3

The php.net page on the move_uploaded_file() function contains a User Contributed Note which says,

Security tips you must know before use this function:

First: make sure that the file is not empty.

I really cannot see how an empty file could be any more of a problem than a file that has either benign or malicious contents. Nor have I ever seen this advice before. However, since the note is highly upvoted, perhaps I may be missing something. So, can allowing empty files to be uploaded create any security vulnerabilities/issues or is this part of the advice pointless?

Improve this question
4
  • Taking in consideration the rest of t-he tips like the file name restriction, it looks like OS level concerns.
    – elsadek
    Sep 25, 2020 at 17:55
  • ... but not necessarily dealing with security. I bet there are some limitations in the function itself.
    – elsadek
    Sep 25, 2020 at 18:05
  • @elsadek What sort of concerns? Filename limitations make sense they can cause problems but I'm pretty sure every filesystem can handle empty files. I don't see why the function wouldn't be able to handle empty files. Can you verify?
    – nobody
    Sep 25, 2020 at 18:14
  • may be checking the source code will unveil something.
    – elsadek
    Sep 25, 2020 at 18:36

2 Answers 2

Reset to default
2

I would say it's just security in depth. There are probably no reasons to accept an empty files and this could potentially lead to unexpected behaviors and security issues.

Improve this answer
1
  • 1
    That's possible but I guess corrupt files would be much more likely to lead to unexpected behavior than empty files.
    – nobody
    Sep 25, 2020 at 18:29
2

An empty file is not a problem by being empty, but can lead to problems down the line if the application processing it don't expect empty files.

Throwing an error and stopping processing when detecting an empty file saves work. Maybe the upload failed somehow, or a proxy on the way removed the file, or someone is feeding invalid data. Ending the request here means your validation routines don't need to check this file, as it have nothing to be checked.

Improve this answer
3
  • So basically, it's just meant to be good coding advice, it's not meant to guard against some well-known security issue?
    – nobody
    Nov 8, 2021 at 17:24
  • That attitude is more than bizarre. The first thing after an upload of multiple files would be to check they are all uploaded, and some checksum is correct - and that would fail.
    – gnasher729
    Nov 8, 2021 at 18:08
  • And how you would know if the checksum is correct? Unless the user provides the checksum during upload, you can calculate it but have nothing to compare against.
    – ThoriumBR
    Nov 8, 2021 at 20:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.