There is a website (in php) on which I want to upload / display photos and videos. What security measures should I adhere to and what should I do for this (I am specifically interested in security, that is, protection against hacker attacks)

3 answers 3

The question is extensive. Attack vectors may be several and all of them can be considered for a long time.

But perhaps the main thing that you should pay attention to is that instead of a picture you are not transferred to the server something else: a php script, html page, or other content that when published on the server can potentially cause a problem: I think php script should not be commented upon; but the html page may contain for example js code to steal a cookie.

    I will touch on a slightly more extensive topic - it’s better to take it as a rule to check all entered fields in order to avoid unwanted injections and infiltrations on the site. Here is an example of regulars who will help you in these checks:

    Набор ΠΈΠ· Π±ΡƒΠΊΠ² ΠΈ Ρ†ΠΈΡ„Ρ€ (Π»Π°Ρ‚ΠΈΠ½ΠΈΡ†Π°): ^[a-zA-Z0-9]+$ Набор ΠΈΠ· Π±ΡƒΠΊΠ² ΠΈ Ρ†ΠΈΡ„Ρ€ (Π»Π°Ρ‚ΠΈΠ½ΠΈΡ†Π° + ΠΊΠΈΡ€ΠΈΠ»Π»ΠΈΡ†Π°): ^[Π°-яА-ЯёЁa-zA-Z0-9]+$ Π”ΠΎΠΌΠ΅Π½ (Π½Π°ΠΏΡ€ΠΈΠΌΠ΅Ρ€ abcd.com): ^([a-zA-Z0-9]([a-zA-Z0-9\-]{0,61}[a-zA-Z0-9])?\.)+[a-zA-Z]{2,6}$ IPv4: ((25[0-5]|2[0-4]\d|[01]?\d\d?)\.){3}(25[0-5]|2[0-4]\d|[01]?\d\d?) IPv6: ((^|:)([0-9a-fA-F]{0,4})){1,8}$ Имя ΠΏΠΎΠ»ΡŒΠ·ΠΎΠ²Π°Ρ‚Π΅Π»Ρ (с ΠΎΠ³Ρ€Π°Π½ΠΈΡ‡Π΅Π½ΠΈΠ΅ΠΌ 2-20 символов, ΠΊΠΎΡ‚ΠΎΡ€Ρ‹ΠΌΠΈ ΠΌΠΎΠ³ΡƒΡ‚ Π±Ρ‹Ρ‚ΡŒ Π±ΡƒΠΊΠ²Ρ‹ ΠΈ Ρ†ΠΈΡ„Ρ€Ρ‹, ΠΏΠ΅Ρ€Π²Ρ‹ΠΉ символ ΠΎΠ±ΡΠ·Π°Ρ‚Π΅Π»ΡŒΠ½ΠΎ Π±ΡƒΠΊΠ²Π°): ^[a-zA-Z][a-zA-Z0-9-_\.]{1,20}$ ΠŸΠ°Ρ€ΠΎΠ»ΡŒ (Π‘Ρ‚Ρ€ΠΎΡ‡Π½Ρ‹Π΅ ΠΈ прописныС латинскиС Π±ΡƒΠΊΠ²Ρ‹, Ρ†ΠΈΡ„Ρ€Ρ‹): ^(?=.*\d)(?=.*[az])(?=.*[AZ])(?!.*\s).*$ ΠŸΠ°Ρ€ΠΎΠ»ΡŒ (Π‘Ρ‚Ρ€ΠΎΡ‡Π½Ρ‹Π΅ ΠΈ прописныС латинскиС Π±ΡƒΠΊΠ²Ρ‹, Ρ†ΠΈΡ„Ρ€Ρ‹, спСцсимволы. ΠœΠΈΠ½ΠΈΠΌΡƒΠΌ 8 символов): (?=^.{8,}$)((?=.*\d)|(?=.*\W+))(?![.\n])(?=.*[AZ])(?=.*[az]).*$ Π”Π°Ρ‚Π° Π² Ρ„ΠΎΡ€ΠΌΠ°Ρ‚Π΅ YYYY-MM-DD: [0-9]{4}-(0[1-9]|1[012])-(0[1-9]|1[0-9]|2[0-9]|3[01]) UPD. Π‘ΠΎΠ»Π΅Π΅ строгая ΠΏΡ€ΠΎΠ²Π΅Ρ€ΠΊΠ°, прСдлоТСнная runcore: (19|20)\d\d-((0[1-9]|1[012])-(0[1-9]|[12]\d)|(0[13-9]|1[012])-30|(0[13578]|1[02])-31) Π”Π°Ρ‚Π° Π² Ρ„ΠΎΡ€ΠΌΠ°Ρ‚Π΅ DD/MM/YYYY: (0[1-9]|[12][0-9]|3[01])[- /.](0[1-9]|1[012])[- /.](19|20)\d\d Π¦Π΅Π»Ρ‹Π΅ числа ΠΈ числа с ΠΏΠ»Π°Π²Π°ΡŽΡ‰Π΅ΠΉ Ρ‚ΠΎΡ‡ΠΊΠΎΠΉ (Ρ€Π°Π·Π΄Π΅Π»ΠΈΡ‚Π΅Π»ΡŒ Ρ‚ΠΎΡ‡ΠΊΠ°): \-?\d+(\.\d{0,})? UUID: ^[0-9A-Fa-f]{8}\-[0-9A-Fa-f]{4}\-[0-9A-Fa-f]{4}\-[0-9A-Fa-f]{4}\-[0-9A-Fa-f]{12}$ Π¨ΠΈΡ€ΠΎΡ‚Π° ΠΈΠ»ΠΈ Π΄ΠΎΠ»Π³ΠΎΡ‚Π°: -?\d{1,3}\.\d+ UPD. E-mail (ΠΎΡ‚ kvf77): ^[-\w.]+@([A-z0-9][-A-z0-9]+\.)+[Az]{2,4}$
    • It is better to organize the architecture of the site so that such checks are basically not needed, especially in frankly inappropriate places such as a password, mail, domain, and free-text fields like this comment - andreymal
    • What kind of information security are you writing if there are gross errors in the regexp code?) for example, "^ [- \ w.] + @ ([A-z0-9] [- A-z0-9] + \.) + [ Az] {2,4} $ "- the point in the first quotes is not screened (that is, you can drive anything into this field at all. - Dmitry Maslennikov

    Be sure to check the file contents by mime type. In php there is a built-in function mime_content_type or third-party developments . This is certainly not the only thing that will help avoid the actions of persons with reduced social responsibility :)

    • Well, the avatarka.png.php.png file with RCE inside will be loaded with the image / png type, and what's the use?) In general, the file name doesn’t necessarily indicate the contents of the file, and mime_content_type may well lie and - andmal
    • From this point of view, everything can lie, rely on the file name and the extension is definitely not worth it, but the contents need to be analyzed. This is the first step. The second step, for example, if we are talking about an image, try to resize it, ImageMagic for example, if it gives an error, then the file is in the firebox, the sender is banned :) There are many test options, everyone chooses the optimal one for himself. - NewView
    • I completely agree, but your answer is still not about the content, but about the name) At least the second link is andreymal
    • But ImageMagic is a good thing, it would have been worth mentioning in the answer) - andreymal
    • 'Be sure to check the file contents by mime type' - or is it published differently from you? - NewView