Somebody uploaded a profile picture.
It was not a picture.
The endpoint checked the extension.
The file was called avatar.png,
and an extension is not a fact.
It is a claim,
typed by the person uploading.
The content type header
is the same claim,
sent by the same person.
So the checks we were proud of
amounted to asking a stranger
whether the stranger could be trusted,
and writing down the answer.
Here is the damage,
roughly in the order it arrives.
The filename went into a path.
Names can contain dots and slashes,
and a name that walks up two directories
is not exotic.
It is the first thing anybody tries.
The file landed in a directory
the web server serves,
which means we hand it back
to the next person who asks,
from our own domain,
with our own session in scope.
An SVG is not an image.
It is a document,
and documents carry script.
A PDF is a small programming language
with an unusually good reputation.
And the innocent ones
get passed to an image library
that is thirty years of C
reading a length field
chosen by somebody hostile.
Then there is size.
An archive that is two kilobytes on disk
and four gigabytes when opened
still works, because it always did.
What actually helps is dull.
Never use the name you were given.
Store the file under an identifier you generated,
and keep the original name as data,
never as a path.
Put it somewhere the web server
will not serve on its own,
and hand it back through code
that decides the type,
from a domain that is not holding the session.
Do not validate an image.
Re-encode it.
Decode it, discard the original,
write a new file out of the pixels.
Nothing hiding in the metadata survives that.
Cap the size before you read it,
not after.
Every other input you accept
is text you will parse yourself.
An upload is a file
you hand to a parser you did not write,
on behalf of somebody
you have never met.
– Serguey Asael Shinder
