Linked Questions
13 questions linked to/from Is it safe to store and replay user-provided mime types?
21
votes
4
answers
13k
views
Is it safe to serve any user uploaded file under only white-listed MIME content types?
Let's say I develop an application that,
Allows any user to upload a file of only white listed mime content type and extensions (word and pdf).
Serves those files with the allowed extension and ...
- 525
20
votes
3
answers
23k
views
Does X-Content-Type-Options really prevent content sniffing attacks?
In Tangled Web Michal Zalewski says:
Refrain from using Content-Type: application/octet-stream and use application/binary instead, especially for unknown document types. Refrain from returning ...
- 5,317
17
votes
3
answers
7k
views
Using file extension and MIME type (as output by file -i -b) combination to determine unsafe files?
We allow users to upload a number of files, all of which we either send over to scribd (doc, xls, ppts, etc) or display as a video ourselves (flv, mov, mp4, etc in flowplayer).
To avoid users ...
- 1,087
3
votes
6
answers
27k
views
Use PHP to check uploaded image file for malware?
I want my users to be able to upload a photo. Currently I am not checking the uploaded photo for problems of any kind, although I do limit the size to 32k.
Is there any way for me to check uploaded ...
- 113
8
votes
3
answers
3k
views
How to safely allow upload of executable files [duplicate]
I need help regarding file uploading. In one of my projects the client wants to allow a file upload without restrictions on the file type. But I'm afraid that then users can upload executable files ...
- 89
10
votes
3
answers
7k
views
Security/Malware implications of storing data in a BLOB as opposed to the file system
From a programming perspective, there has long been a debate over whether to store files in a BLOB or Binary field in a database, or on the file system. The debate always seems to center around ...
- 2,686
10
votes
2
answers
4k
views
Why should I restrict the content type of files be uploaded to my site?
We are building an application where users can upload resumes in our system for our administrators to download. We are having a debate about restricting the content type of the files that can be ...
- 525
11
votes
4
answers
3k
views
Preventing insecure webapp on subdomain compromise security of main webapp
I want your help on getting more concrete information on a type of vulnerability that I remember vaguely.
I vaguely remember hearing about a year ago that if you set up a webapp on a subdomain, and ...
- 1,998
8
votes
5
answers
2k
views
How should I serve untrusted / unsanitized documents (PDF, DOC, XLS) to end users over the web?
My website will be hosting documents for end users and I would like to make this as secure as possible.
Question
Assuming that I have a need to share documents on a website that may contain hostile ...
- 50.6k
2
votes
4
answers
3k
views
Security risks of hosting user-supplied images?
I have a program that will accept and fetch images from urls. It will check if the extension is .png, .jpg, etc...
I will fetch these files and store them, they will be shown to users in a gallery (...
- 54.3k
8
votes
2
answers
3k
views
Restrict JS in SVGs
Does anyone know of a way to prevent JS from running inside of an SVG or stripping out JS from an SVG? In my use case I'd prefer to keep the image as an SVG and not convert it to a JPG. I've thought ...
- 349
3
votes
1
answer
3k
views
Unrestricted File upload [closed]
I am working on a file upload feature in our app. Users can also download uploaded files from the app. To prevent malicious file upload, I am checking magic bytes of the file to find the file type ...
- 261
1
vote
2
answers
246
views
Malware prevention of data received in a POST endpoint
Problem
Having one HTTPS api which has an endpoint i.e POST data how can we prevent/check that the data received is not malicious or possibly detrimental?
To consider (please read)
POST data receives ...
- 65