Security related to .csv files

[impact]

Hello,

I am trying to import Google contacts into my site. For the moment I am trying to import contacts through Google contacts .csv file.

I am able to upload the file successfully into my server. Any idea what kind of security should I implement so that this is not misused? Please also let me know how do i check the file extension and file content so that no potentially dangerous files are uploaded into the server.

I am novice, your generous help will be appreciated.

Thank you,

[Brett_Tabke]

Can you get to the file via http?

If so - put it in a directory that is not visible from the web.

[Matthew1980]

^^^

Yep, on most server/hosts it's called private_html, but you get the idea. If this uploader is your own creation you could check that the file type is as it should be. Basic security there.

Cheers,
MRb

[rocknbil]

Checking extension is a waste of time, all anyone needs to do is change the extension of an executable. You'd probably want to cleanse the input file thoroughly line by line. Something like

$delimiter = '|'; // , "?,"?, \t, etc.

$err = cleanse_upload($delimiter,$file);
if $err { // some error response here }

A decent start is:

if (preg_match('/[^\w\d\s$delimiter]/',$file)) {
return "Bad data";
}

"Anything not a word character, digit, whitespace, return an error"

Then go through line by line, cleansing. You could do the entire block but there may be some fields you want to examine differently.

foreach ($lines as $line) {

//Throw away everything you don't want.
// Note a-z is not the same as \w
// This will disable <script> but leave "script"
// in so you can see what they are up to.
// Translation: remove anything not these
$line = preg_replace('/[^a-z\d\s,\.\"\'$delimiter]/i','',$line);

// Then explode on the delimiter, run the standard stuff:
// escape strings, etc., then reassemble it
}