They Uploaded a File and It Was Not an Image
Somebody uploaded a profile picture. It was not a picture. The endpoint checked the extension. The file was called avatar.png, and an extension is not a fact. It is a claim, typed by the person uploading. The content type header is the same claim, sent by the same person. So the checks we were proud of amounted to asking a stranger whether the stranger could be trusted, and writing down the…
A profile picture was uploaded, but it was not an image file. The system checked the file extension, which was .png, but this was merely a claim made by the uploader. The content type header, also a claim from the same person, did not provide assurance of the file's true nature. The filename was incorporated into a path, which could potentially traverse directories.
This allowed the file to be placed in a directory served by the web server, making it accessible to others using the same domain and session. SVG and PDF files, while not images, can contain executable scripts and programming languages respectively. Executing these files can lead to security vulnerabilities. The file size can also be misleading; a small file on disk can expand significantly when opened.
The key to prevention lies in generating unique identifiers for files, storing them under these identifiers, and keeping the original names as data. Serving files outside the web server's default directory and validating the file type through code, not relying on the name or extension, can also mitigate risks. Converting the file to a different format and discarding the original can remove any hidden threats.
Every other input is essentially text that needs to be parsed, making uploads a file handed over to untested parsing code by strangers.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
