Linked Questions

20 votes
3 answers
23k views

Does X-Content-Type-Options really prevent content sniffing attacks?

In Tangled Web Michal Zalewski says: Refrain from using Content-Type: application/octet-stream and use application/binary instead, especially for unknown document types. Refrain from returning ...
Andrei Botalov's user avatar
3 votes
6 answers
28k views

Use PHP to check uploaded image file for malware?

I want my users to be able to upload a photo. Currently I am not checking the uploaded photo for problems of any kind, although I do limit the size to 32k. Is there any way for me to check uploaded ...
Frank E's user avatar
  • 113
8 votes
3 answers
3k views

How to safely allow upload of executable files [duplicate]

I need help regarding file uploading. In one of my projects the client wants to allow a file upload without restrictions on the file type. But I'm afraid that then users can upload executable files ...
Ravi's user avatar
  • 89
10 votes
3 answers
7k views

Security/Malware implications of storing data in a BLOB as opposed to the file system

From a programming perspective, there has long been a debate over whether to store files in a BLOB or Binary field in a database, or on the file system. The debate always seems to center around ...
David Stratton's user avatar
2 votes
4 answers
3k views

Security risks of hosting user-supplied images?

I have a program that will accept and fetch images from urls. It will check if the extension is .png, .jpg, etc... I will fetch these files and store them, they will be shown to users in a gallery (...
Lucas Kauffman's user avatar
14 votes
1 answer
2k views

Which files are more insecure than others?

Regarding the fact (in case it's not always the proven fact, then an opinion) that there are types of files more safe for handling them after getting from the Internet than the other, I'd like to ask: ...
rem's user avatar
  • 2,127
2 votes
1 answer
870 views

Have I done enough not be compromised through image uploading

I know that you can never be sure that you have done enough to be secure, and I also know that file uploading is hard to make correct. Before asking this question I read some of the related posts here ...
Salvador Dali's user avatar
1 vote
2 answers
687 views

Malware prevention of data received in a POST endpoint

Problem Having one HTTPS api which has an endpoint i.e POST data how can we prevent/check that the data received is not malicious or possibly detrimental? To consider (please read) POST data receives ...
Federico Baù's user avatar
3 votes
2 answers
387 views

Multiple extension vulnerability. Is this malicious file triggered during form preview or after it has been uploaded?

I'm looking at one of our compromised web server logs and we found that an attacker has uploaded a file with multiple extension. Below is the IIS log. The log format are as below. I have removed the ...
john doe's user avatar
2 votes
1 answer
657 views

How confident is MIME blacklisting on a proxy server?

We are blacklisting a number of MIME types on our proxy server so users can't download certain file types, for example, executables. Could it be possible that somehow, a malicious server can trick a ...
lithium's user avatar
  • 23