Best way to determine whether an attached document will harm a user when opened

Question

We're writing a feature that will allow our users to "attach" things like Word documents, Excel spreadsheets, pictures, pdfs to documents in our application - just like email.

We don't however, want to allow them to attach .exe, .bat, .reg files, or anything else that might harm them if they opened it - so we're proposing to have a whitelist of allowed file types.

Does anyone know of a better way to determine whether a document is safe? (i.e. does not have the ability to harm a user's computer). Or instead a resource that would give us a list of commonly used safe documents to add to our whitelist as defaults?

Answer 1

I honestly think you are best served by either Clam AV on Linux or Trend Micro on Windows.

Answer 2

What about Word macro viruses? There is no one "safe" document type. What if someone renames a .exe file .doc - is that allowable? Don't depend on the file type or name alone and never just trust client input. Validate it on the server side if at all possible, most likely using an anti-virus program or some other known utility.

Answer 3

You could use a whitelist plus the result of AssocIsDangerous (http://msdn.microsoft.com/en-us/library/bb773465(VS.85).aspx) to determine if the file should be allowed. White list for files to attach without warning, AssocIsDangerous to block altogether, and the remaining could get a default warning dialog.

Be careful about the white list because complex documents can contain macros and their associated applications could contain security vulnerability in their parsers.

Answer 4

Use a reverse proxy setup such as

www <-> HAVP <-> webserver

HAVP (http://www.server-side.de/) is a way to scan http traffic though ClamAV or any other commercial antivirus software. It will prevent users to download infected files. If you need https or anything else, then you can put another reverse proxy or web server in reverse proxy mode that can handle the SSL before HAVP

Nevertheless, it does not work at upload, so it will not prevent the files to be stored on servers, but prevent the files from being downloaded and thus propagated. So use it with a regular file scanning (eg clamscan).