Linked Questions
13 questions linked to/from How can I be protected from pictures vulnerabilities?
8
votes
3
answers
3k
views
How to safely allow upload of executable files [duplicate]
I need help regarding file uploading. In one of my projects the client wants to allow a file upload without restrictions on the file type. But I'm afraid that then users can upload executable files ...
- 89
1
vote
1
answer
964
views
How can I make sure an image uploaded to my server is not harmful? [duplicate]
I would like to allow users of my app to upload images in different formats that other users can view (including webm videos).
But I would also like to make sure that the images are actual images and ...
- 155
52
votes
4
answers
145k
views
How to inject executable, malicious code into PDF, JPEG, MP3, etc.?
I wanted to know if its generally possible to inject executable code into files like PDFs or JPEGs etc., or must there be some kind of security hole in the application?
And if so, how would one do ...
- 1,413
25
votes
4
answers
10k
views
What is the corrupted image vulnerability? How does it work?
What exactly happens when someone injects malicious binary code into an image file (on Windows)? How is that done?
- 1,851
20
votes
3
answers
23k
views
Does X-Content-Type-Options really prevent content sniffing attacks?
In Tangled Web Michal Zalewski says:
Refrain from using Content-Type: application/octet-stream and use application/binary instead, especially for unknown document types. Refrain from returning ...
- 5,357
26
votes
3
answers
9k
views
What steps should be taken to validate user uploaded images within an application?
Recently I have worked on a number of applications that need to process user uploaded images steps have been taken to validate the extension and the mime type.
But what else can be done to ensure ...
- 9,457
17
votes
3
answers
7k
views
Using file extension and MIME type (as output by file -i -b) combination to determine unsafe files?
We allow users to upload a number of files, all of which we either send over to scribd (doc, xls, ppts, etc) or display as a video ourselves (flv, mov, mp4, etc in flowplayer).
To avoid users ...
- 1,087
14
votes
3
answers
26k
views
Is it possible to inject HTML into image to provoke XSS?
Some answers mention that it's possible to inject attacker-controlled HTML into images and therefore provoke XSS.
I guess that this HTML will be processed by browser only if hole exists in browser. ...
- 5,357
8
votes
5
answers
2k
views
How should I serve untrusted / unsanitized documents (PDF, DOC, XLS) to end users over the web?
My website will be hosting documents for end users and I would like to make this as secure as possible.
Question
Assuming that I have a need to share documents on a website that may contain hostile ...
- 50.7k
9
votes
2
answers
6k
views
C# Image.FromStream is that secure?
after reading the data from the request as Stream i needed to convert it to Image so i used this Method:
Stream inputStream = HttpContext.Current.Request.InputStream;
Image img = Image.FromStream(...
- 191
2
votes
4
answers
3k
views
Security risks of hosting user-supplied images?
I have a program that will accept and fetch images from urls. It will check if the extension is .png, .jpg, etc...
I will fetch these files and store them, they will be shown to users in a gallery (...
- 54.4k
5
votes
5
answers
328
views
Should there be an anti-virus used on client provided files?
This is based on Stack Exchange podcast # 25.
I really don't understand why there would need to be virus checking on uploaded files. It would generally be a bad idea to execute anything which was ...
- 181
2
votes
1
answer
639
views
How confident is MIME blacklisting on a proxy server?
We are blacklisting a number of MIME types on our proxy server so users can't download certain file types, for example, executables.
Could it be possible that somehow, a malicious server can trick a ...
- 23