Developer forum

Hi Peter

We had that in the old days and it was nothing but trouble. It is not a feature for DW currently.

Anyways - you can limit whatever you want related to files using web.config - no reason to do custom services etc. There is no harm in uploading exe files - you just have to make sure they cannot execute - that is Windows and IIS permissions.

BR Nicolai

Hi Nicolai,

For .exe files it is no problem, issue with their problems with .svg files is that we use these ourselves for instance as logo. So we cannot totally block svg's, but for compliance with the pentest we need to prevent them from being uploaded. 

To be honest I do not think it would be easy to make a standard solution for this specific case. 

Greets Hans

Then change the logo to another format or make it inline as SVG: https://css-tricks.com/inline-svg-cached/

Svg is just a text file, it makes no harm. It makes no sense to allow them to be served from the webserver but not allow to upload... Pentest people or not.

You can also make a notification subscriber that will do something if someone uploads svg files.

If you do not allow svg - remember to not allow css, html, cshtml, js. They can be used for the same 'bad' things as svg.

Thank you for your extensive and clear explanation on this subject

Hi Nicolai,

Thanks for the example. With a bit of refactoring we tested it in our solution, and it prevented the uploads as required! Only point of improvement would be that the exception we throw is shown as an "Unhandled error" in stead of the "not allowed" message.

Our refactored code for people who would like to implement this is as follows:

using System;
using System.Collections.Generic;
using System.IO;
using System.Linq;
using System.Web;
 
namespace Application.CustomCode.Observers
{
    [Dynamicweb.Extensibility.Notifications.Subscribe(Dynamicweb.Notifications.Standard.Application.BeforeBeginRequest)]
    public class ApplicationBeginRequestObserver : Dynamicweb.Extensibility.Notifications.NotificationSubscriber
    {
        private readonly List<string> notAllowedExtensions = new List<string> { ".svg", ".js", ".exe" };
        public override void OnNotify(string notification, Dynamicweb.Extensibility.Notifications.NotificationArgs args)
        {
            if (args == null)
                return;
 
            if (!(args is Dynamicweb.Notifications.Standard.Application.BeforeBeginRequestArgs item))
                return;
 
            var app = (HttpApplication)item.EventSender;
 
            if (app.Context.Request.Cookies == null || app.Context.Request.Cookies.Count == 0)
                return;
 
            if (app.Context.Request.HttpMethod.Equals("POST", StringComparison.InvariantCultureIgnoreCase) && app.Context.Request?.Files?.Count > 0)
            {
 
                var illegalExtensionFileNames = app.Context.Request.Files.AllKeys.Select(key => app.Context.Request.Files[key].FileName).
                                                Where(filename => notAllowedExtensions.Contains(Path.GetExtension(filename), StringComparer.InvariantCultureIgnoreCase));
                if (illegalExtensionFileNames.Any())
                {
                    throw new Exception($"upload of the file(s) {string.Join(", ", illegalExtensionFileNames)} is not allowed");
                }
            }
        }
 
        public override bool Equals(object obj)
        {
            if (ReferenceEquals(this, obj))
            {
                return true;
            }
 
            if (obj is null)
            {
                return false;
            }
 
            return false;
        }
 
        public override int GetHashCode()
        {
            return base.GetHashCode();
        }
 
        public static bool operator ==(ApplicationBeginRequestObserver left, ApplicationBeginRequestObserver right)
        {
            if (left is null)
            {
                return right is null;
            }
 
            return left.Equals(right);
        }
 
        public static bool operator !=(ApplicationBeginRequestObserver left, ApplicationBeginRequestObserver right)
        {
            return !(left == right);
        }
 
        public static bool operator <(ApplicationBeginRequestObserver left, ApplicationBeginRequestObserver right)
        {
            return left is null ? right is object : left.CompareTo(right) < 0;
        }
 
        public static bool operator <=(ApplicationBeginRequestObserver left, ApplicationBeginRequestObserver right)
        {
            return left is null || left.CompareTo(right) <= 0;
        }
 
        public static bool operator >(ApplicationBeginRequestObserver left, ApplicationBeginRequestObserver right)
        {
            return left is object && left.CompareTo(right) > 0;
        }
 
        public static bool operator >=(ApplicationBeginRequestObserver left, ApplicationBeginRequestObserver right)
        {
            return left is null ? right is null : left.CompareTo(right) >= 0;
        }
    }
}