1

The php.net page on the move_uploaded_file() function contains a User Contributed Note which says,

Security tips you must know before use this function :

First : make sure that the file is not empty.

I really cannot see how an empty file could be any more of a problem than a file that has either benign or malicious contents. Nor have I ever seen this advice before. However, since the note is highly upvoted, perhaps I may be missing something. So, can allowing empty files to be uploaded create any security vulnerabilities/issues or is this part of the advice pointless?

Improve this question
4
  • Taking in consideration the rest of t-he tips like the file name restriction, it looks like OS level concerns. – elsadek Sep 25 '20 at 17:55
  • ... but not necessarily dealing with security. I bet there are some limitations in the function itself. – elsadek Sep 25 '20 at 18:05
  • @elsadek What sort of concerns? Filename limitations make sense they can cause problems but I'm pretty sure every filesystem can handle empty files. I don't see why the function wouldn't be able to handle empty files. Can you verify? – nobody Sep 25 '20 at 18:14
  • may be checking the source code will unveil something. – elsadek Sep 25 '20 at 18:36
1

I would say it's just security in depth. There are probably no reasons to accept an empty files and this could potentially lead to unexpected behaviors and security issues.

Improve this answer
1
  • That's possible but I guess corrupt files would be much more likely to lead to unexpected behavior than empty files. – nobody Sep 25 '20 at 18:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.