Skip to main content

Inappropriate coding practices - invalid file

Need​

Enforcement of proper file validation and verification

Context​

  • Usage of Scala 2.12 for building scalable and high-performance applications
  • Usage of play.api.mvc for handling HTTP requests and responses in Play Framework
  • Usage of java.io for input and output operations in Java

Description​

Non compliant code​

import java.io._
import play.api.mvc._

def uploadFile = Action(parse.multipartFormData) { request =>
  request.body.file("file").map { file =>
    val filename = file.filename
    val contentType = file.contentType
    file.ref.moveTo(new File(s"/tmp/$filename"))
    Ok("File has been uploaded")
  }.getOrElse {
    Redirect(routes.Application.index).flashing(
      "error" -> "Missing file"
    )
  }
}

The above code represents a file upload feature in a Scala backend application using the Play framework. This function, uploadFile, accepts a file from a multipart form-data request and saves it into a temporary directory.

The vulnerability lies in the fact that the file is directly saved without any validation of its content or extension. This can lead to a security risk as an attacker could upload a malicious file, which may not match the file extension, causing potential harm when the file is used later in the application.

For instance, an attacker could upload a file with a .txt extension but the actual content could be a harmful script or executable. Since the application does not validate the content of the file against its extension, it would just save the file, leading to a potential security risk.

Steps​

  • Validate the file extension before storing it in the repository.
  • Use a whitelist of allowed file extensions to ensure that only valid files are accepted.
  • Verify the file content to ensure it matches the expected file type based on its extension.
  • Consider using a library or framework feature to validate the file content, such as file type detection or content-type checking.
  • Handle the case where the file extension and content do not match, and take appropriate action (e.g., reject the file or convert it to the correct format).

Compliant code​

import java.io._
import play.api.mvc._
import play.api.libs.MimeTypes

def uploadFile = Action(parse.multipartFormData) { request =>
  request.body.file("file").map { file =>
    val filename = file.filename
    val contentType = file.contentType
    val extension = filename.split('.').lastOption.getOrElse("")
    val allowedExtensions = List("jpg", "png", "pdf") // Add more extensions as per your requirements

    if (allowedExtensions.contains(extension) && MimeTypes.forFileName(filename).equals(contentType)) {
      file.ref.moveTo(new File(s"/tmp/$filename"))
      Ok("File has been uploaded")
    } else {
      BadRequest("Invalid file format")
    }
  }.getOrElse {
    Redirect(routes.Application.index).flashing(
      "error" -> "Missing file"
    )
  }
}

The updated code now includes a validation step before moving the file to the repository. This validation checks both the file extension and the content type to ensure they match the expected values.

Firstly, the file extension is extracted from the filename using the split function. This function splits the filename into an array of strings using the '.' character as a delimiter. The lastOption function is then used to get the last element of this array, which should be the file extension.

Next, a list of allowed file extensions is defined. This list can be modified to include any file extensions that should be accepted by the application.

The if statement then checks if the file extension is in the list of allowed extensions and if the content type of the file matches the expected content type for that file extension. The MimeTypes.forFileName function is used to get the expected content type for the file based on its extension.

If the file passes these checks, it is moved to the repository and a success message is returned. If the file does not pass these checks, a "Bad Request" response is returned with a message indicating that the file format is invalid.

This updated code helps to ensure that only valid files are accepted by the application, reducing the risk of issues caused by incompatible file content and extensions.

References​

Last updated on