4

If I were to allow users to host arbitrary PDF/RTF/DOC files on my server all under the same name, but with different query strings would there be anything to worry about? I've heard of PDF/RTF exploits, and I get that someone could perhaps host one of those on my server, but I mean it's not like they can access cookie data or anything through a PDF file. So is this fine to do, or should I be worried?

Should I have them host the files under a different domain name, or am I fine using my original domain?

I've noticed, for example, that a lot of websites like Facebook, Google, YouTube etc. have special domain names for hosting images and other data they allow users to upload, so I'm curious.

Improve this question
3
  • 1
    Facebook, Google et al uses another domain for static content because the servers hosting images can be lightweight servers, not a full-blown webserver. And they can host static content all around the world.
    – ThoriumBR
    Sep 19, 2014 at 20:15
  • @ThoriumBR Oh ok, so then would it be fine of me to allow users to upload pdf/rtf/doc files under my domain?
    – jake192
    Sep 19, 2014 at 20:17
  • In reference to abacabadabacaba's comment, review this video: vimeo.com/103938583 A simple jpg upload functionality contributed to an internal domain controller being compromised.
    – k1DBLITZ
    Sep 22, 2014 at 20:19

2 Answers 2

Reset to default
5

The problem is not that the files could contain exploits, but that they can be made to cause harm when reinterpreted as a different format. For example, someone may upload a file with RTF extension, which is actually a Flash file which is designed to steal cookies or perform CSRF attacks. That's one of the reasons Google hosts all user-provided files on a separate domain, so that the main domain is isolated from such content by same-origin policy.

Improve this answer
0
0

Immediate danger - no.

Potential danger - yes: to anyone's system who is accessing these files. Virus scanning can mitigate some of this risk but is far from perfect.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .