we have a website that allow the user to upload the files.Now if I am allowing the user to upload all the file extensions without restricting them is it secure?I am restricting only by the file size up-to 1GB. Give your advice.we are using amazon s3 to store the files.
3 Answers
It is never secure to allow users to do anything without restriction.
You should never allow users to upload files which they can cause to execute later. For example, if your server has PHP installed and a user uploaded one of the numerous PHP-based web exploit kits (e.g. a C99 shell variant) and was later able to get the server to execute it (by visiting a link to the file) they would gain complete, or near-complete, control over your website/server.
It's not just PHP you need to worry about. Any filetype which the underlying web server can or might execute should be disallowed or received in such a way as to prevent execution.
Even if you filter out file extensions like .php or .py there still is the risk that the server will try to execute a file when it's accessed. A common tactic is for the attacker to append an allowed file extension such as .jpg to the file name (so that you have c99.php.jpg, for example) and depending on the server configuration it may still be executed as PHP by the server. If you're running a Unix-like OS then a good step to take is to explicitly mark uploaded files as not executable.
Don't allow your users to do more than they need to. In this case, you haven't specified why they are uploading the files - that will determine, in part, what restrictions you should place on the files. (e.g. if you have a site that deals with documents, don't let your users upload applications (.exe), restrict to an acceptable set of document mime-types).
I would suggest that the more important consideration is what is done with them after the upload. For instance, it may be perfectly fine to upload a script - if the script is going to be displayed as text (e.g. GitHub), but not if the user could access the file and execute it on the server. Likewise, uploading to S3, you need to ensure your users cannot directly access their files, otherwise it is very easy for someone to upload a malicious file and use your S3 account to serve it.
If the users cannot execute the files, cannot directly access them, and cannot send them to another person (i.e. they can only store the file and must login to retrieve it) then fewer restrictions are needed.
