0

Presume a desktop application presents a Problem Reporting interface as part of it's GUI, and I wish to allow users to upload files as part of that PR.

One would hope this is only ever used for constructive purposes, however - this raises several questions:

  1. How does an organisation deal with 'content policy' - i.e. users uploading content etc that is against our terms, legal, moral etc
  2. How to protect against malicious file uploads, i.e. executables

There are plenty of pages such as this, but preventing upload of certain file types by extension is surely, weak?

Improve this question
2
  • Do you work at a desktop application for an organization where you actually have this issue? Then please tell us more about your specific requirements, and more about your organizational environment (i.e. size of the user base, are users working for the organization, who is in charge of moderating). In the current form the question looks like asked just "for curiosity" and would require a broad "catch all" answer.
    – Doc Brown
    Commented Nov 24, 2023 at 5:53
  • Thanks Doc, to elaborate - micro organisation, the tool is a configuration GUI with a very small public user base (hundreds of users), albeit it is available for public download thus technically open to all. Uploads are seen simply by engineering and support staff primarily for customer support purposes.
    – mountainred
    Commented Nov 26, 2023 at 1:56

1 Answer 1

Reset to default
3

For point 1: It really depends on how public the uploaded files are. For instance if they only viewable by a small group of admin users, then no problem. If they are viewable by any user, then you have a business problem that needs to be communicated back to your BAs for policy and effort decisions. You may need to institute a manual approval system.

For point 2: Allowing only specific extensions is stronger than it looks on the surface. A malicious .exe file renamed to say .jpg will be harmless if only opened by a program that expects image files, and enforcing reasonable rules should not be difficult. Some filtering will almost certainly be required. For instance files intended to be opened with apps like Excel or Word almost certainly want to have macros disabled. I'm a little out if touch in this area but a Google search should bring up some good advice.

Improve this answer
1
  • Thanks @kiwiron, see my reply to Doc Brown above re access. On reflection of your answer, I hadn't appreciated how effective a filetype filter could really be. I see also the Win32 API includes a function to check if a file is an executable (learn.microsoft.com/en-us/windows/win32/api/winbase/…), combining this with automated malware scanning, that sounds like a good start at least.
    – mountainred
    Commented Nov 26, 2023 at 2:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.