Mail Attachment Security

Collapse
This topic is closed.
X
X
Collapse
 
  • Page of 1
  • Time
  • Show
Clear All
new posts
Previous template Next
  • Tyrone Slothrop
    #1

    Mail Attachment Security

    I have created a script which attaches form uploaded files to an
    email. What security is suggested to prevent attachments which may
    contain viruses, etc. from being uploaded? I am running finfo_file()
    to determine the mime-types of the files being uploaded, so it should
    easy to exclude certain types of files based on this, or the file's
    extension.

    Also, I would like to send an alternative text with this email. Is
    there a good script out there that removes HTML and converts to simple
    formatted text?

    TIA!
    Tags: None
    • Gordon Burditt
      #2
      Re: Mail Attachment Security

      >I have created a script which attaches form uploaded files to an
      >email. What security is suggested to prevent attachments which may
      >contain viruses, etc. from being uploaded?
      If the uploaded file is coming from an untrusted source, don't trust
      it. It's probably SPAM. The worst stuff is just straight text
      files that contain stuff that infects human minds (like MAKE MONEY
      FAST chain letters).
      >I am running finfo_file()
      >to determine the mime-types of the files being uploaded, so it should
      >easy to exclude certain types of files based on this, or the file's
      >extension.
      Not nearly enough. MIME types and file names can be arbitrarly set to
      misrepresent the contents.

        Comment

        • Tyrone Slothrop
          #3
          Re: Mail Attachment Security

          On Wed, 31 Jan 2007 00:31:40 -0000, gordonb.a68sj@b urditt.org (Gordon
          Burditt) wrote:
          >>I have created a script which attaches form uploaded files to an
          >>email. What security is suggested to prevent attachments which may
          >>contain viruses, etc. from being uploaded?
          >
          >If the uploaded file is coming from an untrusted source, don't trust
          >it. It's probably SPAM. The worst stuff is just straight text
          >files that contain stuff that infects human minds (like MAKE MONEY
          >FAST chain letters).
          >
          >>I am running finfo_file()
          >>to determine the mime-types of the files being uploaded, so it should
          >>easy to exclude certain types of files based on this, or the file's
          >>extension.
          >
          >Not nearly enough. MIME types and file names can be arbitrarly set to
          >misrepresent the contents.
          While I may agree with you, my client wants an upload so that is what
          she gets. I may have to send the mails via SMTP so they run through a
          Brightmail service and then Spam Assassin instead of going directly to
          her mailbox. I was just hoping for something a bit simpler.

            Comment

            • Gordon Burditt
              #4
              Re: Mail Attachment Security

              >While I may agree with you, my client wants an upload so that is what
              >she gets. I may have to send the mails via SMTP so they run through a
              >Brightmail service and then Spam Assassin instead of going directly to
              >her mailbox. I was just hoping for something a bit simpler.
              That might make your client secure, at the expense of racking up
              counts of spam sent apparently by your web site to Brightmail. That
              could cause trouble (blocking) down the road.

              You could install several major antivirus programs and spam filter
              on your web site, and run all the attachments through all of those.
              I'm not sure that's simpler.


                Comment

                Previous template Next
                Working...