Is no access control on file upload/file download of safe types considered a vulnerability [closed]

Question

Under the theoretical assumption that file uploads were correctly protected (i.e no malicious file types, extensions, scanning etc.), what are the concerns with having no access control on file upload/file download capabilities if the only identifier was a GUID to access an uploaded file.

I think the main concern I have is that it could be utilised as a free file hosting server for pirated media, or could be flooded with bulk files to consume the data storage to interrupt the service from running correctly.

What are other arguments are there against having no access control on file uploads?

Answer 1

Assuming nothing malicious is able to get through (a huge assumption, which I would assume to not be possible!). Without access control you will possibly attract:

• DOS by bulk upload
• Possible illegal content sharing (including kiddy porn...)
• Zero day vulnerabilities in files that you cannot protect from (this falls outside of your assumption as the assumption must be that there are always undetected vulnerabilities);
• You will have no way to block accounts or people (IP's are dynamic...) when the police come nocking
• Check your local countries laws on who is responsible for the content. In case of kiddy porn it might be that you can be held responsible!

Hopefully this helps a bit?

Answer 2

To expand a little on @Wealot's answer, if you want to benefit from DMCA Safe Harbor provisions, it seems there may be a requirement that you be able to deal with repeat infringers.

I am absolutely not a lawyer, but I did have a check into the DMCA, and came across this document: https://www.eff.org/deeplinks/2011/01/dmca-copyright-policies-staying-safe-harbors-while

the DMCA requires that service providers "adopt and reasonably implement" a repeat infringer policy that provides for termination of users' accounts "in appropriate circumstances."

Checking the EFF's document, it seems (but I am reading between lines) that this requirement is in fact fairly important in terms of your ability to claim Safe Harbor applies to you.