安全的文件扩展名
我正在开发一个在线文件管理器，作为在 LAMP 堆栈上运行的网站的一部分。我应该禁止上传的文件使用哪些文件扩展名？ “.php”是一个明显的例子。
I'm working on an online file manager as part of a website running on a LAMP stack. What are some file extensions I should disallow for uploaded files? ".php" is an obvious one.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（4）
我会用另一种方式来解决这个问题。仅您允许发布的规范文件。否则可能存在您未考虑到的各种文件类型，这可能非常危险。考虑您的“禁止 PHP”，您是否也考虑过“.php5”或“.phps”？最好花几分钟时间编制一个您将允许的特定类型的列表。这需要一些前期加载，但最终可能会为您省去很多麻烦。
I would go about it the other way. Only spec files that you ALLOW to be posted. otherwise there can be any variety of file types that you didn't consider and that can be very hazardous. Consider your "disallow PHP", did you also consider ".php5" or ".phps" ? It's much better to take a few minutes and compile a list of the specific types you WILL allow. This take a bit of front-loading, but in the end will likely save you a major headache.
我认为你最好 配置 Apache，这样它就不会尝试从上传目录运行脚本。那么，如果有人上传 .php 文件并不重要——如果其他人浏览到该文件，服务器将像任何 .gif 或 .jpg 一样提供它，而不是尝试在服务器上运行它——即，用户只会将 .php 文件下载到他们的计算机上。
（请注意，我不是 Apache 专家，所以我不确切知道您必须进行哪些配置更改才能禁用脚本执行 - 但查看您的配置文件应该很容易，看看已经变成了什么on 用于您的主目录，并将其反转用于您的上传目录。）
您可能还需要注意 GIFAR 漏洞利用。
I think you'd be better off configuring Apache so it won't even try to run scripts from the upload directory. Then it doesn't matter if someone uploads a .php file -- if someone else browses to that file, the server will serve it up just like any .gif or .jpg, rather than trying to run it on the server -- i.e., the user will just get a .php file downloaded to their computer.
(Note that I'm nothing of an Apache expert, so I don't know exactly what configuration changes you have to make to disable script execution -- but it should be easy to look at your config file, see what's already turned on for your main directory, and reverse it for your uploads directory.)
You might also need to watch out for the GIFAR exploit.
也不要忘记 .html 文件。
您不仅需要禁止用户执行他们上传的文件，还需要严格限制用户上传的 HTML 的服务。有人可以使用一些 JavaScript 来破坏您的登录和身份验证。即使它不在您的服务器上执行，但如果它是从您的域提供的，则可能存在风险。
您永远不应该执行任何用户上传的文件，也不应该将其返回。
Don't forget .html files, too.
Not only do you need to disallow users from executing files that they have uploaded, you also need to severely restrict the serving of user uploaded HTML. Someone can subvert your login and authentication with some javascript. Even though it isn't executed on your server, if it's served from your domain, it can be risky.
You should never execute any user uploaded file, nor should you serve it back.
Apache 还允许通过放置在 Web 树内的特殊文件来分散管理配置。这些文件通常称为 .htaccess，但您可以在 AccessFileName 指令中使用任何名称。放置在 .htaccess 文件中的指令适用于放置该文件的目录以及所有子目录。 .htaccess 文件遵循与主配置文件相同的语法。由于每次请求都会读取 .htaccess 文件，因此在这些文件中所做的更改会立即生效。
Apache also allows for decentralized management of configuration via special files placed inside the web tree. The files are usually called .htaccess, but you can use any name in the AccessFileName directive. Directives placed in .htaccess files apply to the directory where you place the file, and all sub-directories. The .htaccess files follow the same syntax as the main configuration files. Since .htaccess files are read on every request, changes made in these files take immediate effect.