Is it possible for an uploaded PDF file to harm an Apache server, if the filepath can't be found? That is, the PDF file can't be viewed from the browser or accessed by a known path once uploaded.
I have a feature within a Drupal site that allows anyone to upload a PDF file in order to have some ImageMagick processing done to it. The resulting file is a JPEG.
The PDF file is automatically deleted a soon as the JPEG is viewed. But I'm concerned that even during the short processing time, a malicious PDF could do harm to the server. Or that the IMageMagick processing can be interrupted and allow the PDF file to live on the server.
Here's the procedure:
User browses for and chooses the PDF file.
User Saves the node.
- the ability to view the uploaded PDF prior to saving the node has been disabled (unset in the form, not just hidden)
- on upload, the PDF file name changes, and the upload directory name contains a random string
- there is a file size limit
- supposedly the mimetype is detected using PHP FileInfo but I can't tell if that's working (a test indicates it's not)
ImageMagick processing occurs.
The new node is automatically displayed.
- PDF file is automatically deleted as soon as the node is viewed
- The new node contains only a link to the resulting JPEG