File Upload Security

CyberStore validates uploads through FileUpload.ashx before making files available to the application. In v2024.2, validation includes authenticated-request checks, configured file-type and size checks, file-content inspection, filename protection, and Windows Defender scanning.

Prerequisites

Before using an upload workflow, confirm that:

  • The workflow submits an authenticated CyberStore request with a valid client code and current shopper session access key.
  • Windows Defender is available to scan uploads.
  • ASP.NET and IIS permit the required request size.
  • App_Data/upload-settings.json contains valid upload configuration.

Standard Configuration

The supplied standard configuration permits the following file types:

File type Extensions
PDF .pdf
JPEG image .jpg, .jpeg
PNG image .png
Microsoft Word .docx
Microsoft Excel .xlsx
Microsoft PowerPoint .pptx

The standard maximum size of an individual file is 10485760 bytes, or 10 MiB.

Configure Upload Validation

Maintain server-side upload rules in App_Data/upload-settings.json. The configuration properties below control the available file types and their validation.

Property Purpose
AllowedExtensions Lists extensions the handler can accept, including the leading period.
MaxFileSizeBytes Sets the maximum permitted size of an individual file in bytes.
ContentTypeMappings Lists MIME types accepted for each configured extension.
SignaturesHex Lists permitted file-header signatures as hexadecimal bytes.
OOXMLParts Lists required ZIP entries for .docx, .xlsx, and .pptx files.
BlockedExtensions Lists additional extensions that must be rejected.
BlockedZipEntries Lists archive entry names that cause an Office document to be rejected.
TreatContentTypeAsAdvisory Determines whether a MIME mismatch alone rejects the file.

When TreatContentTypeAsAdvisory is false, a MIME mismatch rejects the file. When it is true, the file signature remains authoritative and a MIME mismatch alone does not reject the file.

Add a Binary File Type

For most binary file types, add the extension, accepted MIME type, and recognized signature together. For example, add GIF support by merging entries such as the following into the existing configuration:

{
  "AllowedExtensions": [ ".gif" ],
  "ContentTypeMappings": {
    ".gif": [ "image/gif" ]
  },
  "SignaturesHex": {
    ".gif": [ "474946383761", "474946383961" ]
  }
}

Adding an extension to AllowedExtensions alone is not sufficient for most binary file types. The handler rejects the file when it has no recognized signature for that extension.

The .txt and .csv extensions are exceptions. When no signature is configured for these types, CyberStore uses a textual-content check.

Office Documents

For .docx, .xlsx, and .pptx files, CyberStore inspects the ZIP container and can verify the required entries defined by OOXMLParts. The handler rejects macro-enabled Office documents and documents that contain entries defined by BlockedZipEntries, such as vbaProject.bin.

Protected File Types and Filenames

CyberStore maintains a non-configurable denylist for dangerous file types. The configuration cannot permit executable, installer, script, server-side source, application-configuration, shortcut, registry, and payload-oriented archive or disk-image files.

The handler also rejects prohibited inner extensions in double-extension filenames. For example, program.exe.pdf is rejected because .exe is prohibited.

Filenames are normalized and sanitized before use. When the target filename already exists, CyberStore preserves the existing file and adds a numbered suffix to the new filename.

Malware Scanning

CyberStore scans accepted files with Windows Defender before retaining them. The upload fails closed: the file is deleted when Windows Defender identifies a threat or cannot complete the scan.

Windows Defender must be available to complete the upload. CyberStore does not retain a file that cannot be scanned successfully.

CyberStore also applies additional filesystem restrictions to upload directories to prevent uploaded content from executing.

Request Size Limits

The effective upload size limit is the smallest of:

  1. MaxFileSizeBytes
  2. The ASP.NET httpRuntime request limit
  3. The IIS request-filtering limit

Increasing MaxFileSizeBytes alone does not permit larger uploads. ASP.NET and IIS must also allow the resulting request size.

Apply and Validate Changes

CyberStore normally detects changes to upload-settings.json automatically. If the deployed environment does not detect a change, recycle the CyberStore application pool.

After changing the configuration, test permitted and rejected files through each affected upload workflow. Test a supported file, unsupported extension, oversized file, mismatched file signature, and a file with a prohibited double extension.