2

I'm working on an online file manager as part of a website running on a LAMP stack. What are some file extensions I should disallow for uploaded files? ".php" is an obvious one.

EricP
  • 3,395
  • 3
  • 33
  • 46
  • 1
    checking on file extension does not 100% work, user can upload php script with any sort of extension other than php – ajreal Jan 03 '11 at 01:57

4 Answers4

6

I would go about it the other way. Only spec files that you ALLOW to be posted. otherwise there can be any variety of file types that you didn't consider and that can be very hazardous. Consider your "disallow PHP", did you also consider ".php5" or ".phps" ? It's much better to take a few minutes and compile a list of the specific types you WILL allow. This take a bit of front-loading, but in the end will likely save you a major headache.

Kirk Strobeck
  • 17,984
  • 20
  • 75
  • 114
5

I think you'd be better off configuring Apache so it won't even try to run scripts from the upload directory. Then it doesn't matter if someone uploads a .php file -- if someone else browses to that file, the server will serve it up just like any .gif or .jpg, rather than trying to run it on the server -- i.e., the user will just get a .php file downloaded to their computer.

(Note that I'm nothing of an Apache expert, so I don't know exactly what configuration changes you have to make to disable script execution -- but it should be easy to look at your config file, see what's already turned on for your main directory, and reverse it for your uploads directory.)

You might also need to watch out for the GIFAR exploit.

Community
  • 1
  • 1
Joe White
  • 94,807
  • 60
  • 220
  • 330
0

Don't forget .html files, too.

Not only do you need to disallow users from executing files that they have uploaded, you also need to severely restrict the serving of user uploaded HTML. Someone can subvert your login and authentication with some javascript. Even though it isn't executed on your server, if it's served from your domain, it can be risky.

You should never execute any user uploaded file, nor should you serve it back.

  • 1
    This could be mitigated by serving the files from a separate domain, so it can't access your cookies. – Joe White Jan 03 '11 at 15:23
-2

Apache also allows for decentralized management of configuration via special files placed inside the web tree. The files are usually called .htaccess, but you can use any name in the AccessFileName directive. Directives placed in .htaccess files apply to the directory where you place the file, and all sub-directories. The .htaccess files follow the same syntax as the main configuration files. Since .htaccess files are read on every request, changes made in these files take immediate effect.

Tiff
  • 1