如果允许用户上传的所有文件类型扩展名，则存在安全风险

Question

Background: I have a website where people can store transactions. As part of this transaction, they could attached a receipt if they wanted.

Question: Is there any security risk if a user is allowed to upload any type of file extension to my website?

Info:

• The user will be only person to ever re-download the same file
• There will be no opportunity for the user to "run" the file
• They will only be able to download it back to themselves.
• No other user will ever have access to another users files
• There will be a size restriction on the say (say 2mb)

More info: I was originally going to restrict the files to "pdf/doc/docx" - but then realised some people might want to store a jpg, or a .xls etc - and realised the list of files they "might" want to store is quite large...

edit: The file will be stored outside public_html - and served via a "readfile()" function that accepts a filename (not a path) - so is there anything that can 'upset' readfile()?

Answer 1

Yes, it is definitely a security risk unless you take precautions. Lets say, to re-download the file, the use has to go to example.com/uploads/{filename}. The user could upload a malicious PHP file, and then 'redownload' it by going to example.com/uploads/malicious.php. This would, of course, cause the PHP script to execute on your server giving him enough power to completely wreck everything.

To prevent this, create a page that receives the filename as a parameter, and then serve the page to the user with the correct content-type.

Something like, example.com/files?filename=malicious.php