Unrestricted File Upload - Githubissues

LSFLK / request-management

Generic issue management system for government

Apache License 2.0

0 stars 11 forks source link

Unrestricted File Upload #263

Closed YujithIsura closed 4 years ago

YujithIsura commented 4 years ago

It was observed that this web application has no restrictions in uploading different types of file extensions (Ex-images, PHP files and etc.)

The below listed are some of the recommendations to prevent unrestricted file upload vulnerability.

It is necessary to have a list of only permitted (whitelist) extensions on the web application.
All the control characters and Unicode ones should be removed from the filenames and their extensions without any exception.
Limit the filename length.
Uploaded directory should not have any “execute” permission.
Limit the file size to a maximum value in order to prevent denial of service attacks.