0

We have developed an application with contain file upload functionality. We use that application for internal purpose only. We use core php language.

We already use the below validations:

  1. File extension checks (allow only CSV, txt, SQL).

  2. File size checks (allow only 50 MB). We allow bulk upload as well.

  3. MIME Type.

We are planing to check the file content as well for malicious file upload. How do we do that?

  • Unfortunately, we can't help with the "libarary" part of your question. – schroeder Dec 5 '19 at 20:03
  • Why not just run anti-virus/malware on the file upload folder? – schroeder Dec 5 '19 at 20:05
1

That depends entirely on the file in question.

For example, if you want to enable users to just upload plain text files, then it may be enough to check if there are any unprintable characters in the file.

If you allow users to upload images, you have to make sure that the files are actually images. This is best done with tools like ImageMagick.

This list goes on and on, and depends exactly on what files you want to allow. If you want to allow arbitrary files, then you can't make any file type checks.

What not to do

Never go for file extensions, MIME type or naive magic numbers. File extensions can be changed trivially, even by less experienced users. MIME types can be evaded by any even moderately experienced attacker, just like magic numbers.

  • Only CSV, txt, SQL allowed – schroeder Dec 5 '19 at 20:04
  • @schroeder Weird. I must have read past that. Let me edit – MechMK1 Dec 5 '19 at 21:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.