Skip to content
Advertisement

How can I code a PHP file upload specificly for json files that is secure and wont allow Php or html to be uploaded

I am working on a site that allows models to be uploaded. the models are json format like this :

JavaScript

The file is called crocodile.bbmodel

I am looking for a way to allow users to upload .bbmodel files that is safe so that no web shells or malicious code can sneak its way past the upload can you guys help?

Advertisement

Answer

From what I know there is no magic button that will let you do this. that said the first thing you will want to do is make sure the uploaded file is valid json. check this Fastest way to check if a string is JSON in PHP?

Next you will need to define which fields in json are valid and what types the value should contain. for this I would create a skeleton versioin of the json string and store it a database field. Examining your json further you might need multiple skeletons for the various repeat or nested elements. eg one for meta like this

JavaScript

you would want another skeleton for elements probably describing the keys for a single ‘element’. and of course validate the textures.source nodes against a base64 encoding.

Next you will want to decide what are acceptable types for each of the field values. compare each field of the submitted json against an acceptable type you define.

once you do all of this validation you can be reasonably sure you have a valid file…I won’t say secure or non-malicious but, done properly it will help you ingest the file without errors.

Still not guaranteed to be ‘secure’ but, it is a reasonable approach and would probably satisfy most due diligence critiques. If anyone can improve and provide more steps or different tricks to secure something like this I’d be glad to hear it.

User contributions licensed under: CC BY-SA
9 People found this is helpful
Advertisement