Sign inJoin
1
5 Comments

Are you guys scans(AV) files users upload to your SaaS?

by Scale-Up SaaS

Hey Guys,

Part of developing a secure and successful SaaS is to make sure as much as possible to secure your SaaS end-to-end.

Now my question is:

Are your securing your SaaS from malicious files upload? If Yes... How?

Scale-Up SaaS's avatarScale-Up SaaS
on March 11, 2023
Say something nice to ScaleUpSaaS…
Post Comment
  1. 1

    Hi there,

    Depending on what you want your users to upload, you can:

    • Restrict the file type (not by extension but by meta data)
    • Check the file size
    • Restrict the upload destination to something other than your critical infra, use a CDN or a dedicated server or a third party system.
    • Don't ever execute a file without checking it for basic exploits

    Some good advice from SANS: https://www.sans.org/blog/8-basic-rules-to-implement-secure-file-uploads/
    Also nice to read for a more comprehensive check: https://blog.filestack.com/thoughts-and-knowledge/secure-file-upload/

    Hope that helps.

    mattheld's avatar mattheld
    ·
    4 years ago
    ·
    Reply
    1. 1

      Thanks for sharing. It's very informative.

      Are you using any file scan software?

      Scale-Up SaaS's avatar Scale-Up SaaS
      ·
      4 years ago
      ·
      Reply
      1. 1

        I use https://www.attachmentscanner.com/ for many projects.

        mattheld's avatar mattheld
        ·
        4 years ago
        ·
        Reply
        1. 1

          Thanks for sharing
          How you implement their solutions? via Aws lambda or via Api rest request?

          Scale-Up SaaS's avatar Scale-Up SaaS
          ·
          4 years ago
          ·
          Reply
          1. 1

            Depends on the application, but usually Rest API as Middleware.

            mattheld's avatar mattheld
            ·
            4 years ago
            ·
            Reply