Linked Questions
10 questions linked to/from What are the security risks of letting the users upload content to my site?
20
votes
3
answers
23k
views
Does X-Content-Type-Options really prevent content sniffing attacks?
In Tangled Web Michal Zalewski says:
Refrain from using Content-Type: application/octet-stream and use application/binary instead, especially for unknown document types. Refrain from returning ...
- 5,467
3
votes
6
answers
28k
views
Use PHP to check uploaded image file for malware?
I want my users to be able to upload a photo. Currently I am not checking the uploaded photo for problems of any kind, although I do limit the size to 32k.
Is there any way for me to check uploaded ...
- 113
8
votes
3
answers
3k
views
How to safely allow upload of executable files [duplicate]
I need help regarding file uploading. In one of my projects the client wants to allow a file upload without restrictions on the file type. But I'm afraid that then users can upload executable files ...
- 89
11
votes
3
answers
7k
views
Security/Malware implications of storing data in a BLOB as opposed to the file system
From a programming perspective, there has long been a debate over whether to store files in a BLOB or Binary field in a database, or on the file system. The debate always seems to center around ...
- 2,716
2
votes
4
answers
3k
views
Security risks of hosting user-supplied images?
I have a program that will accept and fetch images from urls. It will check if the extension is .png, .jpg, etc...
I will fetch these files and store them, they will be shown to users in a gallery (...
- 54.7k
14
votes
1
answer
2k
views
Which files are more insecure than others?
Regarding the fact (in case it's not always the proven fact, then an opinion) that there are types of files more safe for handling them after getting from the Internet than the other, I'd like to ask:
...
- 2,127
2
votes
1
answer
883
views
Have I done enough not be compromised through image uploading
I know that you can never be sure that you have done enough to be secure, and I also know that file uploading is hard to make correct. Before asking this question I read some of the related posts here ...
- 1,765
1
vote
2
answers
804
views
Malware prevention of data received in a POST endpoint
Problem
Having one HTTPS api which has an endpoint i.e POST data how can we prevent/check that the data received is not malicious or possibly detrimental?
To consider (please read)
POST data receives ...
- 65
3
votes
2
answers
404
views
Multiple extension vulnerability. Is this malicious file triggered during form preview or after it has been uploaded?
I'm looking at one of our compromised web server logs and we found that an attacker has uploaded a file with multiple extension. Below is the IIS log. The log format are as below. I have removed the ...
- 31
2
votes
1
answer
669
views
How confident is MIME blacklisting on a proxy server?
We are blacklisting a number of MIME types on our proxy server so users can't download certain file types, for example, executables.
Could it be possible that somehow, a malicious server can trick a ...
- 23