File upload allowed extensions principle
List allowed extensions and only allow safe and critical extensions for business functionality. Ensure input validation is applied before validating the extensions.
OWASP Cheat Sheets · all subjects
file_uploads
26 notes, read out of this brain and free to use. Each one was extracted from a source and is re-checked against its exam.
File type validation must not trust Content-Type header
The Content-Type header provided by the user cannot be trusted as it is trivial to spoof. File type must be validated independently of the Content-Type header.
Filename generation strategy
Change the filename to something generated by the application, such as a UUID/GUID, rather than using the user-supplied filename. This prevents various filename-based attacks.
Filename length and character restrictions
Set a filename length limit and restrict allowed characters to a specific subset, such as alphanumeric characters, hyphen, spaces, and periods. Restrict leading periods (hidden files) and sequential periods (directory traversal). Restrict leading hyphens or spaces to make files safer for shell script processing.
File size limit requirement
Set a file size limit to protect the file storage capacity. If files will be extracted or processed, the size limit should account for decompression.
Authorization check for file uploads
Only allow authorized users to upload files. Validation should occur at two levels: authentication level (user must be registered or identifiable) and authorization level (user must have appropriate permissions to access or modify files).
File storage location priorities
Store files following these priorities in order of security: (1) Store on a different host for complete segregation of duties, (2) Store outside the webroot with only administrative access allowed, (3) Store inside the webroot with write-only permissions and proper access controls for read access if required.
File handler mapping for public access
In the case of public access to files, use a handler that maps to filenames inside the application (someid -> file.ext) rather than exposing the actual filesystem paths.
Antivirus and sandbox scanning
Run the file through an antivirus or sandbox to validate that it does not contain malicious data.
Content Disarm and Reconstruct (CDR) for office documents
Run the file through CDR (Content Disarm & Reconstruct) if applicable to the file type, such as PDF and DOCX files.
Library security and updates
Ensure that any libraries used for file handling are securely configured and kept up to date.
CSRF protection for file uploads
Protect the file upload from CSRF attacks.
Double extension bypass attack
Double extensions like .jpg.php can circumvent simple regex patterns like \.jpg. Extension validation must account for this bypass technique.
Null byte bypass attack
Null bytes like .php%00.jpg can truncate the extension, causing .jpg to be removed and .php to become the new extension. Extension validation must decode the filename and account for this bypass.
Extension validation must occur after decoding
Ensure that extension validation occurs after decoding the filename to prevent bypass techniques like null byte injection.
File signature validation with file content validation
File signature validation should be used in conjunction with content-type validation. However, it should not be used on its own as bypassing it is common and easy.
Image rewriting for malicious content destruction
For image uploads, apply image rewriting techniques through randomization to destroy any malicious content injected in the image.
Microsoft document validation with Apache POI
For Microsoft documents, use Apache POI to help validate the uploaded documents.
ZIP files not recommended for upload
ZIP files are not recommended for file uploads since they can contain all types of files and have numerous associated attack vectors.
File content validation with Virus Total API
Some services like Virus Total provide APIs to scan files against well-known malicious file hashes. However, be aware of data leakage threats and information gathering when using public services.
ASP.NET raw content type validation
Frameworks like ASP.NET Drawing Library can check and validate the raw content type and validate it against predefined file types.
Filesystem permissions for uploaded files
Set file permissions on the principle of least privilege. Only allowed system users should be capable of reading the files, and only required modes should be set. If execution is required, scan the file before running it to ensure no macros or hidden scripts are present.
Download rate limiting for DoS protection
Set proper request limits for the download service to protect the server from DoS attacks.
Blocking specific extensions is weak protection
Blocking specific extensions is a weak protection method on its own. Attackers may attempt to bypass such checks through various techniques. An allowlist approach is preferred.
ZIP decompression size calculation security
When calculating ZIP file sizes for upload limits, use secure methods. Refer to secure file extraction techniques such as Java's IDS04-J to safely extract files from ZipInputStream.
Business-critical extensions only for uploads
Use only business-critical extensions without allowing non-required extensions. For example, for image uploads allow one type agreed upon for business requirements; for CV uploads allow docx and pdf extensions only. Choose the least harmful and lowest risk file types.