File upload filename validation
Use input validation to ensure the uploaded filename uses an expected extension type. Ensure the uploaded file is not larger than a defined maximum file size.
OWASP Cheat Sheets · all subjects
input_validation/file_upload
13 notes, read out of this brain and free to use. Each one was extracted from a source and is re-checked against its exam.
ZIP file upload validation requirements
If the website supports ZIP file upload, do a validation check before unzipping the file. The check includes the target path, level of compression, estimated unzip size.
File storage with randomized filename
Use a new filename to store the file on the OS. Do not use any user controlled text for the filename or for the temporary filename. When the file is uploaded, rename it to use a random filename (e.g. uploaded test.JPG renamed to JAI1287uaisdjhf.JPG) to prevent risks of direct file access and ambiguous filename to evade the filter such as test.jpg;.asp or /../../../../../test.jpg.
Uploaded file malicious content analysis
Uploaded files should be analyzed for malicious content using anti-malware and static analysis.
File path specification restriction
The client should not be able to specify the file path; it should be defined by the server.
Uploaded image content-type header
Ensure uploaded images are served with the correct content-type header (e.g. image/jpeg, image/png).
Dangerous file types to restrict: crossdomain.xml and clientaccesspolicy.xml
Files named crossdomain.xml or clientaccesspolicy.xml allow cross-domain data loading in Flash, Java and Silverlight. If permitted on sites with authentication this can permit cross-domain data theft and CSRF attacks. These files should be prohibited.
Dangerous file types to restrict: .htaccess and .htpasswd
Files .htaccess and .htpasswd provide server configuration options on a per-directory basis and should not be permitted.
Web executable script files to restrict
Web executable script files are suggested not to be allowed such as aspx, asp, css, swf, xhtml, rhtml, shtml, jsp, js, pl, php, cgi.
File type allowlist approach
The upload feature should be using an allowlist approach to only allow specific file types and extensions.
Image rewriting for upload verification
Use image rewriting libraries to verify the image is valid and to strip away extraneous content.
Image extension assignment based on detected content type
Set the extension of the stored image to be a valid image extension based on the detected content type of the image from image processing. Do not just trust the header from the upload.
Image content type validation
Ensure the detected content type of the image is within a list of defined image types (jpg, PNG, etc).