安全问题? [英] Security issue?

问题描述

我正在编写一个小型 PHP 应用程序，但不确定是否存在安全问题.所以这就是应用程序所做的:

I am writing a small PHP application and I am not sure whether I have a security issue. So this is what the application does:

• 用户可以上传图片文件(png、gif、jpg、jpeg、tiff 等)或 zip 文件

我检查了 mime 类型和扩展名，如果不允许我不允许上传(这不是我担心的部分).

I check for mime-type and extension and if it's not an allowed I don't allow the upload (this is not the part I am worried about).

现在上传后，我将文件重命名为唯一的哈希值并存储在 root 访问权限之外的文件夹中.

Now once uploaded I rename the file to a unique hash and store in a folder outside root access.

用户现在可以通过一个短 URL 访问该文件.我通过为标题设置正确的 MIME 类型来使文件可访问，然后我只使用 readfile().

The user can now access the file through a short URL. I make the file accessible by setting the right mime-type for the header and then I just use readfile().

我的问题是在图像文件中包含 jar 文件的漏洞在这里是否有效?我将图像作为纯图像提供.

My question is whether the exploit where a jar file is included inside the image file works here? I am serving the image as a pure image.

如果这样做，有什么方法可以防止这种情况发生?

If it does what are ways to prevent this?

谢谢.

推荐答案

MIME 类型检查不会解决GIFAR 问题.2009 年的 JRE 已经打了补丁，但如果你想解决这个问题，你可以

MIME type checks will not solve the GIFAR issue. 2009's JREs are already patched, but if you want to solve the issue you can either

• 提供来自不同域的图像
• 运行服务器端代码以检查图像是否包含有效的 JAR，如提到的 这里

在特定情况下，任何其他操作(除了拒绝将文件发送到任何具有足够旧 JRE 的支持 Java 的浏览器之外)都可能会失败.

Anything else (short of denying the file to any Java enabled browser with an old enough JRE) may fail on specific cases.

还要记住，要使用这种技术进行良好的攻击，您的服务器基础设施必须是开放的(请求来自同一个域的事实并不意味着您应该提供它要求的任何信息.)

Also remember that to perform a good attack with this technique your server infrastructure would have to be somewhat open (the fact that a request comes from the same domain doesn't mean that you should give any information it asks for.)

这篇关于安全问题?的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！