search

Guad / fuwa

A Material design inspired filesharer for all
http://fuwa.se/
GNU General Public License v2.0
13 stars 6 forks source link

Deny all potentially malicious file types #24

Closed Luminarys closed 9 years ago

Luminarys commented 9 years ago

Apparently, it's easy to get around malware restrictions and clamscan isn't 100% effective. We should try to adhere to the standards that google uses[1] in blacklisting attachments in their email. This means blocking executable file extensions, and scanning compressed files for the malicious extensions. This could probably save lots of headaches down the road(apparently pomf as plagued by similar issues until they decided to stop allowing exes).

  1. https://support.google.com/mail/answer/6590
Guad commented 9 years ago

I think compressed archives should be allowed

Luminarys commented 9 years ago

Well, it's not a matter of preventing archives, it's more a matter of preventing archives which have the blacklisted file types. Of course it would be a bit annoying to implement this, as there'd have to be detection of all the various compression types, so I don't think this aspect is critical for now.

Guad commented 9 years ago

You mean detecting executables inside compressed archives? You'd have to account for nested archives and zip bombs, etc. I think for now we're fine with the current system.

Luminarys commented 9 years ago

Yea it might be more trouble than it's worth, for now I think it should be fine.