Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
A comment to this blog post at sans.org about secure file uploads suggests making a pre-formatted template available for users when they need to do file uploads. The user would use the template to add their own data and upload the resulting file. It suggests "encode the template in some way that an attacker would have a difficult time spoofing..."
This would supposedly help stop malicious files masquerading as the correct file types.
Would this work and how would one "encode" the template?
Firstly, I don't think what that commenter posted is great general advice.
I'm assuming what they mean is try to validate some attribute of the file format you're expecting. For example, if you're expecting a .docx file you might validate that it's an archive containing a folder called /word/ and that directory contains a file called document.xml and that document contains some tag/markup either unique to your template or required by .docx files.
The idea is that it'd be difficult for an attacker to make a file which conforms to these requirements but is still malicious.
Frankly I think this would only work in certain very specific scenarios and I think most of the security would come from obscurity (ie. the attacker not knowing exactly what your validation criteria are).
The advice about assigning files a random name, not putting them in a publicly accessible directory, not giving them execute permissions, etc. is more important.
