Study. uk . com
  1. Home
  2. All questions
  3. Question 148

CompTIA Security+ study material · question 148 of 611

Which two controls should be applied to a user file upload feature? Choose two.

  1. Serve uploads from the same directory as application code
  2. Preserve the user's original filename for traceability
  3. Verify the file type by inspecting content rather than trusting the extension
  4. Store the file outside the web root under a generated name
Show the answer

Answer: C. Verify the file type by inspecting content rather than trusting the extension
D. Store the file outside the web root under a generated name

Trusting the extension and letting the user choose the stored path are how uploads become remote code execution.

Source: OWASP Input Validation Cheat Sheet (OWASP) — OWASP Input Validation Cheat Sheet › File Upload Validation

Challenge yourself on this topic → Study as cards