Security Issues with HTTP_RAW_POST_DATA

Question

I'm currently taking HTTP_RAW_POST_DATA and saving it to an image file. Are there any exploitable security issues that I need to be aware of?

Answer 1

The security implications are the same as with any other file upload mechanism. You might have semantic implications, as the POST body might not be raw data, eg if it is quoted-printable encoded or compressed.

Answer 2

Yes, if my POST body looks like...

<?php

rmdir(__DIR__ . '/../');

...and I can access the file via a URL (only if your image extension is set to run PHP, not likely but possible), or you run it (accidentally include it, for example), you will be in trouble.

If you wanted to be safe , store the file above the document root and use an image processing library such as GD to write the image from string and save that output. If it's a malicious file, you should only end up with a garbage outputted image.