Security Risks of File Extensions
The fundamental flaw in modern desktop OS design is trusting the filename to dictate execution context.
The Problem
When you double-click a file, Windows, macOS, and Linux look at the file extension (or associations) to decide which application should handle it. If an attacker can manipulate the perceived extension, they can force the OS to execute a malicious binary instead of opening a harmless document.
Common Attack Vectors
1. Hide Known File Extensions
By default, Windows hides extensions for known file types. An attacker names their file invoice.pdf.exe. Because .exe is known, Windows hides it, and the user sees invoice.pdf. To increase the deception, the executable is compiled with an icon matching Adobe Acrobat.
2. Right-To-Left Override (RTLO)
Unicode includes a special character, U+202E, designed to support languages written right-to-left (like Arabic or Hebrew). Attackers abuse this in filenames.
Consider the filename: invoice_fdp.scr
If an attacker inserts the RTLO character before "fdp", the text rendering engine flips the subsequent characters. The user sees: invoice_rcs.pdf
The OS still sees the underlying `.scr` (screensaver executable) extension and executes the malware.
3. Polyglot Files
A polyglot is a file that is simultaneously valid in multiple formats. For example, a file can be constructed to be a valid ZIP archive AND a valid JPEG image. Depending on which application opens it, different data is parsed. This is often used to bypass upload filters that only check magic numbers for images, allowing malicious archives to be stored on a server.
How to protect yourself
- Always enable "Show hidden file extensions" in your OS folder options.
- Never double-click unknown files. Use a terminal to inspect them (e.g.,
file filename) or a safe viewer like uViewFile. - Look for the RTLO character. Many modern text editors and email clients will flag it or render it as a visible block.
Internal References
Common Mistakes
| Mistake | Consequence | Better Approach |
|---|---|---|
| FileReader.readAsArrayBuffer | Browser Crash (OOM) | Use File.slice for chunks |
| Rendering full DOM | Browser freeze | Virtualized list rendering |
FAQ
What is the max file size?
By using slicing and streams, we can handle files limited only by your OS filesystem (e.g., 2TB on NTFS), not your RAM.