File upload security in Cybersecurity - Interactive Code Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the code to check the file extension before upload.

Cybersecurity

if filename.endswith([1]):
    print("File accepted")

Drag options to blanks, or click blank then click option'

A".jpg"

B".bat"

C".exe"

D".dll"

Attempts:

3 left

💡 Hint

Common Mistakes

Choosing executable extensions like .exe or .bat which are unsafe.

Only files with the .jpg extension are accepted here to reduce risk.

2fill in blank

medium

Complete the code to limit the maximum file size to 5MB.

Cybersecurity

if file_size [1] 5 * 1024 * 1024:
    print("File size is acceptable")

Drag options to blanks, or click blank then click option'

A>

B==

C<=

D>=

Attempts:

3 left

💡 Hint

Common Mistakes

Using > or >= which would accept files larger than 5MB.

The file size should be less than or equal to 5MB to be accepted.

3fill in blank

hard

Fix the error in the code that checks for allowed MIME types.

Cybersecurity

allowed_types = ['image/png', 'image/jpeg']
if file_mime_type [1] allowed_types:
    print("MIME type allowed")

Drag options to blanks, or click blank then click option'

A==

Bnot in

C!=

Din

Attempts:

3 left

💡 Hint

Common Mistakes

Using == which compares to the whole list, not membership.

The in operator checks if the MIME type is in the allowed list.

4fill in blank

hard

Fill both blanks to safely save the uploaded file with a unique name.

Cybersecurity

import uuid
unique_name = str(uuid.[1]()) + [2] + file_extension
save_file(unique_name)

Drag options to blanks, or click blank then click option'

Auuid4

B"_"

C"."

Duuid1

Attempts:

3 left

💡 Hint

Common Mistakes

Using uuid1 which is time-based and less random.

Joining with underscore instead of dot.

Using uuid4() generates a random unique ID, and "." joins the name and extension safely.

5fill in blank

hard

Fill all three blanks to create a dictionary comprehension filtering safe files by size and extension.

Cybersecurity

safe_files = {file: size for file, size in files.items() if file.endswith([1]) and size [2] [3]

Drag options to blanks, or click blank then click option'

A".png"

B<=

C5 * 1024 * 1024

D".exe"

Attempts:

3 left

💡 Hint

Common Mistakes

Using unsafe extensions like .exe.

Using > instead of <= for size.

This comprehension keeps files ending with .png and size less than or equal to 5MB.

Practice

1. What is the main purpose of file upload security in web applications?

easy

A. To increase the file size limit

B. To speed up the file upload process

C. To allow all file types without restrictions

D. To prevent harmful files from being uploaded and executed

Solution

1. Step 1: Understand the risks of file uploads

   Uploading files can introduce harmful content like viruses or scripts that can damage the system.

2. Step 2: Identify the goal of file upload security

   The goal is to stop harmful files from entering and running on the server or user devices.

3. Final Answer:

   To prevent harmful files from being uploaded and executed -> Option D

4. Quick Check:

   File upload security = prevent harmful files [OK]

Hint: File upload security stops dangerous files from entering [OK]

Common Mistakes:

• Thinking file upload security speeds up uploads
• Believing all file types should be allowed
• Confusing file size limits with security

2. Which of the following is a correct practice for validating uploaded files on the server?

easy

A. Check the file's MIME type and scan for malware

B. Only check the file size, ignoring content type

C. Accept all files and scan them later

D. Allow files based only on their file extension

Solution

1. Step 1: Understand file validation methods

   File extension alone can be faked; MIME type and malware scanning provide stronger checks.

2. Step 2: Identify the best validation practice

   Checking MIME type ensures the file is of expected type; scanning detects harmful content.

3. Final Answer:

   Check the file's MIME type and scan for malware -> Option A

4. Quick Check:

   Validate MIME type + scan malware = secure upload [OK]

Hint: Validate MIME type and scan files for safety [OK]

Common Mistakes:

• Relying only on file extensions
• Ignoring malware scanning
• Accepting all files without checks

3. Consider this code snippet for handling file uploads:

if uploaded_file.content_type == 'image/png' and uploaded_file.size <= 1048576:
    save_file(uploaded_file)
else:
    reject_upload()

What will happen if a user uploads a 2MB PNG file?

medium

A. The file will be rejected due to size limit

B. The file will be saved successfully

C. The file will be rejected due to wrong type

D. The code will cause a runtime error

Solution

1. Step 1: Check the file type condition

   The file is PNG, so content_type == 'image/png' is true.

2. Step 2: Check the file size condition

   The file size is 2MB (2,097,152 bytes), which is greater than 1MB (1,048,576 bytes), so size condition fails.

3. Final Answer:

   The file will be rejected due to size limit -> Option A

4. Quick Check:

   File size > limit = reject upload [OK]

Hint: Check both type and size conditions carefully [OK]

Common Mistakes:

• Ignoring the size check and assuming success
• Confusing file size units
• Assuming code errors without cause

4. A developer wrote this code to validate uploaded files:

if uploaded_file.extension == '.jpg' or '.png':
    process_file(uploaded_file)
else:
    reject_file()

What is the main problem with this code?

medium

A. It only accepts .jpg files

B. It rejects all files incorrectly

C. The condition always evaluates to true, accepting all files

D. It causes a syntax error

Solution

1. Step 1: Analyze the condition logic

   The expression 'uploaded_file.extension == '.jpg' or '.png'' always evaluates '.png' as true because non-empty strings are truthy.

2. Step 2: Understand the effect on file acceptance

   Since the condition is always true, all files pass and get processed regardless of extension.

3. Final Answer:

   The condition always evaluates to true, accepting all files -> Option C

4. Quick Check:

   Incorrect or/or logic = always true condition [OK]

Hint: Use explicit comparisons for each extension [OK]

Common Mistakes:

• Assuming it only accepts .jpg or .png
• Thinking it causes syntax error
• Not understanding boolean logic in conditions

5. You want to securely allow users to upload profile pictures but avoid risks. Which combination of these steps is best practice? A) Check file extension only B) Validate MIME type and scan for malware C) Limit file size to 2MB D) Rename files to safe names before saving Choose the best combination.

hard

A. B and D only

B. B, C, and D

C. A and C only

D. A, B, C, and D

Solution

1. Step 1: Evaluate each step's security impact

   Checking extension alone is weak; validating MIME and scanning malware are strong protections. Limiting size prevents large uploads. Renaming files avoids overwriting and path issues.

2. Step 2: Identify the best combination

   Combining MIME validation, malware scan, size limit, and renaming covers multiple security aspects effectively.

3. Final Answer:

   B, C, and D -> Option B

4. Quick Check:

   Multiple layered checks = best security [OK]

Hint: Combine validation, size limit, and renaming for safety [OK]

Common Mistakes:

• Relying only on file extension
• Ignoring file size limits
• Not renaming files before saving