What security issues we acquire if we publish a form that lets you upload any type of file into our database?

Question

I am trying to assess our security risk if we allow to have a form in our public website that lets the user upload any type of file and get it stored in the database.

I am worried about the following:

• Robots uploading information
• A huge increment of the size of the database
• The form is an resume upload so HR people will be downloading those files in a jpeg or doc or pdf format but actually getting a virus.

Answer 1

1. You can use captchas for dealing with robots
2. Set a reasonable file size limit for each upload

Answer 2

In general, if you really mean to allow any kind of file to be uploaded, I'd recommend:

• A minimal type check using mime magic numbers that the extension of the file corresponds to the given one (though this doesn't solve much if you are not going to limit the kinds of files that can be uploaded).
• Better yet, have an antivirus (free clamav for example) check the file after uploading.

On storage, I always prefer to use the filesystem for what it was created: storing files. I would not recommend storing files in the database (suposing a relational database). You can store the metadata of the file on the database and a pointer to the file on the file system. Generate a unique id for the file and you can use a 2-level directory structure to store the data: E.g: Id=123456 => /path/to/store/12/34/123456.data

Said that, this can vary depending on what you want to store and how do you want to manage it. It's not the same to service a document repository, a image gallery or a simple "shared directory"

Answer 3

You can do multiple checking for your file upload control.

1) Checking the extension of file (.wmv, .exe, .doc). This can be implemented by Regex expression.

2) Actually check the file header or definition type (ex: gif, word, image, etc, xls). Sometimes file extension is not sufficient.

3) Limit the file size. (Ex: 20mb)

4) Never accept the filename provided by the user. Always rename the file to some GUID according to your specifications. This way hacker wont be able to predict the actual name of the file which is stored on the server.

5) Store all the files out of web virtual directory. Preferably store in separate File Server.

6) Also implement the Captcha for File upload.