secure upload with uploadify and asp.net mvc 2

Question

i have an asp.net mvc 2 application and i am using uploadify. I am uploading the files straight into a sql server db. What are the necessary checks i need to do and how? I would like to perform a anti virus scan? what are possible security loopholes here?

Are you parsing the XML on the server or you are storing the uploaded stream directly as a BLOB into the database? — Darin Dimitrov, Jul 17 '11 at 22:14

score 0 · Answer 1 · edited May 23 '17 at 11:55

You could try feeding the uploaded stream into a XmlReader and parse through it. In the event of an exception chances are that there is something wrong with this XML file:

using (var reader = XmlReader.Create(uploadedFile.InputStream))
{
    try
    {
        while (reader.Read())
        { }
        // At this stage you may save the XML file into the database. 
    }
    catch (Exception ex)
    {
        // probably not a valid XML file
    }
}

If the uploaded XML files need to obey a certain structure you could validate them against an XSD schema by specifying this to the XmlReader.

secure upload with uploadify and asp.net mvc 2

1 Answers1