Dangers of PHP uploading word docs into a quarantine

Question

I plan to write a PHP script which will allow web users to upload MS Word formatted docs. Here are the precautions I am taking:

• Filenames will be created by me (something like YYYY-MM-DD.doc)
• Files will have 600 or lower permissions.
• Files will not be touched until they're downloaded via FTP.
• File size is limited.

I've been looking into ways to verify that a file is a valid word doc, but the strategies all seem flawed and very time consuming. Once they are downloaded to a computer for review, I let the computer's antivirus take over in case of a valid word doc that is somehow infected.

Does placing the files in a sort of quarantine, as outlined above, mitigate the dangers of not verifying that its word formatted?

Answer 1

What dangers are you worried about?

Are you worried about dangers to the server? If so, the precautions seem adequate: nothing you're doing is treating the files as anything but a collection of bytes, so even a file with a harmful payload won't do anything to the server.

Are you worried about dangers to other computers? If so, your precautions are inadequate, but verifying that the files are Word documents won't help much: custom-built malware can get past an antivirus scanner, and even valid Word documents can carry malware.

Are you worried about your server being used to transmit illegal material? In this case, you'll need to do deep, possibly manual, inspection of uploads, because a Word document can embed images, or can carry classified information, or...