Security configuration of attachments

Security configuration of attachments,

File Upload Limits for Attachments:

--> Set Profile: Upload File Size Limit (UPLOAD_FILE_SIZE_LIMIT)
  • Limits the maximum Attachment file size that can be uploaded
  • Specified in KB (e.g. 2000KB)
--> Allowing unlimited attachment sizes can allow for a Denial of Service attack (DOS)

Attachments file type extension validation:

--> Set Profile: Attachment File Upload Restriction Default
  • Yes (default): Black list behavior – Disallow types marked as ‘N’
  • No (recommended): White list behavior – Only allow types marked as ‘Y’
--> Validate attachments file type extensions
  • New column - FND_MIME_TYPES. ALLOW_FILE_UPLOAD – values N & Y
This was Delivered as part of January 2012 CPU

Tag scanning of HTML Attachments:

--> Set Profile: FND: Disable Antisamy Filter
  • False (default / recommended) – sanitize HTML pages
--> OWASP Antisamy – allows a specific (white list) of HTML elements and attributes
  • Error Message if uploaded HTML file was modified


No comments:

Post a Comment