Linked Questions

161
votes
14answers
17k views

What is the safest way to deal with loads of incoming PDF files, some of which could potentially be malicious?

As an investigative journalist I receive each day dozens of messages, many of which contain PDF documents. But I'm worried about some of the potentially malicious consequences of blindly opening them ...
25
votes
3answers
7k views

How can I be protected from pictures vulnerabilities?

I've just read this question What is the corrupted image vulnerability? How does it work? (GIFAR, EXIF data with javascript, etc..) I'm asking myself how can I protect myself and my website's users. ...
17
votes
4answers
8k views

Is it safe to serve any user uploaded file under only white-listed MIME content types?

Let's say I develop an application that, Allows any user to upload a file of only white listed mime content type and extensions (word and pdf). Serves those files with the allowed extension and ...
19
votes
4answers
2k views

Is it safe to store and replay user-provided mime types?

If a user uploads a file but modifies the request by setting the mime-type to something arbitrary, like "superdangerous/blackhatstuff", is it safe for me to send the same mime type back to a different ...
17
votes
3answers
5k views

Using file extension and MIME type (as output by file -i -b) combination to determine unsafe files?

We allow users to upload a number of files, all of which we either send over to scribd (doc, xls, ppts, etc) or display as a video ourselves (flv, mov, mp4, etc in flowplayer). To avoid users ...
7
votes
2answers
5k views

C# Image.FromStream is that secure?

after reading the data from the request as Stream i needed to convert it to Image so i used this Method: Stream inputStream = HttpContext.Current.Request.InputStream; Image img = Image.FromStream(...
14
votes
1answer
1k views

Which files are more insecure than others?

Regarding the fact (in case it's not always the proven fact, then an opinion) that there are types of files more safe for handling them after getting from the Internet than the other, I'd like to ask: ...
2
votes
4answers
2k views

Security risks of hosting user-supplied images?

I have a program that will accept and fetch images from urls. It will check if the extension is .png, .jpg, etc... I will fetch these files and store them, they will be shown to users in a gallery (...
3
votes
2answers
1k views

Risks of serving untrusted content under HTTP Content-Type: text/plain?

Am I gonna run into XSS attacks by doing this, or will a file download be prompted? Are there security problems that would rise in a modern browser?
1
vote
3answers
2k views

DNS queries with hex string that is a SHA1 of a domain name! Is it a malware?

My computer does a lot of queries to strange domains such as: 56cea5c2b408989ab067adcb787d0f99209bbe07.mydomain.com The strange thing is that 56cea5c2b408989ab067adcb787d0f99209bbe07 is the SHA1 of ...
2
votes
2answers
467 views

Protecting websites from outdated browsers and plugins via a whitelist/blacklist combination?

Aside from using browser headers, I want to blacklist/whitelist browser and plugins from my site so that I can prevent these older unpatched systems from (1) being a general user of my site (2) ...