Question

Background

In a targeted issue tracking application (in django) users are able add file attachments to internal messages. Files are mainly different image formats, office documents and spreadsheets (microsoft or open office), PDFs and PSDs.

A custom file field type (type extending FileField) currently validates that the files don’t exceed a given size and that the file’s content_type is in a the applications MIME Type ‘white list’. But as the user base is very varied (multi national and multi platform) we are frequently having to adjust our white list as users using old or brand new application versions have different MIME types (even though they are valid files, and are opened correctly by other users within the business).

Note: Files are not ‘executed’ by apache, they are just stored (with unix permissions 600) and can be downloaded by users.

Question

What are the pro’s and con’s for the different types of validation?

A few options:

• MIME type white list or black list
• File extension while list or black list
• Django file upload input validation and security even suggests “you have to actually read the file to be sure it’s a JPEG, not an .EXE” (is that even viable when numerous types of files are to be accepeted?)

Is there a ‘right’ way to validate file uploads?

Edit

Let me clarify. I can understand that actually checking the entire file in the program that it should be opened with to ensure it works and isn’t broken would be the only way to fully confirm that the file is what it says it is, and that it isn’t corrupted.

But the files in question are like email attachments. we can’t possibly verify that every PSD is a valid and working Photoshop image, same goes for JPG or any other type. Even if it is what it says it is, we couldn’t guarantee that it’s a fully functional file.

So What I was hoping to get at is: Is file magic absolutely crucial? What protection does it really add? And again does a MIME type whitelist actually add any protection that a file extension whitelist doesn’t? If a file has an file extension of CSV, JPG, GIF, DOC, PSD is it really viable to check that it is what it says it is, even though the application itself doesn’t depend on file?

Is it dangerous to use simple file extension whitelist excluding the obvious offenders (EXE, BAT, etc.) and, I think, disallowing files that are dangerous to the users?

Answer 1

The best way to validate that a file is what it says it is by using magic.

Er, that is, magic. Files can be identified by the first few bytes of their content. It’s generally more accurate than extensions or mime types, since you’re judging what a file is by what it contains rather than what the browser or user claimed it to be.

There’s an article on FileMagic on the Python wiki

You might also look into using the python-magic package

Note that you don’t need to get the entire file before using magic to determine what it is. You can read the first chunk of the file and send those bytes to be identified by file magic.

Clarification

Just to point out that using magic to identify a file really just means reading the first small chunk of a file. It’s definitely more overhead then just checking the extension but not too mch work. All that file magic does is check that the file “looks” like it’s the file you want. It’s like checking the file extension only you’re looking at the first few chars of the content instead of the last few chars of the filename. It’s harder to spoof than just changing the filename. I’d recommend against a mime type whitelist. A file extension whitelist should work fine for your needs, just make sure that you include all possible extensions. Otherwise a perfectly valid file might be rejected just because it ends with .jpeg instead of .jpg.