Level 50
Whats the purpose of those zip files in the first place? You might not actually need them.
Jan 13, 2021
11
Level 9
Allowing .zip Files to be Uploaded
I have .zip files blacklisted among other file types on a website uploader because they may contain malicious files or a .zip bomb. Is there a safe way to allow .zip files to be uploaded, or is it safe and I am just thinking its not?
Level 9
Files to print. The website I created automatically zips all of the whitelisted files and sends them to a Google Cloud Bucket. The thing is, in the large format print industry people are used to handing over files in that are zipped already. Indesign files in particular are usually sent with linked files that folks zip.
Level 50
Ok this might be a bit over the top, but why don't you let Google worry about your uploads and utilise their own mechanism for file uploads directly to Google Cloud? Have a look here:
https://cloud.google.com/storage/docs/uploading-objects#storage-upload-object-php
Let them worry about it ;-)
Level 9
I sort of have this, it uploads whitelisted files into a temporary folder. After 5 min it zips files the files they uploaded, after another 5 minutes it sends that zipped folder to the cloud bucket and notifies production a folder is ready, a week later it cleans them from the temp folder.
Maybe I am worried about nothing, just a lot of things say be very careful allowing people to upload certain file types.
Level 50
@tovisbratsburg You said they want to upload zip files but here you say that you actually zip them:
After 5 min it zips files the files they uploaded
If that is the case then the whole question does not make sense. Just do not allow them to upload zip files and that is it. No headache for you.
Level 9
For the user, zipping the files for upload reduces file size for transfer and is generally done when FTPing or Emailing indesign to keep them together.
I am going to explore clamAV.
Level 5
I am confused I have .zip files blacklisted among other file types You blacklisted Zip files. Why don't you whitelist it again if you want it?
And do validation on the other type files. You can even set a max size limit on the zip files.
Level 9
"They may contain malicious files or a .zip bomb." I'd like the ability to scan them or figure out a way to make sure they are not a threat.
Level 73
You can always run a virus check on them
Level 9
Awesome, I'll check this out! It might be the perfect solution.
Level 9
Looks like this might be an option too:
https://laravel-news.com/clamav-anti-virus-validator-for-laravel
Please or to participate in this conversation.