Pushing Left, Like a Boss – Part 5.5 File Uploads
Allowing files to be uploaded to your applications (and therefore your network) is the most high-risk activity an application can do. It is truly a dangerous thing.
If you decide to include file uploads in your applications, you should:
1. Scan all uploaded files with an application to analyze the files for malicious characteristics such AssemblyLine (free from the Canadian Government, can be installed locally so you do not need to share your files with a 3rd party), Cylance, FireEye or Virus Total.
2. Buy a third party tool to do this work for you.
3. If buying a third party tool is not possible, follow the advice in the OWASP File Uploads cheat sheet when you create your own.
· Ensure the application is receiving the expected file type which is within an acceptable size range. If not, reject it.
· If possible, avoid accepting Zip files. If you must accept zip files, be extremely careful.
· Rename the file, do not use user-supplied information to name the file, even temporarily.
· Do not allow the user to specify a path to save the file, always have the application decide, and do not share this location with the end user.
· Pay special attention to files with double file extensions and ensure the fake extension is removed. For example: myfile.php.txt would become systemcreatedfilename.txt.
· Use image processing libraries to verify the image is valid and to strip away extraneous content.
· Set the extension of the stored image to be a valid image extension based on the detected content type of the image from image processing (do not trust the header from the upload).
· Ensure the detected content type of the image is within a list of defined acceptable image types (jpg, png, etc).
· Ensure that you can attribute the file to the authenticated and authorized user that uploaded it for auditing purposes. It is not advised to let unauthenticated users to upload files.
· It is preferable to save files to a to properly secured blob storage, then a database or to a file system. If on a file system, ensure it is on a file server (not the web server), preferably isolated and/or on a different domain/network zone, in a directory that does not have any execute permissions and has had all the script handlers removed. If at all possible store it in the cloud in blob storage instead.