0

On nodejs-express, I need a file upload function for my website's bulletin board so that every user can upload and download files for each other.

For security reasons, I use npm module 'mmmagic' for validating if uploaded file's mime-type is not modulated (e.g. png) -or is in whitelist which I accepted. And I'm considering using 'helmet' module for enhanced security with noSniff().

My question is, does .txt files can execute or inject malicious code by attackers, and do something they want?

I saw my messenger app accept files that is javascript (.js) file, and others when the file's extension is covered with .txt at the end.

Like: sample.js.txt

I can't decide whether I should restrict files even their extension is covered with txt or not. Thanks in advance.

3
  • 1
    Why do you think security would be improved if you blocked .txt files?
    – jfriend00
    Aug 27 '20 at 3:52
  • Well, maybe, could be used for attacker with something??
    – J Jin
    Aug 27 '20 at 4:34
  • I saw the @schroeder's comments on Gg8's answer on here
    – J Jin
    Aug 27 '20 at 4:35
0

A file by itself is not malicious, it is just data. It depends on how it gets used. If a text file gets somehow interpreted in an unexpected context, for example as shell commands, then it can cause harm too. Similar some seemingly malicious code binary does not cause any harm as long as it does not gets executed or loaded as library.

In other words: one need to how the file will be used later before you can decide what filtering and restrictions you need to apply. Your question offers no information in this regard and thus it cannot be answered if text file can be malicious or not.

5
  • Thanks for your answer. I need a file upload function for my website's bulletin board so that every user can upload and download files for each other.
    – J Jin
    Aug 27 '20 at 5:39
  • @JJin: "upload" and "download" is just a data transfer and by themselves not dangerous. But when implementing the download wrong one can enforce a context in the browser which might cause problems, like Javascript context or CSS context. The rest of the context if what the user does with the downloaded files, which might depend on the extensions - but often the extension is ignored too. Still, it is unknown what the user does with the files. Instead of allowing sharing of arbitrary files with some curated deny list it would be the safer approach to allow only sharing of specific file types. Aug 27 '20 at 5:47
  • I heard that attacker can inject web shellcodes in .png format file. Could this be dangerous for my nodejs server if I don't make a whitelist of extensions and mime-type checked with its magic number?
    – J Jin
    Aug 27 '20 at 6:25
  • @JJin: again, it fully depends on the context where the file is executed. If the context allows to include a file with extension png to be included as script, then it will try to interpret this file as script - no matter what the extension says. Also "magic numbers" are just dumb heuristics focused on giving a positive (probably is a PNG) but not a negative (definitely is no Javascript). Have a look at polyglot documents which are interpreted differently based on the context. Aug 27 '20 at 6:38
  • Thanks for your help :)
    – J Jin
    Aug 27 '20 at 6:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.