Skip to main content

Inadequate file size control

Need​

Implementation of file size restrictions and validation

Context​

  • Usage of C# 7.1 for developing applications with advanced language features and improvements
  • Usage of Microsoft.AspNetCore.Mvc for building web applications with ASP.NET Core MVC
  • Usage of Microsoft.AspNetCore.Http for handling HTTP requests and responses in ASP.NET Core applications
  • Usage of System.IO for input/output operations in .NET development

Description​

Non compliant code​

[HttpPost]
public async Task<IActionResult> UploadFile(IFormFile file)
{
    if (file == null || file.Length == 0)
        return Content("file not selected");

    var path = Path.Combine(
        Directory.GetCurrentDirectory(), "wwwroot",
        file.GetFilename());

    using (var stream = new FileStream(path, FileMode.Create))
    {
        await file.CopyToAsync(stream);
    }

    return RedirectToAction("Files");
}

The above C# code is used to upload files in an ASP.NET Core application. Here, the UploadFile method is decorated with the [HttpPost] attribute, indicating that it's an action method for handling HTTP POST requests.

It accepts a parameter of type IFormFile, which represents a file sent with the HttpRequest. If the file is null or its length is zero, the method returns a message "file not selected".

Then, it creates a path where the file should be saved on the server. The Path.Combine method is used to combine several strings into a path.

Next, it creates a new file stream and copies the contents of the uploaded file into this stream. This is done inside a using block, which ensures that the stream is correctly disposed after use, even if an exception is thrown.

Finally, it redirects the user to the "Files" action.

The vulnerability in this code is that there is no check on the size of the uploaded file. An attacker could exploit this to upload very large files, potentially filling up the server's storage and causing a Denial of Service (DoS) attack.

Steps​

  • Implement server-side file size validation to check the size of the uploaded file.
  • Set a maximum file size limit for the uploaded files.
  • Handle the case where the uploaded file exceeds the maximum file size limit and provide appropriate error messages to the user.
  • Consider using client-side validation to prevent large files from being uploaded in the first place.
  • Ensure that the file size limit is enforced consistently across all layers of the application (e.g., frontend, backend, and server configurations).

Compliant code​

[HttpPost]
public async Task<IActionResult> UploadFile(IFormFile file)
{
    // Set a maximum file size limit (in bytes)
    long maxFileSize = 10485760; // 10 MB

    if (file == null)
        return Content("File not selected");

    if (file.Length == 0)
        return Content("File is empty");

    if (file.Length > maxFileSize)
        return Content("File size exceeds the maximum limit of 10 MB");

    var path = Path.Combine(
        Directory.GetCurrentDirectory(), "wwwroot",
        file.GetFilename());

    using (var stream = new FileStream(path, FileMode.Create))
    {
        await file.CopyToAsync(stream);
    }

    return RedirectToAction("Files");
}

The updated code now includes a server-side file size validation. A maximum file size limit is set (in this case, 10 MB), and the size of the uploaded file is checked against this limit. If the file is null, an error message is returned. If the file is empty (i.e., its length is 0), another error message is returned. If the file size exceeds the maximum limit, a different error message is returned.

This way, the server prevents large files from being uploaded, which can cause performance issues or even crash the server. It's also a good practice to implement client-side validation to provide immediate feedback to the user and prevent unnecessary network traffic. However, client-side validation can be bypassed, so it's important to always validate on the server side as well.

Remember to enforce the file size limit consistently across all layers of the application, including frontend, backend, and server configurations, to ensure the security and performance of your application.

References​

Last updated on