If a user uploads a file but modifies the request by setting the mime-type to something arbitrary, like "superdangerous/blackhatstuff", is it safe for me to send the same mime type back to a different user later on?
I.e. another user downloads the same file and I set the mimetype to "superdangerous/blackhatstuff", is it possible to set the mime type to something potentially dangerous? Because it is user-supplied data, I get the feeling it's not a good idea to store and replay without some kind of sanitization. (I am of course, sanitizing the query before I store the mime type, so I'm not concerned with SQL injection attacks via the mime type.)
I am using clam AV to scan uploaded files, which hopefully catches some of the mime sniffing attacks, but that's not really what I'm asking about here.
If this is, in fact, dangerous, then what is the proper thing to do? Should I not specify a mime-type at all, and let the receiver guess it? Should I try to do my own mime sniffing (I'm using PHP on Linux, which provides an API for file magic.)
Edit: More Details
Let me explain the purpose of this feature. The application in question is used as part of a workflow that requires various kinds of artifacts to be submitted for review and approval, including (but not limited to), word docs, spreadsheets, images, and archives. Other users will need to be able to download these artifacts in order to view them and make an approval decision.
Anyway, point being is that I'm not asking about the safety of storing files and letting users download those files. (I realize it's a large threat vector, but it's not the question I'm asking.) I'm really more concerned about whether it's safe to replay a user-supplied mime-type, and if not, what is the alternative? To not specify a mime type at all?
image/pjpegwhen it means
image/jpeg; thus, JPEGs uploaded from IE will only display correctly in IE, if you trust the browser-supplied MIME type.