Linked Questions

19
votes
3answers
20k views

Does X-Content-Type-Options really prevent content sniffing attacks?

In Tangled Web Michal Zalewski says: Refrain from using Content-Type: application/octet-stream and use application/binary instead, especially for unknown document types. Refrain from returning ...
25
votes
3answers
7k views

How can I be protected from pictures vulnerabilities?

I've just read this question What is the corrupted image vulnerability? How does it work? (GIFAR, EXIF data with javascript, etc..) I'm asking myself how can I protect myself and my website's users. ...
17
votes
4answers
8k views

Is it safe to serve any user uploaded file under only white-listed MIME content types?

Let's say I develop an application that, Allows any user to upload a file of only white listed mime content type and extensions (word and pdf). Serves those files with the allowed extension and ...
19
votes
4answers
2k views

Is it safe to store and replay user-provided mime types?

If a user uploads a file but modifies the request by setting the mime-type to something arbitrary, like "superdangerous/blackhatstuff", is it safe for me to send the same mime type back to a different ...
13
votes
3answers
17k views

Is it possible to inject HTML into image to provoke XSS?

Some answers mention that it's possible to inject attacker-controlled HTML into images and therefore provoke XSS. I guess that this HTML will be processed by browser only if hole exists in browser. ...
8
votes
3answers
2k views

How to safely allow upload of executable files [duplicate]

I need help regarding file uploading. In one of my projects the client wants to allow a file upload without restrictions on the file type. But I'm afraid that then users can upload executable files ...
8
votes
5answers
2k views

How should I serve untrusted / unsanitized documents (PDF, DOC, XLS) to end users over the web?

My website will be hosting documents for end users and I would like to make this as secure as possible. Question Assuming that I have a need to share documents on a website that may contain hostile ...
11
votes
1answer
6k views

Preventing Server-Side Request Forgeries in Java

The application lets users specify a URL for their profile picture. It fetches the data from the URL and saves it on the server. However, the app is vulnerable to server-side request forgery (SSRF) - ...
2
votes
4answers
2k views

Security risks of hosting user-supplied images?

I have a program that will accept and fetch images from urls. It will check if the extension is .png, .jpg, etc... I will fetch these files and store them, they will be shown to users in a gallery (...
2
votes
1answer
527 views

How confident is MIME blacklisting on a proxy server?

We are blacklisting a number of MIME types on our proxy server so users can't download certain file types, for example, executables. Could it be possible that somehow, a malicious server can trick a ...