security - 允许应用程序/八位字节流类型的文件上传是否有安全隐患？

Question

我有一个应用程序，用户可以在其中上传文件供我们执行某些操作。唯一预期的文件类型是 JSON，最初我们限制上传类型为 application/json .

但是，我们有一位用户在尝试上传 JSON 文件时出错。我们可以更新应用程序以允许类型为 application/octet-stream 的文件并使事情正常工作，但这似乎是语义上的。

我不太了解application/octet-stream .在我的搜索中，我没有学到更多。似乎有些浏览器可能会在不知道如何处理的情况下将文件转换为这种类型；有时，当文件扩展名不存在时，可能会抛出此错误(我们已经测试了它，但仍然遇到相同的问题)；似乎这种类型允许类型为 .exe 的文件以及其他要上传的内容。

如果我们允许用户上传application/octet-stream类型的文件，是否存在安全风险？ ?为什么或者为什么不？

Answer 1

发布我的问题后，它让我从不同的角度搜索我的问题。我想我的问题在这个线程中得到了回答:

What security issues appear when users can upload their own files?

鲍勃·阿曼写道:

If you allow users to upload scripts and executables, you should make sure that anything uploaded via that form is never served back as anything other than application/octet-stream. Don't try to mix the Content-Type when you're dealing with potentially dangerous uploads. If you're going to tell users they have to worry about their own security (that's effectively what you do when you accept scripts or executables), then everything should be served as application/octet-stream so that the browser doesn't attempt to render it. You should also probably set the Content-Disposition header. It's probably also wise to involve a virus scanner in the pipeline if you want to deal with executables. ClamAV is scriptable and open source, for example.