Nilesh Kumar

Acting against a malicious file upload is not an easy task. We need to maintain fine balance between security and user experience. We can still use the traditional ways such as checking content type, file headers, extensions etc. but what about in cases where a code is appended to a file jpg/ png files. The above traditional countermeasures will not work. So a few countermeasures for such scenarios: Similar to how WAF (Web Application Firewalls) work, the application should analyze each part of the file. The file needs to be parsed and look for any malicious hints/ contents such as executable codes containing dangerous functions - system, exec, kill etc. Also, check for existence of encoders such as base64 etc. There's no point of their presence in an innocent image file. Another effective method is to crop the image before saving it. Check the code here in Case 3 section of Sanitizing image files. What it basically does is, before saving the file, it does some resizing and