Tuesday, February 3, 2009

File Upload Security


Hi, guys.


I haven’t written for a while, but better late than never... So, what is the story?

In web development exist the problem with uploading files with malicious content, which can harm the server or the system (site) at all. The most common way to protect from this is to restrict file types by checking file extension and mime-types, and only allow certain types to be uploaded. But in some situation it’s not enough.
To start with brief explanation of what is mime-type and file extension. Mime-type (Multimedia Internet Mail Extensions) describes what kind of information file contains. In addition mime-types are used by web servers to specify file type when it responds to the browser's HTTP request (stored in HTTP header). Every browser interprets mime-type in its own way and every file may have more than one mime-type.
Everybody knows what the file extension is. It’s the same as mime-type, but it’s used by operating system to know the type of data in file and which program windows must use to open it. Some OS (UNIX) are not supporting file extensions.
To perform more security we may check not only mime-types and extension as well as file signature. Every file has unique characters in the first 20 bytes (may be less than 20 and not exactly consecutively). This data are presented in two forms – hexadecimal and ASCII text. Second one is not necessary to have sense (Pdf files have ASCII text “%PDF“, for example). To read file header from stream, you may use this C# code:


string hex = string.Empty;

int bytesToReading = (stream.Length < 20) ?

Convert.ToInt32(stream.Length) : 20;

Byte[] bytes = new byte[bytesToReading];

stream.Read(bytes, 0, bytesToReading);

for (int i = 0; i < bytesToReading; i++)

{

if (bytes[i] != 0)

{

hex += bytes[i].ToString("X");

}

}

stream.Position = stream.Seek(-bytesToReading, SeekOrigin.Current);



I’ll give a simple solution to put all this in your system. In xml file describes “file” objects, which will have extension, list of mime-types and list of possible hex signatures, which file may have. This information you can get form internet (http://www.garykessler.net/library/file_sigs.html, http://mark0.net/soft-trid-deflist.html). I recommend you to check signatures in more than one source. This xml file will collect “files”, which system will allow to be uploaded. Then parse the information from xml and fill it in static objects representing the xml structure. System will allow uploading a file, when his extension, mime-type and hex signature match with some of these with one from static “file” objects. And this simple solution will prevent unnecessary file uploading.

When searching the internet about this issue I found a very simple and useful tool called TrIDNet, which identify file by its content.

I will glad to hear your opinion about the problem.

40 comments:

AmberlyThrower said...

情色影片線上直播情色影片網情色火影忍者成人影片您要求的影片無法使用性交易影片性交易卡通影片性交成人影片性交影片快速動作性交影片貼圖性交影片直播性交影片性交口交陰戶影片性交免費影片性交線上影片性交影片liz名模寫真集la論壇kiss104貼圖區j我愛78論壇jp影片分享區jp免費影片jp免費成人影片jp成人貼圖網jp日本無料動畫jpdvdjolin圖japanav短片japanav免費電影i一葉晴貼圖區ivy許嘉凌寫真陰唇圖貼陰唇陰部圖陰部做愛自拍圖片陰部貼圖陰部自拍陰道濕潤讓性更完美陰道收縮影片陰道圖貼陰道啞鈴陰道內射自拍陰道貼影區陰道裸圖陰道陰唇寫真陰道陰莖

陽明山花季 said...

Better say nothing than nothing to the purpose. ........................................

泰秋 said...

I love readding, and thanks for your artical...................................................

惠蘋 said...

雖然說上班很累,不過還是得努力應付每一天,看看文章休息一下,謝謝你哦!........................................

勝丹勝丹 said...

Hello~Nice to meet you~..................................................

火芬 said...

恐佈哦~~
相愛?相害?
看了鬼故事之後讓你睡不著覺
洗臉的女孩
紅燒人頭,可好吃了
紅布床簾

婉菁 said...

I love readding, and thanks for your artical. ........................................

士瑋 said...

sex女,ut,貼影,av,高潮,女優,做愛,手機成人影片,色遊戲,成人動漫,百分百貼圖區,85cc影片,成人影音,av色情影片,A片線上,a片,sex,777,三級線上看,美女的照片,視訊做愛,78論壇,打飛機,免費視訊,成人影院,辣妹視訊,視訊聊天,影片網,kiss911,a片,交友,聊天,做愛,免費影片,性交,線上成人,網路色情,聊天,美女自慰,免費a分享,免費短片,裸照,一夜情,女優,85cc成人片,美女寫真,偷拍a,情人視訊聊天室

淑婷 said...

