FILe Upload related

this is not work for malicious file (file type is pdf)

You should check file type as well. Otherwise an .EXE can be uploaded by renaming it as .DOC or .TXT.

To prevent malicious files from being uploaded through the FileUpload control in a .NET Web Forms application, you can implement a combination of client-side and server-side validations. Here's a comprehensive approach:

1. Validate File Extensions

Check the file extension against a whitelist of allowed extensions (e.g., .pdf, .jpg).

string[] allowedExtensions = { ".pdf", ".jpg" };
string fileExtension = System.IO.Path.GetExtension(FileUploadControl.FileName)?.ToLower();

if (!allowedExtensions.Contains(fileExtension))
{
    lblMessage.Text = "Invalid file type. Only .pdf and .jpg files are allowed.";
    return;
}

2. Validate File MIME Type

Ensure that the uploaded file has an expected MIME type.

string mimeType = FileUploadControl.PostedFile.ContentType;

if (mimeType != "application/pdf" && mimeType != "image/jpeg")
{
    lblMessage.Text = "Invalid file type.";
    return;
}

3. Restrict File Size

Set a limit for the maximum file size to prevent oversized uploads.

int maxFileSize = 5 * 1024 * 1024; // 5 MB

if (FileUploadControl.PostedFile.ContentLength > maxFileSize)
{
    lblMessage.Text = "File size cannot exceed 5 MB.";
    return;
}

4. Scan File Content for Viruses

Integrate an antivirus scanning tool or library like ClamAV to scan the file after upload but before processing or storing it.

5. Save to a Temporary Location for Validation

Save files to a temporary, restricted location, and validate them before moving them to their final destination.

string tempPath = Server.MapPath("~/TempUploads/");
string filePath = Path.Combine(tempPath, Path.GetFileName(FileUploadControl.FileName));

FileUploadControl.SaveAs(filePath);

// Perform further validation here, such as scanning the content

6. Avoid Storing Files with Original Names

Rename the file before saving to avoid executing malicious code via name-based attacks.

string newFileName = Guid.NewGuid().ToString() + fileExtension;
string safePath = Server.MapPath("~/Uploads/" + newFileName);
FileUploadControl.SaveAs(safePath);

7. Check File Content

Analyze the file's content to confirm that it matches its declared type. For example:

• Use libraries like ImageSharp or GDI+ for image validation.
• Use PDF libraries like iTextSharp for PDF content validation.

8. Use HTTPS

Ensure your site uses HTTPS to encrypt data during transmission, preventing interception and tampering.

9. Sanitize Input

Sanitize file names and input to prevent path traversal or injection attacks.

string sanitizedFileName = Path.GetFileName(FileUploadControl.FileName);

10. Impose Storage Restrictions

Store uploaded files outside the application root to prevent direct access via URL.

Example: Complete File Upload Validation Code

protected void UploadButton_Click(object sender, EventArgs e)
{
    if (FileUploadControl.HasFile)
    {
        string[] allowedExtensions = { ".pdf", ".jpg" };
        string fileExtension = Path.GetExtension(FileUploadControl.FileName)?.ToLower();

        if (!allowedExtensions.Contains(fileExtension))
        {
            lblMessage.Text = "Invalid file type.";
            return;
        }

        if (FileUploadControl.PostedFile.ContentLength > 5 * 1024 * 1024)
        {
            lblMessage.Text = "File size cannot exceed 5 MB.";
            return;
        }

        string mimeType = FileUploadControl.PostedFile.ContentType;
        if (mimeType != "application/pdf" && mimeType != "image/jpeg")
        {
            lblMessage.Text = "Invalid file type.";
            return;
        }

        string newFileName = Guid.NewGuid().ToString() + fileExtension;
        string safePath = Server.MapPath("~/Uploads/" + newFileName);

        FileUploadControl.SaveAs(safePath);
        lblMessage.Text = "File uploaded successfully.";
    }
    else
    {
        lblMessage.Text = "Please select a file to upload.";
    }
}

11. Regular Security Updates

Keep your .NET environment and libraries updated to mitigate vulnerabilities.

By combining these strategies, you can significantly reduce the risk of malicious file uploads in your .NET Web Forms application.

Web.config for File Execution Restrictions i.e., check that the directory where you save uploads doesn't allow the execution of uploaded files, by configuring the web.config to block executable files. For example:

Even though file extensions and MIME types can be validated, attackers may still try to upload files disguised as images or PDFs. For example, a .pdf file might contain a malicious script or a .jpg file might be a malicious executable disguised with an image extension. Therefore, you should not rely solely on the file extension or MIME type. Save uploaded files outside of the web root directory to avoid accidental exposure. This way, the files are not directly accessible via a URL. If files need to be publicly available, use a controlled mechanism (such as a download handler).

To prevent malicious file uploads in ASP.NET Web Forms:
- Allow only specific extensions (e.g., .pdf, .jpg) also check the MIME type matches the expected type.
- Limit File Size. For example reject files exceeding a size limit (e.g., 5 MB).
- You have to verify the file content (e.g., validate images using System.Drawing).
- Ensure secure file uploads over HTTPS.
- Block script execution in upload folders via IIS/web.config.

For example

protected void UploadFile_Click(object sender, EventArgs e)
{
    string[] allowedExtensions = { ".pdf", ".jpg", ".jpeg", ".png" };
    string[] allowedMimeTypes = { "application/pdf", "image/jpeg", "image/png" };
    int maxFileSize = 5 * 1024 * 1024; // 5 MB
    string fileExtension = Path.GetExtension(FileUpload1.FileName).ToLower();
    string mimeType = FileUpload1.PostedFile.ContentType.ToLower();

    // Validate file extension
    if (!allowedExtensions.Contains(fileExtension))
    {
        LabelMessage.Text = "Invalid file type. Only PDF and image files are allowed.";
        return;
    }

    // Validate MIME type
    if (!allowedMimeTypes.Contains(mimeType))
    {
        LabelMessage.Text = "Invalid MIME type.";
        return;
    }

    // Validate file size
    if (FileUpload1.PostedFile.ContentLength > maxFileSize)
    {
        LabelMessage.Text = "File size exceeds the maximum limit of 5 MB.";
        return;
    }

    // Validate file content (for images)
    if (fileExtension == ".jpg" || fileExtension == ".jpeg" || fileExtension == ".png")
    {
        try
        {
            using (var img = System.Drawing.Image.FromStream(FileUpload1.PostedFile.InputStream))
            {
                // Valid image
            }
        }
        catch
        {
            LabelMessage.Text = "Invalid image content.";
            return;
        }
    }

    // Code for save file

    LabelMessage.Text = "File uploaded successfully.";
}