Image File Uploads Security

I am implementing a project to my site to allow users to upload image files (ai, pdf, jpeg, gif, tiff). I know this can be very risky but I was wondering what kind of security checks I should put in place to make sure these files to not cause my site any harm.

开发者_如何学编程OR

Should I use something like dropbox to upload my images? If I do this is it possible to get these images whenever I want so I can display them within the browser to the user?

---

image uploads are fine, because you know what you want: An image

First rule is never to trust the client, so let the user upload the file (maybe you want to add an upload size limit).

Second, you have to ensure that the image is really an image so

1. Check the mime-type of the file (don't go by the file extension, use a real mime type check like the file shell command or an appropriate library)

2. To really make sure the file is OK, Open and Reprocess it using an image library like GD, ImageMagick etc. and save it to disk (keep in mind this needs some resource!). This will also filter out corrupted images.

An uploaded file usually doesn't harm the site itself but the users who download the file.

---

I've come across with a file uploading part of a project I worked. Some high-level suggestions to complement sled's answer:

The mime type is set on base of the file extension, so it's no useful (as the file has not been uploaded yet to the server, the mime type is just a 'guess' in base of his extension).

So solutions would be:

• Do the content check client-side (before sending the http-request)
• When you get the whole file by HTTP do the check server-side before persisting to the disk.

Other Suggestions:

• The simple file extension check (wheter by filename or mime-type) is the basic secutiry measure that also has to be present.
• Folder permissions: Don't allow execute permissions, don't allow the user to create new folders (as it might create a sub-folder with executing permissions).