Skip to main content

Inadequate file size control

Need​

Implementation of proper file size validation and control

Context​

  • Usage of TypeScript for statically typed JavaScript development
  • Usage of Express for building web applications and handling HTTP requests
  • Usage of multer for handling file uploads in Node.js

Description​

Non compliant code​

import express from 'express';
import multer from 'multer';

const app = express();
const upload = multer();

app.post('/upload', upload.single('file'), (req, res) => {
  // Process the uploaded file
});

app.listen(3000, () => {
  console.log('Server is running on port 3000');
});

The vulnerability in this code is the lack of control over the size of the files that can be uploaded to the server.

In the code, the multer middleware is being used to handle file uploads. The upload.single('file') function specifies that only a single file with the field name 'file' can be uploaded. However, it does not include any validation or restriction on the size of the file being uploaded.

This means that an attacker can potentially upload large files, consuming server resources and storage. If the server's storage capacity is overloaded with large files, it can lead to a denial of service (DoS) attack, causing the server to become unresponsive or crash.

To mitigate this vulnerability, it is recommended to implement controls to limit the maximum file size that can be uploaded to the server.

Steps​

  • Install and import the 'express-fileupload' package
  • Configure the maximum file size limit in the multer middleware
  • Handle the case when the file size exceeds the limit
  • Implement appropriate error handling for file size limit exceeded
  • Test the updated code to ensure the file size control is working correctly

Compliant code​

import express from 'express';
import fileUpload from 'express-fileupload';

const app = express();

app.use(fileUpload({
  limits: { fileSize: 10 * 1024 * 1024 }, // Set the maximum file size limit to 10MB
}));

app.post('/upload', (req, res) => {
  if (!req.files || Object.keys(req.files).length === 0) {
    return res.status(400).json({ message: 'No files were uploaded.' });
  }

  const file = req.files.file;

  if (file.size > 10 * 1024 * 1024) {
    return res.status(400).json({ message: 'File size limit exceeded.' });
  }

  // Process the uploaded file

  res.status(200).json({ message: 'File uploaded successfully.' });
});

app.listen(3000, () => {
  console.log('Server is running on port 3000');
});

The fixed code addresses the vulnerability by implementing controls to limit the maximum file size that can be uploaded to the server.

  1. The code imports the necessary dependencies, including Express and the express-fileupload middleware.

  2. The code initializes an Express application.

  3. The code uses the fileUpload middleware and sets the maximum file size limit to 10MB using the limits option. This ensures that any file larger than the specified limit will be rejected.

  4. The code defines a POST route '/upload' to handle file uploads.

  5. Inside the route handler, the code checks if any files were uploaded. If no files were uploaded, it returns a 400 Bad Request response with a corresponding error message.

  6. The code retrieves the uploaded file from the request using req.files.file, assuming that the file input field is named 'file'.

  7. The code checks if the size of the uploaded file exceeds the maximum file size limit. If it does, it returns a 400 Bad Request response with a corresponding error message.

  8. If the file passes all the checks, the code can proceed to process the uploaded file. This part of the code is not shown in the example and can be customized based on the specific requirements of the application.

  9. Finally, the code sends a 200 OK response with a success message if the file was uploaded and processed successfully.

  10. The code starts the Express server and listens on port 3000.

By setting a maximum file size limit and checking the size of the uploaded file, the code ensures that the server resources and storage are not consumed by large files and prevents potential denial of service attacks.

References​

Last updated on