Determine the size and type of files that users are expected to upload
to your system. Take measures to assure that the files meet those
requirements.
Other Notes
This can have a chaining relationship with incomplete blacklist /
permissive whitelist errors when the product tries, but fails, to properly
limit which types of files are allowed.
This can also overlap multiple interpretation errors for intermediaries,
e.g. anti-virus products that do not filter attachments with certain file
extensions that can be processed by client systems.
This can be primary when there is no check at all. If is frequently
resultant when use of double extensions (e.g. ".php.gif") bypass sanity
checks. Also resultant from client-side enforcement; some products will
include web script in web clients to check the filename, without verifying
on the server side.
PHP applications are most targeted, but this likely applies to other
languages that support file upload, as well as non-web technologies. ASP
applications have also demonstrated this problem.
Description
