1

On nodejs-express, I need a file upload function for my website's bulletin board so that every user can upload and download files for each other.

For security reasons, I use npm module 'mmmagic' for validating if uploaded file's mime-type is not modulated (e.g. png) -or is in whitelist which I accepted. And I'm considering using 'helmet' module for enhanced security with noSniff().

My question is, does .txt files can execute or inject malicious code by attackers, and do something they want?

I saw my messenger app accept files that is javascript (.js) file, and others when the file's extension is covered with .txt at the end.

Like: sample.js.txt

I can't decide whether I should restrict files even their extension is covered with txt or not. Thanks in advance.

Improve this question
3
  • 1
    Why do you think security would be improved if you blocked .txt files?
    – jfriend00
    Commented Aug 27, 2020 at 3:52
  • Well, maybe, could be used for attacker with something??
    – J Jin
    Commented Aug 27, 2020 at 4:34
  • I saw the @schroeder's comments on Gg8's answer on here
    – J Jin
    Commented Aug 27, 2020 at 4:35

1 Answer 1

Reset to default
1

A file by itself is not malicious, it is just data. It depends on how it gets used. If a text file gets somehow interpreted in an unexpected context, for example as shell commands, then it can cause harm too. Similar some seemingly malicious code binary does not cause any harm as long as it does not gets executed or loaded as library.

In other words: one need to how the file will be used later before you can decide what filtering and restrictions you need to apply. Your question offers no information in this regard and thus it cannot be answered if text file can be malicious or not.

Improve this answer
4
  • Thanks for your answer. I need a file upload function for my website's bulletin board so that every user can upload and download files for each other.
    – J Jin
    Commented Aug 27, 2020 at 5:39
  • @JJin: "upload" and "download" is just a data transfer and by themselves not dangerous. But when implementing the download wrong one can enforce a context in the browser which might cause problems, like Javascript context or CSS context. The rest of the context if what the user does with the downloaded files, which might depend on the extensions - but often the extension is ignored too. Still, it is unknown what the user does with the files. Instead of allowing sharing of arbitrary files with some curated deny list it would be the safer approach to allow only sharing of specific file types.
    – Steffen Ullrich
    Commented Aug 27, 2020 at 5:47
  • I heard that attacker can inject web shellcodes in .png format file. Could this be dangerous for my nodejs server if I don't make a whitelist of extensions and mime-type checked with its magic number?
    – J Jin
    Commented Aug 27, 2020 at 6:25
  • @JJin: again, it fully depends on the context where the file is executed. If the context allows to include a file with extension png to be included as script, then it will try to interpret this file as script - no matter what the extension says. Also "magic numbers" are just dumb heuristics focused on giving a positive (probably is a PNG) but not a negative (definitely is no Javascript). Have a look at polyglot documents which are interpreted differently based on the context.
    – Steffen Ullrich
    Commented Aug 27, 2020 at 6:38

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .