Click here to Skip to main content
15,888,816 members
Please Sign up or sign in to vote.
0.00/5 (No votes)
See more:
Hi,

In RS( Request Specification), we have help page in the user can upload the files (.docx,.doc,.pdf,.txt,.xls,.xlsx).

The Security team is approaching like developer need to scan the content of the uploading documents to find is there any malicious script or any other script is there to avoid the application crash or data security breach.

i coded to validate the file extension, proper file name , and it will not allowed if there is no content available in the documents which user upload.

Can anyone pls suggest what to in this situation, what is adequate way to do this requirement.

Application developer : Front End MVC 5 , Back End C#

Thanks in Advance.

What I have tried:

C#
if (fileContent != null && fileContent.ContentLength > 0)
                {
                    var supportedTypes = new[] { "txt", "doc", "docx", "pdf", "xls", "xlsx" };
                    var fileExt = System.IO.Path.GetExtension(file).Substring(1);  //datatime.now.tostring(yyyymmdd)

                    if (!CheckFileName(fileContent.FileName))
                    {
                        ErrorMessage = "File Name format Is InValid, Please Change the File Name ";
                        return Json(ErrorMessage);
                    }                                           

                    else if (!supportedTypes.Contains(fileExt))
                    {
                        ErrorMessage = "File Extension Is InValid - Only Upload WORD/PDF/EXCEL/TXT File";
                        return Json(ErrorMessage);

                    }
                    else if (Request.Files.Count == 0)
                    {
                        ErrorMessage = "Please select the file to upload";
                        return Json(ErrorMessage);
                    }
                    else
                    {
                        var Inputfile = Request.Files[0];
                        var basepath = fMPortalSettings.FMPortalApplicationConfiguration.HelpDocumentPath;

                        if (Inputfile != null && Inputfile.ContentLength > 0)
                        {
                            var filename = Path.GetFileName(Inputfile.FileName);
                            var path = basepath + filename;

                            Inputfile.SaveAs(path);
                            objFMHelpModel.CreatedDate = DateTime.Now;
                            objFMHelpModel.Link = data.Link;
                            objFMHelpModel.Description = data.Description;
                            objFMHelpModel.FileName = fileContent.FileName;
                            objFMHelpModel.ID = data.ID;
                            helpService.AddorEditHelpDetails(objFMHelpModel);
                            ErrorMessage = "File Uploaded Successfully";
                        }
                    }
                }
                else
                {
                    ErrorMessage = "File Does not contain any Data";
                }
Posted
Updated 30-Jan-19 3:06am
v2

Unfortunately what you have will only scratch the surface when it comes to vulnerabilities.

MS Office files can have files attached/embedded within them as well as have macros attached to them. PDFs can also have functionality added to them.

A thorough check of an uploaded Word or Excel document would have you actually open up the file within your uploader and then checking for Macros or Embedded/Attached files.

A cheap trick that you can do with the current versions (docx, xlsx) is to utilize the fact that they actually are ZIP files with content files within them.
You could un-zip these and review all of the files that are within it and look for malicious files.

No matter what, this is going to require quite a bit of research to do:
Google: Office Interop Word Embedded Files[^]
Google: Office Interop Word Macro[^]

My Recommendation would be to purchase and utilize actual software specializing in protecting from malicious uploads; like the kind used to scan email attachments. If your company already has this there may be an API available to use.
 
Share this answer
 
v2
Comments
Vadivel Murthy 30-Jan-19 9:05am    
Thank you for the info @MadMyche
MadMyche 30-Jan-19 9:17am    
You're Welcome. I am sorry I could not provide you code to meet your requirements. Sometimes it is better to just not code the solution. And the methods of today may not work with the attacks of tomorrow
Vadivel Murthy 30-Jan-19 9:20am    
No problem @MadMyche.
Maybe you can use the free and open source nClam: https://www.architectryan.com/2011/05/19/nclam-a-dotnet-library-to-virus-scan/[^]
The example however seems to be server based, it will take some work to get this working on a client to scan before the upload :)
 
Share this answer
 
Comments
Vadivel Murthy 30-Jan-19 9:11am    
@RickZeeland, thanks for the info.
the software will scan the file and check if there is any Virus available , however i need to analyze or scan the content of file to check with contain .exe or any Javascript which will create security issues.
MadMyche 30-Jan-19 9:29am    
It is a viable step; using a third-party scanner is the recommendation I had.
Vadivel Murthy 30-Jan-19 9:38am    
ya @MadMyche, i am currently working on it. to implement the third party .exe to scan all the uploading documents.

however my question is, it will check the script which are inside any word or pdf file.

This content, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)



CodeProject, 20 Bay Street, 11th Floor Toronto, Ontario, Canada M5J 2N8 +1 (416) 849-8900