上传文件并发送到电子邮件

Question

This might be a stupid question but I just want to know if I have a form that allow user to upload upto 3 images files and email those images to me to a outside server. The question is if I just check the extension of the to make sure it is the type of file I wanted without checking the actual file type will that be any security issues for my server? I know upload file have to first save the file temporary to my server. Any help will be appreciated. thx.

Answer 1

The file extension is definitely not a reliable indicator of file type -- any file type can be named with any extension. Something like libmagic can help you better determine the file type, if that's what you want to do.

That said, so long as your server does not execute any files sent to it, and acts only as a mailer, I don't see any risk involved with users uploading malicious files, at least not to the server itself. Other aspects of the server configuration may make the existence of executable files on the server a problem, but the mailer itself isn't a particular risk.

Of course, setting up any application that allows someone to send mail from the web requires a certain level of authorization security, to avoid having your application used as a spamming mechanism. If the mail is only being sent to yourself, then you're the only one who would get spammed, but it still might be rather annoying.