允许文档上传时的安全考虑
我有一个网络应用程序，允许用户上传与其帐户相关的某些文档（word/excel/powerpoint 等）。我正在使用 CodeIgniter 构建这个，我只是想检查一下我是否遗漏了任何安全方面的内容。
- 检查文件的 MIME 类型 检查
- 最大大小
- 文件名经过哈希
- 处理任何用户都不会看到文件名，而是在单击“下载”链接时，会使用 ID 调用安全下载控制器 ( http://www.example.com/safedownload/1245/ )
我还缺少什么吗？当前目录中文件的CHMOD设置为0600，安全吗？
谢谢。
I have a web application that allows users to upload certain documents relevant to their account (word/excel/powerpoint etc). I'm building this with CodeIgniter and I just wanted to check that I'm not missing anything security wise.
- MIME types of the file are checked
- Maximum size is checked
- The filename is hashed
- The filename is never seen by any user rather when clicking a "download" link, the safedownload controller is called with an ID ( http://www.example.com/safedownload/1245/ )
Is there anything I'm missing? The CHMOD of the files in the directory is currently set to 0600, is that secure?
Thanks.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
您是否考虑过以后访问文件的方式？您应该注意一个常见的缺陷 -
如果可以以任何方式操纵文件路径，则可能会完全在您存储文档的文件夹之外访问您的服务器 - 例如 ../../。 ./etc/somefile
为了防止这种情况，您可以检查即将访问的文件路径中的“..”，以确保没有人找到一种方法来获取代码执行的命令中的这些字符！
Have you considered the way the files are accessed later? There is a common flaw you should be aware of-
If the filepath can be manipulated in any way, it is possible that your server could be accessed, completely outside the folder you store the documents in- for instance ../../../etc/somefile
To protect against this, you could check the filepath that is about to be accessed for '..' to be sure noone has found a way to to get those characters in the command your code executes!