There's an asp.internet application that enables customers to upload files, the files are stored on temporary disk location and then mounted on an archive and held in DB.

My question relates to security and/or virus issues. What are the security holes within this approach? Can the herpes virus do harm if it's never performed (file is saved, then opened up using filestream, transformed into byte array and saved to DB.

Later, once the file is required we stream the file to user.

The files are stored on a folder on the internet server such as this:

context.Request.Files[0].SaveAs(); (location is really a folder under application_data/files)

later once the same user produces an archive we grab the file from disk and store it in db such as this:

FileStream fileStream = File.OpenRead(currentFilePath);
byte[] ba = new byte[fileStream.Length];
int len = fileStream.Read(ba, 0, ba.Length);
//ba saved to DB here as varbinary(max)

We limit the files that may be submitted for this list:

List<string> supportedExtensions = new List<string>(10) {".txt", ".xls", ".xlsx", ".doc", ".docx", ".eps", ".jpg", ".jpeg", ".gif", ".png", ".bmp", ".rar", ".zip", ".rtf", ".csv", ".psd", ".pdf" };

The file is streamed to user's internet browser such as this:

//emA = entity object loaded from DB
context.Response.AppendHeader("Content-Disposition", "inline; filename=\"" + emA.FileName + "\"");

context.Response.AddHeader("Content-Type", emA.ContentType);
context.Response.BinaryWrite(emA.FileContent);

Almost always there is a burglar risk when accepting files from unknown customers. Anybody may potentially write the herpes virus in VBA (Visual Fundamental for Programs) at work documents.

Your approach isn't any pretty much of the security risk than saving them on the file system or directly within the database aside from one concern...

When the files are stored on the disk, they may be scanned by traditional virus scanning devices. So far as I understand most virus scanning devices don't scan files which are saved inside a DB like a byte array.

Whether it were my server, I'd be storing them around the file system for performance reasons, not security reasons, and you will wager I'd ask them to scanned with a virus scanner basically were permitting potentially harmful files, for example office documents, executables, etc.

Have your customers create logins before permitting these to upload files. Unchecked access of the kind is uncommon... not to imply that this can be a solution by itself, but like several good home security systems it may form an additional layer :-)

I can not see there being any longer security risk than saving the files to disk. The potential risks listed here are frequently not related to in which you keep data since as is available already stated the saved file does not get executred.

The danger is generally in the way the information is transfered. Earthworms will exploit conditions which permit that which was just data coming with the system to become treat as though it were code and begin being performed. Such exploits don't require that sense at all of "file" being transfered show up, previously a specifically formatted URL could suffice.

Nevertheless, I have never understood the need to keep large binary data inside a SQL database. Why don't you just save the files on disk and keep file path within the DB. After that you can use features for example WriteFile or URL re-conntacting get IIS do what its proficient at.