prevent mime faking on php uploads

Question

Is there a way to prevent someone from faking a mime type on a file upload and then running a php/exe/etc...

I have to make the file upload directory writeable and executable so that the files can be stored, but this allows anyone to run a script after. One thing I can do is add random data to the file name so they can't guess the file name after (since they still can't read from the directory to get a listing).

I'm using file upload with php for the first time and I'm trying to cover all of the security issues.

Answer 1

The file upload directory should not be accessible to the web browser. I.e. don't allow somebody to upload a file, say "remove_all_my_files.php", and then execute it on your system by giving the url to it, say "http://xample.com/uploads/remove_all_my_files.php".

Answer 2

The information in $_FILES always comes from the client, so what you want to do is accept the file and scan it on the server. I'd either recommend using finfo, which is a PHP extension and it makes it easy:

<?php
// example :-)
$finfo = finfo_open(FILEINFO_MIME);
echo finfo_file($finfo, '/path/to/your/upload/file);
finfo_close($finfo);
?>

There is also a OO-interface if you don't like procedural.

If finfo is not an option, you could use the unix command file to check.

Also, many people suggest serving files through a wrapper. I am torn on this one, it can be a solution but it's far from ideal because a) the files are still on your server and b) it's expensive to serve files like that.

Answer 3

On my Apache web server configurations I don't believe the actual file contents determine whether a file runs as a script or not. The determination as to whether to display a file as text or an image format, or run it as a script is made by matching the file ending.

For example, a directive in the apache configuration file, httpd.conf of

AddType application/x-httpd-php .php

tells the server to run files ending in .php to run as a php script. So just make sure that none of the uploaded files are saved with a .php ending, or any other script executable ending or any file ending you use for include files.

Answer 4

Don't serve the file directly. Keep uploads in a no public access location. Read from file, buffer for output to allow downloading.

Here's the basic idea:

function ReadAndOutputFileChunked ($filename) { 
 $chunksize = 1*(1024*1024); // how many bytes per chunk 
 $buffer = ''; 
 $handle = @fopen($filename, 'rb'); 
 if ($handle === false) { 
  return false; 
 } 
 while (!feof($handle)) { 
  $buffer = @fread($handle, $chunksize); 
  print $buffer; 
 } 
 return @fclose($handle); 
}

header("Content-type: application/octet-stream");
ReadAndOutputFileChunked('/private/path/to/upload/files/' . $nameOfFile);