CODEWITHSUNDEEP
phpupload
JSW189
JSW189

Reputation: 6325

Dangerous file types to avoid in file-sharing website

I am making a small file-sharing website where users can upload content. Recently somebody uploaded a PHP script that was presumably intended to harm the site. It got me thinking: what file types should I block users from uploading? I have already blocked .exe files. What other file types could cause harm to either my website or its users?

This script can be viewed here.

Upvotes: 4

Views: 2791

Answers (3)

CesarB
CesarB

Reputation: 45575

That script could euphemistically be described as a remote administration script.

You should always use a whitelist, not a blacklist. Instead of "enumerating badness", make a list of allowed file types and reject everything else.

Also, all files uploaded should be put in a directory which does not run the PHP handler, or any other script handlers at all (check for instance what other content management systems written in PHP do in the .htaccess for their upload directories).

It is also a good idea to put the uploaded files in a separate subdomain which does not have any access to the cookies of the main domain, to avoid attacks which attempt to run JavaScript code on the same origin as the main site (a whitelist of content types is not enough for this, since some browsers are known to guess the content type and treat non-HTML files as HTML).

Upvotes: 1

Niet the Dark Absol
Niet the Dark Absol

Reputation: 324750

It looks like the script is cut off while it's still defining functions, so I can't make out what it's doing.

However, if you're doing things correctly you should have an .htaccess file in your "uploaded files" directory with:

Header set Content-Disposition "attachment"

This will ensure that accessing any file in that directory will result in a download, and that script will not be run.

(Actually even better is to have the files outside the webroot, and have a "downloader" php script echoing the file contents)

Upvotes: 5

Marc B
Marc B

Reputation: 360762

Don't store the files where they're directly accessible - only provide access via a script YOU control. Don't store the files using their user-supplied filename - use a filename YOU generate (best option is to store file details in a database, including the original filename, and store the actual file using that db record's primary key field.

With those two, people can upload antyhing they want, and there'll be zero chance of the file being executed/interpreted on your server, because it's never in a position where it CAN be executed/interpreted.

Upvotes: 9

Related Questions