85cc片觀看,77美女dvd影片,熊貓貼區,ut網際聊天,一葉情,av,嘟嘟,影音live秀,a片,做愛影片,視訊做愛,美女短片,78論壇,ut聊天,打飛機,a片,免費視訊,免費視訊,成人影院,性愛小說,辣妹視訊,網路交友,捷克論壇,h影片,色咪咪,免費影片85cc,kiss911,後宮,a片,影音視訊聊天,交友,免費聊天,聊天室交友,做愛影片,線上a片,美女影片,免費影片下載,免費聊天室,視訊做愛,美女視訊聊天

志名 said...

I like your blog................................

DagnyDepa芝汝 said...

人間好話,要如海綿遇水牢牢吸住.........................

HaydeeG_Mccra鈺苓 said...

你的選擇就是做或不做,不做就永遠不會有機會.............................................

健豪 said...

78論壇 A片,成人影片分享 080視訊聊天室 666成人 視訊交友網 xvideo免費影片 視訊美女ws888 6k聊天室辣妹視訊 A片-免費視訊 視訊美女mybank sex888影音視訊聊天室 影音情人趣味 85cc免費影片 視訊激麻館 禁地論壇成人 情色視訊 成人影片情色網 bt成人論壇 18成人avooo 玩美女人試看片 hilive tv視訊妹 免費聊天firework av999免費影片 avdvd無碼影片成人情色 一葉晴貼影片av127 520聊天室 一夜情視訊聊天室 視訊聊天室交友 免費視訊辣妹avdvd一夜情 1元視訊 網愛聊天 250av女優免費影片 免費影音視訊fm358 sex女優王國情色 嘟嘟情人色網 dvd 台灣18網 視訊交友雙贏論壇 色a金激麻館 性愛故事性愛文學 凹凸情欲網 成人視訊happylife 視訊聊天交友mm358 免費視訊辣妹sex女優王國 情色香港論壇 亞洲情色貼圖區 日本 a 片自拍偷拍網站情色小說 免費avi影片下載 台灣情色視訊網 17358 視訊聊天室 日本a片免費下載 情色影片免費觀賞you tube影片下載

熙辰 said...

好喜歡你的部落格唷,剛下班,要去睡了!!!掰~~..................................................

佩GailBohanan1蓉 said...

Never put off till tomorrow what may be done today.............................................................

rl64@yahoo.com.hk said...

想跟你說一聲加油,祝福大家每天開心........................................

冠儒俊鑫 said...

你不能決定生命的長度,但你可以控制它的寬度..................................................................

溫淑芬 said...

your artical is so funny!! it make me so happy!! .................................................................

江婷 said...

河水永遠是相同的,可是每一剎那又都是新的。.................................................................

江婷 said...

知識可以傳授,智慧卻不行。每個人必須成為他自己。.................................................................

于庭 said...

成熟,就是有能力適應生活中的模糊。.................................................................

吳婷婷 said...

當一個人內心能容納兩樣相互衝突的東西,這個人便開始變得有價值了。............................................................

茂慧茂慧 said...

嗨!很喜歡來這欣賞你的作品,幫你推推推當上人氣王唷..................................................................

香昱信張君林 said...

沒有經過反省的人生,是不值得活的人生..................................................

嘉剛怡元 said...

好的開始並不代表會成功,壞的開始並不代表是失敗............................................................

婷珊 said...

這不過是滑一跤,並不是死掉而爬不起來了。.......................................................

賢林賢林 said...

人並不是生來要吃敗仗的。人可被毀滅,但不可被擊倒。.................................................................

蔡舜娟蔡舜娟 said...

人生最重要的一件事,就是從生活中認識你自己。......................................................

dawsonfelicia張君dawsonfelicia均 said...

good, excellent, nice job!!..................................................................

琬安琬安 said...

blog有留言互動才好玩~~希望留言能支持您的更新動力!!!..................................................................

李吳文云威昌 said...

不要去想沒拿到的東西,多想想自己手裡所擁有的..................................................

孫邦柔 said...

時間就是塑造生命的材料。

張v李佳羽嘉旺 said...

人不能像動物一樣活著,而應該追求知識和美德............................................................

家唐銘 said...

Poverty tries friends...................................................................

韋陳富 said...

與人相處不妨多用眼睛說話,多用嘴巴思考. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

陳雅吳水以竹 said...

與人相處不妨多用眼睛說話,多用嘴巴思考,............................................................

琬群學葉安高 said...

感謝你的分享 要繼續發表好文章喔..................................................

黃智樺黃智樺 said...

人不能像動物一樣活著,而應該追求知識和美德................. ................................................

秋協盛協盛昀 said...

打聲招呼,祝你一切平安!............................................................

怡靜怡靜怡靜怡雯 said...

在莫非定律中有項笨蛋定律:「一個組織中的笨蛋,恆大於等於三分之二。」..................................................