I have a web application (forum software) where I am working on a feature about user attaching files to the forum posts.
The application is written in assembly language and the database is SQLite.
The approach I used is to keep the attached files as a blobs in the database and to allow downloading only with the headers:
Content-type: application/octet-stream Content-Disposition: attachment
This way, the files will never be stored as a files on the server.
Any validations of the file type and content are not planned to be implemented, because are considered superfluous on this setting (and I want to give the users maximal freedom, without compromising the security of course).
It is clear, that uploading huge files is one way to make DoS attacks, but this is not a subject of the preset question.
The possible bugs in the web-application itself, causing buffer overflows and similar are not an issue as well (they are possible, of course, but I want to ask about the architecture, not the implementation).
The questioned setting is the following scheme:
- file-less: from the POST request -> to the SQLite blob field.
- from the SQLite blob field -> to the network and user browser.
- Always: application/octet-stream and Content-Disposition: attachment
- No server validation of the file type and/or content.
And the question is:
What attack vectors are still possible with the above approach?
P.S. The question Pentesting file upload functionality is similar, but mainly discuss the uploaded files as existing in the FS of the server that is different from the system I am asking for.