0

I plan to write a PHP script which will allow web users to upload MS Word formatted docs. Here are the precautions I am taking:

  • Filenames will be created by me (something like YYYY-MM-DD.doc)
  • Files will have 600 or lower permissions.
  • Files will not be touched until they're downloaded via FTP.
  • File size is limited.

I've been looking into ways to verify that a file is a valid word doc, but the strategies all seem flawed and very time consuming. Once they are downloaded to a computer for review, I let the computer's antivirus take over in case of a valid word doc that is somehow infected.

Does placing the files in a sort of quarantine, as outlined above, mitigate the dangers of not verifying that its word formatted?

4
  • What you outlined has nothing to do with file being a valid word doc. It is not very clear what you are asking here.
    – user43488
    Commented Apr 30, 2014 at 21:11
  • Does placing the files in a sort of quarantine, as outlined above, mitigate the dangers [of not making sure the uploaded file is a word doc]? Commented Apr 30, 2014 at 21:36
  • Are you worried about the infection on your server or on the client who will later download? Are you processing the file, or are just uploading and storing?
    – Eric G
    Commented May 1, 2014 at 2:19
  • Remember to store them outside of web root if you do not want anyone downloading them without FTP (e.g. by going to http://www.example.com/uploads/2014-05-02.doc). Commented May 2, 2014 at 16:46

1 Answer 1

4

What dangers are you worried about?

Are you worried about dangers to the server? If so, the precautions seem adequate: nothing you're doing is treating the files as anything but a collection of bytes, so even a file with a harmful payload won't do anything to the server.

Are you worried about dangers to other computers? If so, your precautions are inadequate, but verifying that the files are Word documents won't help much: custom-built malware can get past an antivirus scanner, and even valid Word documents can carry malware.

Are you worried about your server being used to transmit illegal material? In this case, you'll need to do deep, possibly manual, inspection of uploads, because a Word document can embed images, or can carry classified information, or...

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .