proposal/discussion: validation rules for files inside archive if the application unpack it or has business logic limit for other files

[elarlang]

If an application allows users to upload archive files (such as zip) and then unpack files from zip to the application, then application should validate each file separately inside the archive according to file validation rules.

Or in more general - if an application allows to upload files including archives, then if business logic rules exists for uploaded files, those should also apply to the files inside the archive.

... but an application may just allow users to upload zip files by business logic rules and other users to download them.

So - do we need requirement for that?

[elarlang]

Maybe it is solvable via https://github.com/OWASP/ASVS/issues/1604

[tghosth]

You know what I am going to say.... 🙃

[jmanico]

I totally agree that each file inside a zip needs to also go through a file validation/malware scanning/etc process like any other uploaded individual file.

[jmanico]

So how about this addition

12.1.5	[ADDED] Verify that if an application allows users to upload archive files (e.g., zip files), the application must individually validate each file within the archive according to established file validation rules.	✓	✓	✓	23

[jmanico]

Another option is to modify 12.2.1, suggested by @tghosth

12.2.1	[MODIFIED] Verify that when the application accepts a file, it checks if the file extension matches an expected file extension and validates that the contents correspond to the type represented by the extension. This includes, but is not limited to, checking the initial 'magic bytes', performing image re-writing, and using specialized libraries for file content validation. This validation should apply to uploaded files and also to uploaded contents of an archive file, such as a zip.		✓	✓	434

[tghosth]

12.2.1	[MODIFIED] Verify that when the application accepts a file, either on its own or within an archive such as a zip file, it checks if the file extension matches an expected file extension and validates that the contents correspond to the type represented by the extension. This includes, but is not limited to, checking the initial 'magic bytes', performing image re-writing, and using specialized libraries for file content validation.		✓	✓	434

[jmanico]

Closing this out from PR https://github.com/OWASP/ASVS/pull/2221

[tghosth]

I think this is a good compromise which hits the original goal of the issue without getting too prescriptive or complicated