Cant really find any specifics here except at a high level the platform says it performs anti-virus on all file based objects.
Can someone chime in here with any more information ?
It’s been highlighted on one of our recent PEN tests that file handling is very poor in this regard. We are using the AppShare DropZone File Uploader component as the front end in our application.
But It doesn’t appear to perform any kind of checking (virus or malware) before storing said document meaning you could be propagating a nasty if people are then able to view / download said document.
There certainly is no concept of quarantine or otherwise I have seen ?
Ive just discovered that the DropZone File Uploader barfs when you are using “ID and Hash” for Record identifier in URLs
Seems like that should probably be fixed at source in due course. Will attempt to fix locally in the meantime.
All uploaded files (via any means) are scanned with an anti-virus tool (ClamAV) and will be rejected before being stored on disk if anything is detected.
The DropZone widget will not have anything specific for this, it is handled by the underlying platform. I’m not sure if/how it would present a rejected file to the user.
Bob,
I mean thats great (generally) but I assume then the file uploader is entirely unaware of that. I assume the file provided it passes its own validation (type / mime etc) is just passed on to the system for actual storage.
I may need to raise a ticket anyway in due course as our PEN test provider was able to upload a file they say should have been flagged / rejected.
Will do that when I’m ready.
1 Like
Has anyone noticed that the determination of mime type is tied to the filename and not the actual content of the file.
This is a bit of nuisance because you could maskerade a zip file as a png and upload it no worries. Create knows it’s a zip file (has its mime type correct) when uploaded so it is doing the determination correctly but the uploader blindly allows it.
Feels like another request to perhaps tighten up the functionality moving forward too.
Create itself doesn’t use the extension to determine mime type (at least not solely), it uses the standard linux file command I believe.
I’m not sure how feasible/efficient it would be to get the Dropzone widget to do similar checks on the file content using browser JS, maybe there is a library for this somewhere.
Yes that makes sense - create knows the “real” mime type of the file regardless of the name / extension.
I could create a routine that compares the extension and mime types and if they are not in a matching set then I could delete the file - this maybe a bad experience for users though who may find their file just never turns up despite the upload appearing to be successful.
Mind you I guess in the event the system eventually rejects the file its the same outcome 