Chapter 38 — File upload and parser attacks

Practice (75 min)

1. PortSwigger Academy "File upload vulnerabilities" track: web-shell upload, content-type bypass, extension blacklist bypass, obfuscated extensions, polyglot, .htaccess, race condition on upload, and path traversal in the filename.
2. Locally: an upload endpoint storing files in the web root with the user's filename. Get a web shell (.php, then bypasses). Then apply: object storage
   • opaque key + separate cookieless origin + re-encode + magic-byte allowlist. Re-test every bypass.
3. Parser labs: an app that runs ImageMagick with a default policy.xml — trip ImageTragick (SSRF via https: delegate at least). Fix with a hardened policy.xml. Do the ffmpeg -protocol_whitelist / HLS file-read repro if you use ffmpeg.
4. Zip-slip: an extraction routine that trusts entry names; write a file outside the target dir; fix by canonicalising and containing each entry path (G1 Ch 45).
5. CSV injection: export user-controlled data to CSV; open in a spreadsheet with a =HYPERLINK/=cmd cell; add the leading-quote / escaping fix.
6. Wrap the whole parsing step in a gVisor pod with egress denied (Part 4); re-run the parser exploits and show containment.

Build it in Go (35 min) — zip slip, lying uploads, and os.Root

Go 1.24 added os.Root: a directory handle that confines every file operation to that directory at the OS level. ../, absolute paths, and symlinks that point outside are refused. No string sanitising required. This lab extracts a malicious archive both ways, then runs an upload handler against hostile inputs. Everything happens inside a temporary directory.

// safeupload: file upload and archive extraction without the classic bugs
// (Chapter 38): zip slip / path traversal, oversized bodies, and lying
// Content-Types. Uses os.Root (Go 1.24+), which confines every file
// operation to one directory -- "../", absolute paths, and symlinks that
// point outside are all refused by the OS-level API, not by string checks.
//
//	go run ./safeupload
package main

import (
	"archive/zip"
	"bytes"
	"crypto/rand"
	"encoding/hex"
	"fmt"
	"io"
	"mime/multipart"
	"net/http"
	"net/http/httptest"
	"os"
	"path/filepath"
	"strings"
)

// maliciousZip builds an archive whose entry names try to escape the target.
func maliciousZip() []byte {
	var buf bytes.Buffer
	zw := zip.NewWriter(&buf)
	for _, name := range []string{"report.txt", "../escaped.txt", "a/../../escaped2.txt"} {
		w, _ := zw.Create(name)
		io.WriteString(w, "content of "+name)
	}
	zw.Close()
	return buf.Bytes()
}

// extractNaive is the bug, as written in countless codebases.
func extractNaive(zr *zip.Reader, dest string) {
	for _, f := range zr.File {
		path := filepath.Join(dest, f.Name) // "../escaped.txt" resolves OUTSIDE dest
		os.MkdirAll(filepath.Dir(path), 0o755)
		out, err := os.Create(path)
		if err != nil {
			fmt.Println("   naive:", err)
			continue
		}
		rc, _ := f.Open()
		io.Copy(out, rc)
		rc.Close()
		out.Close()
		fmt.Println("   naive: wrote", path)
	}
}

// extractSafe opens dest as an os.Root: every path is resolved INSIDE it.
func extractSafe(zr *zip.Reader, dest string) {
	root, err := os.OpenRoot(dest)
	if err != nil {
		panic(err)
	}
	defer root.Close()
	for _, f := range zr.File {
		out, err := root.Create(f.Name)
		if err != nil {
			fmt.Printf("   safe:  refused %-22q (%v)\n", f.Name, err)
			continue
		}
		rc, _ := f.Open()
		io.Copy(out, io.LimitReader(rc, 10<<20)) // also cap decompressed size: zip bombs
		rc.Close()
		out.Close()
		fmt.Println("   safe:  wrote", filepath.Join(dest, f.Name))
	}
}

// uploadHandler accepts an image upload safely.
func uploadHandler(store *os.Root) http.HandlerFunc {
	return func(w http.ResponseWriter, r *http.Request) {
		r.Body = http.MaxBytesReader(w, r.Body, 1<<20) // 1 MB, enforced while reading
		file, hdr, err := r.FormFile("file")
		if err != nil {
			http.Error(w, "bad upload: "+err.Error(), http.StatusRequestEntityTooLarge)
			return
		}
		defer file.Close()
		head := make([]byte, 512)
		n, _ := io.ReadFull(file, head)
		// Trust the BYTES, not the client's Content-Type header or file name.
		sniffed := http.DetectContentType(head[:n])
		if sniffed != "image/png" && sniffed != "image/jpeg" {
			http.Error(w, fmt.Sprintf("refused: claimed %q, content is %q", hdr.Header.Get("Content-Type"), sniffed), http.StatusUnsupportedMediaType)
			return
		}
		// Never use the client's file name on disk: pick our own.
		id := make([]byte, 8)
		rand.Read(id)
		name := hex.EncodeToString(id) + map[string]string{"image/png": ".png", "image/jpeg": ".jpg"}[sniffed]
		out, err := store.Create(name)
		if err != nil {
			http.Error(w, "store failed", http.StatusInternalServerError)
			return
		}
		defer out.Close()
		out.Write(head[:n])
		if _, err := io.Copy(out, file); err != nil {
			http.Error(w, "too large", http.StatusRequestEntityTooLarge)
			return
		}
		fmt.Fprintf(w, "stored as %s (client said %q)", name, hdr.Filename)
	}
}

