Unrestricted Upload of File with Dangerous Type
The product allows the upload of files without properly validating the file type, which can lead to execution of malicious code.
When users can upload files without restriction, attackers may upload executable files, scripts, or other dangerous content that can be executed by the server or other users.
この脆弱性の修正方法
3 件の Shoulder 検出ルールに基づく Unrestricted File Upload の予防策。
Validate file type, enforce size limits, and use generated filenames for uploads
func upload(w http.ResponseWriter, r *http.Request) { - file, header, _ := r.FormFile("file") - defer file.Close() - dst, _ := os.Create("/var/www/uploads/" + header.Filename) + r.Body = http.MaxBytesReader(w, r.Body, 10*1024*1024) + file, header, err := r.FormFile("file") + if err != nil { + http.Error(w, "Invalid file", 400) + return + } + defer file.Close() + ext := filepath.Ext(header.Filename) + allowed := map[string]bool{".jpg": true, ".png": true, ".pdf": true} + if !allowed[ext] { + http.Error(w, "File type not allowed", 400) + return + } + safeFilename := uuid.New().String() + ext + dst, _ := os.Create(filepath.Join("/var/uploads", safeFilename)) defer dst.Close() io.Copy(dst, file) }
Add fileFilter to multer to validate uploaded file types
- const upload = multer({ dest: 'uploads/' }); + const upload = multer({ + dest: 'uploads/', + fileFilter: (req, file, cb) => { + const allowed = ['image/jpeg', 'image/png', 'image/gif']; + if (allowed.includes(file.mimetype)) { + cb(null, true); + } else { + cb(new Error('Invalid file type'), false); + } + } + }); app.post('/upload', upload.single('file'), handler);
Validate file extension, MIME type, and size; use secure_filename() for paths
- from flask import request - - @app.route('/upload', methods=['POST']) - def upload(): - file = request.files['file'] - file.save(f'uploads/{file.filename}') - return {'status': 'uploaded'} + from flask import request, jsonify + from werkzeug.utils import secure_filename + + ALLOWED = {'png', 'jpg', 'pdf'} + + @app.route('/upload', methods=['POST']) + def upload(): + file = request.files['file'] + ext = file.filename.rsplit('.', 1)[-1].lower() + if ext not in ALLOWED: + return jsonify({'error': 'Invalid type'}), 400 + filename = secure_filename(file.filename) + file.save(f'uploads/{filename}') + return jsonify({'filename': filename})
コードの脆弱性を見つける
Shoulderを使用してコードのUnrestricted Upload of File with Dangerous Typeパターンをスキャンしましょう。 3 ルール.
# Scan with Shoulder CLI npx @shoulderdev/cli trust --cwe=434 # Or scan entire project npx @shoulderdev/cli trust .
検出ルール (3)
コードレビューで注目すべき点
これらのパターンはUnrestricted Upload of File with Dangerous Typeの潜在的な脆弱性を示しています。コードレビューとセキュリティ監査中に探してください。
コードベースをスキャン: Unrestricted Upload of File with Dangerous Type
Shoulder CLI はコードベース全体から脆弱なパターンを見つけます。