R040. Validate file format and extension

Requirement

The system must validate that the format (structure) of the files corresponds to their extension.

References

  1. CWE-646: Reliance on File Name or Extension of Externally-Supplied File. The software allows a file to be uploaded, but it relies on the file name or extension of the file to determine the appropriate behaviors. This could be used by attackers to cause the file to be misclassified and processed in a dangerous fashion.

Copyright © 2020 Fluid Attacks, We hack your software. All rights reserved.

Service status - Terms of Use - Privacy Policy - Cookie Policy