Acceptings Attachtments in on onlime form

[r0k3t]

Hi there,

I was wondering what anyone else thinks of this. We are looking at creating an online form with just creates a simple email and fires it off but we would like to give the user the option of sending an attachment. Does anyone have any thoughts on the risks involved with this from a security standpoint? Is there any special products that .net could use to scan files first? some third party application or control?

I have been having trouble finding much good info from google cause, well... You type the words like "email attachment" "risk" or something like that you get so much back it is out of control.

OK - thanks for any suggestions.

[gep13]

Are you talking about an online registration form, or allowing the user to email any person, along with an attachment?

I am not clear on exactly what you are asking.

At the end of the day, you will have to upload the file onto the server prior to sending the email, once it is there, you can check the file extension, and prevent sending any obviously dodgy file types.

Gary

[r0k3t]

Hi there,

No - the wouldn't be able to email anyone, the email goes to an internal email address. Yeah - I figured we would want to limit the file types however the file types that we are talking about, .zip files, .pdf .doc(x) are pretty doggy to begin with (well they can be as we all know).

Thanks

[gep13]

Exactly.

Who is the user base? The general public? Or people within your organization? Since they are logging in, you can track the files that they are sending, and always block accounts if needs be.

Gary

[r0k3t]

Unfortunately it is the general public.

[gep13]

Ah, and there in lies the problem.

At the end of the day, it really comes down to what is the benefit of this functionality, i.e. is it really needed. It is not going to be a 5 minute job to implement.

Gary