File Upload Test

This test demonstrates how to allow a client to select and upload a file to an application server.   File uploading can be dangerous, since a nefarious client may try to exploit the multipart/form-data to infect an application with virus code.   The PSP/servlet implementation can block against some of these attacks; however, the application must be designed to prevent other attempts.   For example, applications must not save client files anywhere that is directly visible to the webserver; otherwise, a client may attempt to upload a file containing virus code in order to have the webserver execute the virus in a subsequent request.  

Another potential hack is less obvious, but it's severity can not be understated.   The HTTP multipart/form-data protocols include a convention that allows the client (typically a browser) to include the filename of the source of the data that is being sent to the application server.   This feature can be very helpful, since it permits clients and the application the opportunity for the client and application to use a recognizable name to reference client data within the application.   While a browser will likely strip all directory references from this client filename, a nefarious client may execute malicious code to create multipart form-data with filenames that attempt to overwrite system/application files within the application server.   Applications that attempt to use the client supplied suggested filename must always check to ensure that client supplied filenames do not contain a hostile directory specification.

The code below is overly simplific, applications will likely want to include a bit more logic for added security and organization.

Select a file to upload