Re: File Upload - Security Issues
From: Roland Hall (nobody_at_nowhere)
Date: 10/19/04
- Next message: Paul Thakur: "viewing contents of field type "long text""
- Previous message: Jeff Cochran: "Re: Help writing a Script to forward e-mail"
- In reply to: Azz: "File Upload - Security Issues"
- Next in thread: Azz: "Re: File Upload - Security Issues"
- Reply: Azz: "Re: File Upload - Security Issues"
- Messages sorted by: [ date ] [ thread ]
Date: Mon, 18 Oct 2004 21:12:06 -0500
"Azz" wrote in message news:%23OLf10StEHA.2244@TK2MSFTNGP10.phx.gbl...
: I've been faced with a bit of a pickle and was wondering if anyone here
: would be able to help me out clear up a few points. I am wanting to upload
a
: file (unspecified type as of this moment, but could be MS Word, Access,
: Excel etc).
You're kidding, right? You want to upload a file for what reason and you do
not know what type? One would think your goal would be defined first and
then you would try to determine what the best solution would be. I'm sure
your agument may be that but the difference in non-executable file types
doesn't factor in.
: We've spoken to a number of people including our tech team who
: are concerned about uploading these files to our Windows 2000 (or NT) box
: running IIS using ASP.
And those are?
: So we've had to come up with an alternative solution
: and we have a few ideas on ways around it.
Perhaps the purpose of locating the file on the web server and which type of
file and what pitfalls you see re: security might be helpful on this end?!
: Firstly I guess I should ask; Should I be worried about uploading MS
Office
: files to an IIS server that doesn't have MS Office actually installed?
What are you worried about? How does your data file present a problem to
security?
: I am
: told, and therefore expect that this is not a good security situation...
so
: I look at other ways around.
And, I repeat, that is?
: This leaves me with the option of palming the file off to PHP/Unix box &
: scripting where it will be quite a bit safer.
How is it safer?
: One way that appears to be a
: possible solution is to do it as follows:
:
: 1* HTML displayed with a form (multipart/form-data enctype) and a file
input
: box.
:
: 2* Upon submit this is submitted to an ASP page that then (using the XML
: object in ASP) effictively "posts" the information directly to the PHP
page.
:
: 3* This PHP page then takes the file and saves it to the Unix filesystem,
: and then, completes it's processing and sends XML information of the file
: back to the ASP page.
:
: 4* The ASP finishes parsing and displays the next bit of HTML displaying
: whatever.
:
: We have successfully set up a XML submit to the PHP that retains all the
: Request.Form post information as well as the multipart binary file.
:
: The problem I foresee (and basically my main question):
:
: * The IIS, when sending the multipart information, I presume it must be
: storing the file in a binary temporary file somewhere? If so, is this
: something that could be run?
Run? It's a data file. How can it be run if you are referring to being
executed? Surely you do not think a temp data file is executable?!
: Therefore kinda making this process pointless.
Still looking for the point.
: We are trying to avoid using PHP in great chunks as there is only myself
and
: one other in our office that have had any hefty experience of it, and
: therefore, it would make it largely unmaintainable!
A file upload process requires a lot of maintenance? No matter what you
choose, if that becomes part of your infrastructure, people will have to
brought up to speed or replaced with those that have or are willing to learn
the knowledge required to maintain it.
: I hope this makes sense,
Not really. So far, all I've seen is unsubstantiated claims that one web
server/technology is greater than another. You're referring to security yet
you have to shown any reference to SSL, certificates, VPN, etc. We also do
not know your network design so we do not know where the [target] server
resides or any information regarding your security model. If your server is
outside your control [hosted] then it's important to know that and if it's
not, why not just make a network connection on the LAN?
: Any pointers on the above? Or as importantly, any pointers on things we
have
: missed from our logic?
No pointers to offer yet. Still need a lot more information. It appears
you're looking for a vote, one way or another, regarding IIS/ASP vs *nix/PHP
and that is too limited to answer since neither, in itself, has anything to
do with security. And, no matter how one differs from the other, your
developer(s) can also render either/both of them completely insecure.
Just my $.02.
-- Roland Hall /* This information is distributed in the hope that it will be useful, but without any warranty; without even the implied warranty of merchantability or fitness for a particular purpose. */ Technet Script Center - http://www.microsoft.com/technet/scriptcenter/ WSH 5.6 Documentation - http://msdn.microsoft.com/downloads/list/webdev.asp MSDN Library - http://msdn.microsoft.com/library/default.asp
- Next message: Paul Thakur: "viewing contents of field type "long text""
- Previous message: Jeff Cochran: "Re: Help writing a Script to forward e-mail"
- In reply to: Azz: "File Upload - Security Issues"
- Next in thread: Azz: "Re: File Upload - Security Issues"
- Reply: Azz: "Re: File Upload - Security Issues"
- Messages sorted by: [ date ] [ thread ]
Relevant Pages
|
|