func upload(url, filename, contentType string, body []byte) string {
	var buf bytes.Buffer
	mw := multipart.NewWriter(&buf)
	h := make(map[string][]string)
	h["Content-Disposition"] = []string{fmt.Sprintf(`form-data; name="file"; filename=%q`, filename)}
	h["Content-Type"] = []string{contentType}
	part, _ := mw.CreatePart(h)
	part.Write(body)
	mw.Close()
	resp, err := http.Post(url, mw.FormDataContentType(), &buf)
	if err != nil {
		return err.Error()
	}
	defer resp.Body.Close()
	b, _ := io.ReadAll(resp.Body)
	return fmt.Sprintf("%d %s", resp.StatusCode, strings.TrimSpace(string(b)))
}

func main() {
	sandbox, _ := os.MkdirTemp("", "upload-lab") // everything happens in here
	defer os.RemoveAll(sandbox)
	os.Chdir(sandbox) // so the paths below are short and relative
	data := maliciousZip()
	zr, _ := zip.NewReader(bytes.NewReader(data), int64(len(data)))

	fmt.Println("1. extracting a malicious archive into naive/x/")
	naive := filepath.Join("naive", "x")
	os.MkdirAll(naive, 0o755)
	extractNaive(zr, naive)
	fmt.Println("2. the same archive with os.Root")
	safe := "safe"
	os.MkdirAll(safe, 0o755)
	extractSafe(zr, safe)

	fmt.Println("3. uploads")
	os.MkdirAll("uploads", 0o755)
	store, _ := os.OpenRoot("uploads")
	defer store.Close()
	srv := httptest.NewServer(uploadHandler(store))
	defer srv.Close()
	png := append([]byte("\x89PNG\r\n\x1a\n"), make([]byte, 100)...)
	fmt.Println("   real PNG                     ->", upload(srv.URL, "cat.png", "image/png", png))
	fmt.Println("   HTML pretending to be a PNG  ->", upload(srv.URL, "cat.png", "image/png", []byte("<html><script>alert(1)</script>")))
	fmt.Println("   path in the file name        ->", upload(srv.URL, "../../etc/cron.d/x", "image/png", png))
	fmt.Println("   5 MB body                    ->", upload(srv.URL, "big.png", "image/png", append(png, make([]byte, 5<<20)...)))
}

$ go run ./safeupload
1. extracting a malicious archive into naive/x/
   naive: wrote naive/x/report.txt
   naive: wrote naive/escaped.txt
   naive: wrote naive/escaped2.txt
2. the same archive with os.Root
   safe:  wrote safe/report.txt
   safe:  refused "../escaped.txt"       (openat ../escaped.txt: path escapes from parent)
   safe:  refused "a/../../escaped2.txt" (openat a/../../escaped2.txt: no such file or directory)
3. uploads
   real PNG                     -> 200 stored as 4b2912fe70d50985.png (client said "cat.png")
   HTML pretending to be a PNG  -> 415 refused: claimed "image/png", content is "text/html; charset=utf-8"
   path in the file name        -> 200 stored as dcfcf6f61433c71a.png (client said "x")
   5 MB body                    -> 413 bad upload: http: request body too large

What to notice:

• The naive extractor wrote outside its directory twice. filepath.Join cleans ../ rather than rejecting it, which is exactly the zip-slip bug.
• os.Root refused both escapes with no validation code at all.
• The client's Content-Type was a lie, and the bytes weren't. http.DetectContentType found HTML, which would be stored XSS if served back from your domain.
• Go's multipart parser already reduced ../../etc/cron.d/x to x (it applies filepath.Base to file names). The handler doesn't rely on that and picks its own random name anyway. Defence in depth means not depending on a library's courtesy.
• MaxBytesReader enforced the limit while reading, so the 5 MB body was never buffered.

Exercises:

1. Add a symlink entry to the archive (zip stores the mode) pointing to /etc and confirm os.Root refuses to follow it.
2. Serve stored uploads from a separate domain with Content-Disposition: attachment and X-Content-Type-Options: nosniff.
3. Add decompression-bomb protection for images: check dimensions with image.DecodeConfig before decoding the pixels.