Skip to main content

Inappropriate coding practices - invalid file

Need​

Enforcement of proper file validation and verification

Context​

  • Usage of Java 8 for developing applications with enhanced features and performance
  • Usage of javax.servlet-api for Java Servlet development
  • Usage of java.io for input and output operations in Java

Description​

Non compliant code​

import javax.servlet.http.*;
import java.io.*;

public class FileUploadServlet extends HttpServlet {
    protected void doPost(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
        Part filePart = request.getPart("file"); 
        String fileName = Paths.get(filePart.getSubmittedFileName()).getFileName().toString(); 
        InputStream fileContent = filePart.getInputStream();

        byte[] buffer = new byte[fileContent.available()];
        fileContent.read(buffer);

        File targetFile = new File("/uploads/" + fileName);
        OutputStream outStream = new FileOutputStream(targetFile);
        outStream.write(buffer);
    }
}

The above code represents a simple servlet that handles file uploads. When a POST request is made to this servlet with a file, the servlet reads the file from the request, and writes it to a location on the server (/uploads/).

The vulnerability in this code lies in the fact that it doesn't verify the content of the file against its extension. This means that a file with a .txt extension could contain binary data, or a file with a .jpg extension could contain text data.

This could lead to various issues:

  1. If the application later tries to use these files based on their extension (for example, trying to display a .jpg file as an image), it might fail or behave unexpectedly because the content of the file doesn't match its extension.

  2. This could be used as a vector for attacks. For example, an attacker could upload a file with a .jpg extension that actually contains executable code, and then find a way to execute that code on the server.

  3. If the application serves these files to users, it could lead to unexpected behavior on the user's side, or even security issues. For example, a file with a .jpg extension that actually contains HTML and JavaScript could be executed by the user's browser, leading to a cross-site scripting (XSS) attack.

Steps​

  • Validate the file extension before saving it to the server.
  • Use a whitelist approach to only allow specific file extensions that are considered safe.
  • Implement server-side file type verification to ensure that the file content matches its extension.
  • Consider using a secure file storage solution or database instead of saving files directly to the server.
  • Implement proper error handling and logging to detect and handle any potential issues with file uploads.

Compliant code​

import javax.servlet.http.*;
import java.io.*;
import java.nio.file.Files;
import java.nio.file.Paths;
import java.util.Arrays;
import java.util.List;

public class FileUploadServlet extends HttpServlet {
    private static final List<String> ALLOWED_FILE_EXTENSIONS = Arrays.asList("jpg", "png", "gif", "pdf");

    protected void doPost(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
        Part filePart = request.getPart("file"); 
        String fileName = Paths.get(filePart.getSubmittedFileName()).getFileName().toString(); 
        String fileExtension = fileName.substring(fileName.lastIndexOf(".") + 1);

        // Validate file extension
        if (!ALLOWED_FILE_EXTENSIONS.contains(fileExtension)) {
            throw new ServletException("Invalid file extension");
        }

        InputStream fileContent = filePart.getInputStream();

        byte[] buffer = new byte[fileContent.available()];
        fileContent.read(buffer);

        // Verify file content
        String mimeType = Files.probeContentType(Paths.get(fileName));
        if (!filePart.getContentType().equals(mimeType)) {
            throw new ServletException("File content does not match file extension");
        }

        File targetFile = new File("/uploads/" + fileName);
        OutputStream outStream = new FileOutputStream(targetFile);
        outStream.write(buffer);
    }
}

The updated code includes a whitelist of allowed file extensions. When a file is uploaded, the code checks the file's extension against this whitelist. If the extension is not in the whitelist, a ServletException is thrown.

The code also verifies that the file's content matches its extension. It does this by using the Files.probeContentType() method to determine the file's MIME type based on its content, and then comparing this to the MIME type reported by the file upload request. If these do not match, a ServletException is thrown.

These changes help ensure that only files of the expected types are uploaded, and that the content of these files matches their reported types. This can help prevent a variety of security issues, such as the execution of malicious code disguised as a harmless file.

Please note that this code still writes the uploaded file directly to the server's file system. Depending on your application's requirements and the sensitivity of the data being uploaded, you may want to consider using a secure file storage solution or database instead.

References​

Last updated on