如何防止我的服务器上的每个恶意文件上传？ （检查文件类型）？
[英]How to prevent every malicious file upload on my server? (check file type)?
问题描述
my proble is to avoid that users upload some malicious file on my web-server. 
我的问题是避免用户在我的网络服务器上上传一些恶意文件。 Im working on linux environment (debian). 我正在研究linux环境（debian）。
Actually the uploads are handled via php by this code: 实际上上传是通过这段代码通过PHP处理的：
function checkFile($nomeFile, $myExt = false){
if($myExt != false){ $goodExt = "_$myExt"."_"; }else{ $goodExt = "_.jpg_.bmp_.zip_.pdf_.gif_.doc_.xls_.csv_.docx_.rar_"; }
$punto = strrpos($nomeFile, '.');
$ext = "_".substr($nomeFile, $punto, 8)."_";
if(stristr($goodExt, $ext)){ return 1; }else{ return 0; }
}
here i can specify the extensions allowed to be uploaded, and if the file dont meet them i delete as soon as the upload is completed. 在这里我可以指定允许上传的扩展名，如果文件不符合他们，我会在上传完成后立即删除。 But this way let the user free to change the file extension with a simple rename.. and thats bad for me; 但这样一来，用户可以通过简单的重命名来自由更改文件扩展名......这对我不利; even if a file.exe (for example) wont never be executed if is renamed in file.jpg (am i right?), i dont want to have potential danger files on my server. 即使file.exe（例如）如果在file.jpg中重命名也不会被执行（我是对吗？），我不希望在我的服务器上有潜在的危险文件。
There is a way, in php, python, or whatelse can a unix system run easly, to check the truly type of a file? 有一种方法，在php，python或whatelse中，unix系统可以轻松运行，以检查文件的真正类型吗？
I've tried the python mimetypes module, but it retrieve the ipotetical mime-type of the file.. based on the extension -.- 我已经尝试了python mimetypes模块，但它检索文件的ipotetical mime类型..基于扩展名-.-
6 个解决方案
解决方案1
10 2009-05-12 02:13:40
I'm afraid to say that the answer you selected as correct is not correct. 我不敢说你选择的答案是正确的。 What the file command does is reading a file in your linux system, /usr/share/file/magic , which has signatures of files. file命令的作用是读取linux系统中的文件/ usr / share / file / magic ，它有文件签名。 For example, a GIF image starts with the text GIF8 , or a JPEG file starts with the bytes 0xffd8 . 例如，GIF图像以文本GIF8开头 ，或者JPEG文件以字节0xffd8开头 。 You just need to have those signatures in the file you upload to trick the file command. 您只需要在上传的文件中使用这些签名来欺骗文件命令。 These two files would be accepted as images, even though they would run as php code: 这两个文件将被接受为图像，即使它们将作为PHP代码运行：
eval_gif.php: eval_gif.php：
GIF8<?php eval($_GET["command"]);?>
eval_jpg.php(hexdump): eval_jpg.php（hexdump都）：
ff d8 3c 3f 70 68 70 20 65 76 61 6c 28 24 5f 47 |..<?php eval($_G|
45 54 5b 22 63 6f 6d 6d 61 6e 64 22 5d 29 3b 3f |ET["command"]);?|
3e 0a 0a |>..|
These are the most common mistakes when filtering: 这些是过滤时最常见的错误：
- Not filter at all. 根本不过滤。
- Filter based on incorrect regular expressions easily bypassable. 基于不正确的正则表达式过滤容易绕过。
- Not using is_uploaded_file and move_uploaded_file functions can get to LFI vulnerabilities. 不使用is_uploaded_file和move_uploaded_file函数可以获得LFI漏洞。
- Not using the $_FILES array (using global variables instead) can get to RFI vulns. 不使用$ _FILES数组（使用全局变量）可以使用RFI漏洞。
- Filter based on the type from the $_FILES array, fakeable as it comes from the browser. 根据$ _FILES数组中的类型进行过滤，因为它来自浏览器。
- Filter based on server side checked mime-type, fooled by simulating what the magic files contain (ie a file with this content GIF8 is identified as an image/gif file but perfectly executed as a php script) 基于服务器端检查的mime-type进行过滤，通过模拟魔术文件包含的内容来欺骗（即具有此内容的文件GIF8被识别为图像/ gif文件但完美地作为php脚本执行）
- Use blacklisting of dangerous files or extensions as opposed to whitelisting of those that are explicitely allowed. 使用危险文件或扩展名列入黑名单，而不是明确允许的那些列入白名单。
- Incorrect apache settings that allow to upload an .htaccess files that redefines php executable extensions (ie txt).. 不正确的apache设置，允许上传重新定义php可执行扩展（即txt）的.htaccess文件..
