Archive for the ‘Programming’ category

Sometimes a business has a reason to offer a quick file uploader tool on their website to collect files from its clients and prospects. Maybe a Word document has to be e-mailed to you before you can return an estimate for custom work. Or maybe you expect your clients to upload a spreadsheet or image file to go with their project. It’s a nice idea to offer the file upload feature right on your website and save the visitor the step of leaving the site to email you an attachment.

Here is some of the advice we give our clients when they are offering this feature on their website:

File upload limit

Larger files are going to cause more issues for you and your visitors; there’s a greater chance of the upload getting interrupted mid-way or otherwise failing, not to mention the load on the server. If you do not have an idea in mind for reasonable file sizes, set the upload limit at 20MB for starters and see what happens.

Virus prevention

Since you don’t know who uploaded the file, be safe and follow the usual advice:  run a virus scan before opening any of the files sent to you and frequently scan your computer for viruses and malware.

File extensions can be fake

While we can lock down what types of files can be uploaded, it does not actually offer protection from malicious files. Just because a file appears to end in “.doc” or “.xls” does not mean it’s safe. The extension has no bearing on what the file really is. Case in point, I often circumvent virus checkers by renaming an innocent zip file to “.jpg” when I send it somewhere so McAfee doesn’t have a hissy-fit and refuse to pass it through. And for goodness sake, *never* run one of these files. You should not be expecting executable programs.

Extreme measures (for the paranoid only)

If you are paranoid, you probably would open the file in some sandboxed computer–there are many links on the web to methods of doing it. I’d probably set up a virtual machine with the operating system and document programs on it so if that system got infected, you could blow it away easily. But the setting up of this and training is costly and time consuming. Googling for “virtual machines” would be a starting point.

When Synotac programs a file uploader, we make sure the web server is not in danger. The document won’t ever be opened on the server–it is just bits as far as the server is concerned and to the chagrin of hackers everywhere, “just bits” don’t infect anything. The safety of your own computer is dependent on the use of the good safety habits above.