Validate MIME Type for Multi-Extension Filenames, Polyglot Files, and Null-Byte Injection
Use a system property to prevent attachments from bypassing MIME-type restrictions.
Use the glide.attachment.enable_secure_filename_validation system property to enable strict validation of attachment file names. This change to prevents attachments from bypassing MIME-type restrictions. When set to true, the platform performs full file name sanitization and rejects unsafe patterns that could otherwise be used to upload malicious files.
Add a record to the System Properties [sys_properties] table with the name glide.attachment.enable_secure_filename_validation and a value of true.
More information
| Attribute | Description |
|---|---|
| Configuration name | glide.attachment.enable_secure_filename_validation |
| Configuration type | System Properties \(/sys\_properties\_list.do\) |
| Data type | Boolean |
| Recommended value | true |
| Default value | false |
| Fallback value | false |
| Category | Validation, sanitization, and encoding |
| Security risk |
MIME type validation for file attachments doesn't take place in multi-extension processing or when null bytes are present. This allows attackers to circumvent the glide.attachment.extensions and glide.security.file.mime_type.validation system properties through null-byte injection, multi-extension file names and polyglot files, leading to malicious file uploads. |
| Functional impact | When the glide.attachment.enable_secure_filename_validation property is set to true:
Functionality that does not rely on unsafe file name patterns continue to work normally. |
| Dependencies and prerequisites | None |
Parent Topic:Validation, sanitization, and encoding