2

I am using PHP to create a small script that uploads images to a server.

While going through the PHP documentation, I found a contribution from user CertaiN that gives a very clear example of how this script should look like: CertaiN's contribution. The code is, overall, very well explained, but the very first line of the script has no comment or explanation:

header('Content-Type: text/plain; charset=utf-8');

I browsed the internet and found no explanation for this command. My question is, therefore, the following: what is the exact purpose of this line in the protections against malicious uploads? Or is it completely unrelated to the rest of the script?

1

That line does not impact file upload security, it only sets the HTTP response mime type.

The reasoning I can see for the author using text/plain instead of text/html is simply that this script does not contain any actual HTML in the possible response messages.

Although the possible responses in this particular script do not echo any user input that I can tell, using text/plain as the response type instead of text/html would help to mitigate XSS in the page response, which could be possibly triggered via a combination with a CSRF attack from another site if the page did output anything using user input. This script does not protect against CSRF attacks.

Side note: this script does not actually validate that the files are valid images (mime checking is not sufficient). See the relevant Stack Overflow discussion EDIT: Actually, the script does an ok job at that.

You can use text/html if you want, just be careful with user supplied information.

  • 1
    Thanks for the response, I think it's clear enough and I'll mark it as correct. However, regarding your side note, I believe mime checking should be sufficient. Or, at least, that's what everyone seems to suggest in that discussion you linked (as well as many others). In fact, a popular (and incorrect) solution seems to be using the getimagesize() function, which, if you have a look at the [secure.php.net/manual/en/function.getimagesize.php] (php docs), is not recommended. They too mention that using FileInfo is the way to go on this. – Rors Jun 17 at 17:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.