I maintain a website were users are allowed to upload files. I'm doing already some good MIME-checks, consistency checks, virus checks, blacklist checks based on hash lists, some other custom checks and also I used most of the best-practices around the file upload functionality. But I was thinking about the following worst-case scenario:
Let's say a user will succeed in uploading a SWF file and will be able to access it from my domain and execute it in a browser. Could I isolate or reduce the risks by adding a strict crossdomain.xml file already? Just to prevent escalation in this scenario.
My site is currently not using any flash or silverlight and for that reason I suppose I don't need a crossdomain.xml file. Nevertheless, I'm wondering if I do good to setup a strict configured crossdomain.xml file in case a user will be able to upload and execute malicious code (for example using flash).
I would love to hear some opinions about this! Thanks in advance!