A common vulnerability.
WHAT THE RISKS ARE
Executable content stored and then served Files overwriting others Very large files exhausting storage Content that attacks whatever processes it Malware passed to other users
WHAT TO VALIDATE
File size, with a hard limit Type, by inspecting content rather than trusting the declared type or extension Dimensions, for images
WHY NOT THE EXTENSION
It is supplied by the client and means nothing.
WHAT TO DO WITH THE FILENAME
Discard it, and generate your own.
WHY
Supplied names contain traversal sequences, unusual characters, and collisions.
WHAT TO STORE
The original name separately, as data, for display.
WHERE TO STORE FILES
Outside the served directory, or in separate object storage.
WHY
So an uploaded file can never be executed by the server.
WHAT TO SET WHEN SERVING THEM
An explicit content type A header preventing type guessing Attachment disposition, where appropriate
WHAT TO CONSIDER
Scanning for malware, where files are shared between users.
WHAT TO LIMIT
Upload rate per user.