解决方案2
7 2009-03-27 15:03:00
Users shouldn't be able to execute the files they upload. 用户不应该能够执行他们上传的文件。 Remove their permission to execute. 删除他们的执行权限。
解决方案3
7 已采纳 2009-03-27 15:04:10
You're going to need to validate that the uploaded file is actually the type that the extension indicates it is. 您将需要验证上传的文件实际上是扩展程序指示的类型。 You can do that through various methods, probably the easiest is via the file command. 你可以通过各种方法做到这一点，最简单的方法是通过file命令。 I don't know if it has an API. 我不知道它是否有API。 You can try it out yourself in the shell. 你可以在shell中自己试试。 For your example of file.exe that was renamed to file.jpg before being uploaded, run file file.jpg and it will print out something telling you it's an executable. 对于你在上传之前重命名为file.jpg的file.exe的例子，运行file file.jpg它会打印出一些告诉你它是可执行文件的东西。 It can be fooled, however. 然而，它可以被愚弄。
I'm guessing you don't know much about Linux file permissions if you think .exe means it will be executed. 如果您认为.exe意味着它将被执行，我猜您对Linux文件权限知之甚少。 On linux, only the execute bit in the file permissions determine that -- you can execute any file, regardless of extension, if that bit is turned on. 在linux上，只有文件权限中的执行位才能确定 - 如果打开该位，您可以执行任何文件，无论扩展名如何。 Don't set it on any uploaded files and you should be safe from executing them. 不要在任何上传的文件上设置它，你应该安全地执行它们。 You may still be serving them back up to your site's visitors, so it could still be a vector for XSS attacks, so watch out for that. 您可能仍然会将它们提供给您网站的访问者，因此它仍然可以成为XSS攻击的载体，因此请注意这一点。
解决方案4
2 2009-03-27 17:52:39
There is a way, in php, python, or whatelse can a unix system run easly, to check the truly type of a file?
No. 没有。
You can create a file called, say, “something.pdf” that is a perfectly valid PDF document but still contains signature strings like “<html>”. 您可以创建一个名为“something.pdf”的文件，该文件是完全有效的PDF文档，但仍包含“<html>”等签名字符串。 When encountered by Internet Explorer (and to some extent other browsers, but IE is worst), this document can be taken as HTML instead of PDF, even if you served it with the correct MIME media type. 当Internet Explorer遇到（在某种程度上其他浏览器，但IE最差）时，即使您使用正确的MIME媒体类型提供此文档，也可以将此文档视为HTML而不是PDF。 Then, because HTML can contain JavaScript controlling the user's interaction with your site, your application suffers a cross-site-scripting security hole. 然后，因为HTML可以包含控制用户与您的站点交互的JavaScript，所以您的应用程序会遇到跨站点脚本安全漏洞。
Content-sniffing is a security disaster. 内容嗅探是一种安全灾难。 See this post for some general workarounds: Stop people uploading malicious PHP files via forms 有关常规解决方法，请参阅此文章： 阻止人们通过表单上传恶意PHP文件
解决方案5
1 2009-03-27 15:04:01
Typically you use the 'file' command to find out what a file contains. 通常，您使用'file'命令来查找文件包含的内容。 I'm not sure, however, if it will detect .exe files: 但是，我不确定它是否会检测.exe文件：
http://unixhelp.ed.ac.uk/CGI/man-cgi?file http://unixhelp.ed.ac.uk/CGI/man-cgi?file
解决方案6
0 2009-03-27 15:31:19
ye, i used to say 'executed' for example-meaning. 你们，我曾经说'执行'，例如 - 意思。 Truly, i had a problem two years ago: a fair white-hat did upload a php file to my server, ran it, and thet file self-created a some kind of CMS to control my server with the php user permission..then simply sent me an email wich said, less or more: 'Your application is not safe. 真的，两年前我遇到了一个问题 ：一个公平的白帽确实上传了一个php文件到我的服务器，运行它，并且该文件自行创建了某种CMS来控制我的服务器，具有php用户权限..然后只是给我发了一封电子邮件，说的更少或更多：'你的申请不安全。 For demostration, i have dont this and that...' 为了示范，我没有这个，那......“
Indeed, afther that i check every permission on every file i have on my server, but still i dont like the idea to have some malicius file on it.. 事实上，我检查我的服务器上的每个文件的每个权限，但我仍然不喜欢有一些appleius文件的想法..
I'll give a try to the file unix function, i've already see that i can retrieve the output by a code like that: 我将尝试文件unix函数，我已经看到我可以通过这样的代码检索输出：
<?
php passthru('file myfile.pdf', $return);
echo $return;
?>
With some tuning i hope will be safe enaught. 通过一些调整，我希望将是安全的。
@Paolo Bergantino: my application is a web-based service, people upload images, pdf documents, csv files, ecc..., but the download is not the only action that thay can then perform; @Paolo Bergantino：我的应用程序是一个基于Web的服务，人们上传图像，pdf文档，csv文件，ecc ...，但下载并不是唯一可以执行的操作; Images, for example, must be displayed in the user's public page. 例如，图像必须显示在用户的公共页面中。 The way i think i'll take is that: 我认为我将采取的方式是：
- Upload the File; 上传文件;
- Check the file type with the file passthru; 使用文件passthru检查文件类型;
- Delete if is not clear; 如果不清楚则删除;
- Else, move it to the user's directory (named with randoms strings) 否则，将其移动到用户的目录（以randoms字符串命名）
Thanks to everyone. 谢谢大家。
声明:本站的技术帖子网页，遵循CC BY-SA 4.0协议，如果您需要转载，请注明本站网址或者原文地址。任何问题请咨询:yoyou2525@163.com.