CODEWITHSUNDEEP
asp.net
Niraj CHoubey
Niraj CHoubey

Reputation: 467

prevention of exe file upload in a website

Can somebody tell me how to prevent exe file from being uploaded in a website , even if exe file is inside zip file( exe file in a new folder and new folder is then zipped and uploaded)?

Upvotes: 3

Views: 3205

Answers (2)

Bryan
Bryan

Reputation: 8788

Short answer: you can't.
Pedantic answer: Don't have users upload files.

Long answer: What code is handling this uploaded file? What are you doing with it? This is where the security needs to happen. You can explicitly check the file extension in the post handler, but that only gets you so far, as you've already determined.

Some tips: -Drop files in a secure location outside the web root.
-Don't give your ASP.NET process user more permissions than it needs -Give them unique server-generated names and proper extensions.
-Do not call Shell.Execute on user-uploaded files. Duh.

What exactly are you trying to prevent here? Your question is difficult to answer as-is.

Upvotes: 2

Victor Hurdugaci
Victor Hurdugaci

Reputation: 28425

Allow the users to upload the file (if is ZIP) and do a server-side check by unpacking the archive and evaluating its content.

Upvotes: 2

Related Questions