Skip to main content

Insecure file upload - Files Limit

Need​

Enforce file upload limits and implement proper file management

Context​

  • Usage of Dart for building cross-platform mobile, web, and desktop applications
  • Usage of Shelf for managing and organizing data in a Node.js application
  • Usage of shelf_io for managing and interacting with data storage in Node.js applications

Description​

Non compliant code​

import 'package:shelf/shelf.dart' as shelf;
import 'package:shelf/shelf_io.dart' as io;

void main() {
  var handler = const shelf.Pipeline().addMiddleware(shelf.logRequests())
      .addHandler(_echoRequest);

  io.serve(handler, 'localhost', 8080);
}

shelf.Response _echoRequest(shelf.Request request) {
  if (request.method == 'POST') {
    return shelf.Response.ok('File uploaded');
  }
  return shelf.Response.notFound('Not Found');
}

In the above Dart code, we have a simple server that is built using the shelf framework. The server listens on localhost and port 8080.

The _echoRequest function is used as the handler for all incoming requests. This function checks if the request method is POST, and if it is, it returns a 200 OK response, indicating that the file has been uploaded successfully.

However, this code is vulnerable to insecure file upload attacks because it does not limit the number of files that can be uploaded to the server. There is no mechanism in place to delete the previous file from the server when a new one is uploaded. This can lead to a server being overwhelmed with files, potentially filling up storage space and causing a denial of service. It could also potentially allow an attacker to upload malicious files to the server.

Steps​

  • Implement a file upload limit: You need to add a mechanism to limit the number of files a user can upload within a certain time frame. This can be done by keeping track of the number of files uploaded by each user and when they were uploaded.
  • Delete old files: To prevent the server from being filled with old and unnecessary files, you should implement a system that automatically deletes files after a certain period of time or when a new file is uploaded.
  • Use middleware: Middleware can be used to handle the file upload limit and deletion of old files. This can be done in the 'shelf' package by adding a middleware function to the pipeline that handles these tasks before the request reaches the handler function.
  • Handle exceptions: Make sure to handle exceptions properly. If a user tries to upload more files than allowed, the server should respond with an appropriate error message. Similarly, if there's an error while deleting old files, the server should handle it gracefully.

Compliant code​

import 'dart:async';
import 'package:shelf/shelf.dart' as shelf;
import 'package:shelf/shelf_io.dart' as io;

// Define a map to store the number of uploads per user
Map<String, int> userUploads = {};

void main() {
  var handler = const shelf.Pipeline()
      .addMiddleware(shelf.logRequests())
      .addMiddleware(_checkUploadLimit)
      .addHandler(_echoRequest);

  io.serve(handler, 'localhost', 8080);
}

// Middleware to check the upload limit
shelf.Middleware _checkUploadLimit() {
  return (shelf.Handler innerHandler) {
    return (shelf.Request request) async {
      if (request.method == 'POST') {
        final user = request.headers['user'];
        if (userUploads[user] >= 5) {
          return shelf.Response(429, body: 'Upload limit reached');
        }
        userUploads[user] = (userUploads[user] ?? 0) + 1;
        Timer(Duration(minutes: 10), () => userUploads[user]--);
      }
      return innerHandler(request);
    };
  };
}

shelf.Response _echoRequest(shelf.Request request) {
  if (request.method == 'POST') {
    return shelf.Response.ok('File uploaded');
  }
  return shelf.Response.notFound('Not Found');
}

The code above is a Dart server application using the Shelf framework. It includes a middleware function _checkUploadLimit that checks if a user has exceeded the upload limit before the request is handled by the _echoRequest function.

The _checkUploadLimit middleware function is added to the pipeline before the _echoRequest handler. This function checks if the request method is 'POST' (indicating a file upload), and if so, it checks the number of uploads for the user. If the user has reached the upload limit (in this case, 5 uploads), it responds with a 429 status code (Too Many Requests) and a message indicating that the upload limit has been reached. If the user has not reached the upload limit, it increments the number of uploads for the user and sets a timer to decrement the number of uploads after 10 minutes.

The _echoRequest function handles the request after it has passed through the middleware. If the request method is 'POST', it responds with a message indicating that the file has been uploaded. If the request method is not 'POST', it responds with a 404 status code (Not Found).

This code helps to prevent the server from being overwhelmed by too many file uploads from a single user. It also helps to prevent the server from filling up with old and unnecessary files by automatically decrementing the number of uploads for a user after a certain period of time.

References​

Last updated on