Linked Questions

32
votes
5answers
14k views

What are the security risks of letting the users upload content to my site?

As a web designer (not a security expert) I wonder: If I allow users to upload content to my website (videos, images and text files), what are the real risks involved?
19
votes
3answers
21k views

Does X-Content-Type-Options really prevent content sniffing attacks?

In Tangled Web Michal Zalewski says: Refrain from using Content-Type: application/octet-stream and use application/binary instead, especially for unknown document types. Refrain from returning ...
26
votes
3answers
8k views

How can I be protected from pictures vulnerabilities?

I've just read this question What is the corrupted image vulnerability? How does it work? (GIFAR, EXIF data with javascript, etc..) I'm asking myself how can I protect myself and my website's users. ...
18
votes
4answers
10k views

Is it safe to serve any user uploaded file under only white-listed MIME content types?

Let's say I develop an application that, Allows any user to upload a file of only white listed mime content type and extensions (word and pdf). Serves those files with the allowed extension and ...
23
votes
3answers
6k views

What steps should be taken to validate user uploaded images within an application?

Recently I have worked on a number of applications that need to process user uploaded images steps have been taken to validate the extension and the mime type. But what else can be done to ensure ...
19
votes
4answers
2k views

Is it safe to store and replay user-provided mime types?

If a user uploads a file but modifies the request by setting the mime-type to something arbitrary, like "superdangerous/blackhatstuff", is it safe for me to send the same mime type back to a different ...
17
votes
3answers
6k views

Using file extension and MIME type (as output by file -i -b) combination to determine unsafe files?

We allow users to upload a number of files, all of which we either send over to scribd (doc, xls, ppts, etc) or display as a video ourselves (flv, mov, mp4, etc in flowplayer). To avoid users ...
13
votes
3answers
19k views

Is it possible to inject HTML into image to provoke XSS?

Some answers mention that it's possible to inject attacker-controlled HTML into images and therefore provoke XSS. I guess that this HTML will be processed by browser only if hole exists in browser. ...
7
votes
6answers
3k views

How to defend vs. Image Remote File Inclusion, e.g. RFI using a .gif file (Apache/PHP)?

To defend versus Remote File Inclusion where attackers try to abuse image files, I usually recommend to never use include to include image files into PHP code. Sometimes though, the avoidance of ...
8
votes
5answers
2k views

How should I serve untrusted / unsanitized documents (PDF, DOC, XLS) to end users over the web?

My website will be hosting documents for end users and I would like to make this as secure as possible. Question Assuming that I have a need to share documents on a website that may contain hostile ...
9
votes
2answers
4k views

Why should I restrict the content type of files be uploaded to my site?

We are building an application where users can upload resumes in our system for our administrators to download. We are having a debate about restricting the content type of the files that can be ...
4
votes
2answers
3k views

Possible arbitrary file download vulnerability

I am auditing a possible vulnerable piece of ASP code on a Windows environment. The code is as follows: If InStr(strPath, "\Only\Download\From\Here\", CompareMethod.Text) = 0 Then Basicly it is ...