Re: Question: Limiting Filetypes Uploaded

[prev] [thread] [next] [Date index for 2005/03/03]

On Mar 2, 2005, at 7:21 PM, Richard F. Rebel wrote:
> I worked for a company who did mass free hosting and I can tell you 
> that
> browser supplied mime types are not enough in many situations.
I agree - my question was if they tended to call a 'valid' file 
invalid, or an invalid file valid -- the idea being that if the browser 
claimed something was a pdf, and I only want jpgs, its safe to throw 
out without doing additional testing (ie the magic byte to image app 
tests).   if the browser says its a jpg, then i do actual file analysis 
to see if it is indeed a jpg. (the idea being to conserve cpu)


> I had to resort to file magic byte testing (technique used by the unix
> 'file' command), and then further to ensuring that tar's, rar's, 
> bzip's,
> pkzip's etc all passed consistency checks and had no padded data on the
> end, as well as check the contents.  We also ended up having to run
> JPEG's and GIFS through image libraries to ensure the same as people
> were uploading copies of windows in hundreds of JPEGS which had proper
> headers but the remainder was added on CAB files.
That sounds awful, and unfortunately like something I must do.

> Also, if I remember correctly you must write a mod_perl content handler
> in order to acurately stop a 'claimed' 100k upload that is in actuality
> a 100MB upload.  We did this by counting bytes as we read them and
> aborting once over a given size.  Also, I think some browsers don't
> correctly report the size up uploaded files, but I am kinda hazy on 
> this
> aspect.  This was apache 1.3 btw.

Ok, this is a more general question then -- shouldn't POST_MAX handle 
that?

> 2 ensure they cannot upload larger than claimed/quota amounts by a
> writing a handler in mod_perl or c that counts the bytes.  TIME OUT 
> slow
> connections... eg, upload 100k, wait, slow down, wait some more, send
> some bytes, etc. this is an easy way to DOS you.
ok, now i'm scared.  does anyone know of a handler out there that does 
something like this?  or can point me in the right direction on how to 
make one?  i def. don't have the knowledge  to code this alone, but 
would be eager to  work on one.

all of  this upload stuff is for a 'profile' image for  a community 
style site i'm working on.  i'm only allowing limited numbers of 
uploads, but you've alerted me to a whole area of  problems that are 
best addressed by doing this right and building handlers/etc to prevent 
issues like  this from possibly arising.