Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

we have a website that allow the user to upload the files.Now if I am allowing the user to upload all the file extensions without restricting them is it secure?I am restricting only by the file size up-to 1GB. Give your advice.we are using amazon s3 to store the files.

share|improve this question

3 Answers 3

It is never secure to allow users to do anything without restriction.

share|improve this answer

You should never allow users to upload files which they can cause to execute later. For example, if your server has PHP installed and a user uploaded one of the numerous PHP-based web exploit kits (e.g. a C99 shell variant) and was later able to get the server to execute it (by visiting a link to the file) they would gain complete, or near-complete, control over your website/server.

It's not just PHP you need to worry about. Any filetype which the underlying web server can or might execute should be disallowed or received in such a way as to prevent execution.

Even if you filter out file extensions like .php or .py there still is the risk that the server will try to execute a file when it's accessed. A common tactic is for the attacker to append an allowed file extension such as .jpg to the file name (so that you have c99.php.jpg, for example) and depending on the server configuration it may still be executed as PHP by the server. If you're running a Unix-like OS then a good step to take is to explicitly mark uploaded files as not executable.

share|improve this answer

Don't allow your users to do more than they need to. In this case, you haven't specified why they are uploading the files - that will determine, in part, what restrictions you should place on the files. (e.g. if you have a site that deals with documents, don't let your users upload applications (.exe), restrict to an acceptable set of document mime-types).

I would suggest that the more important consideration is what is done with them after the upload. For instance, it may be perfectly fine to upload a script - if the script is going to be displayed as text (e.g. GitHub), but not if the user could access the file and execute it on the server. Likewise, uploading to S3, you need to ensure your users cannot directly access their files, otherwise it is very easy for someone to upload a malicious file and use your S3 account to serve it.

If the users cannot execute the files, cannot directly access them, and cannot send them to another person (i.e. they can only store the file and must login to retrieve it) then fewer restrictions are needed.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.