Malicious code is code an attacker gets a system to run for harmful or unauthorized ends. In web applications, the practical danger is often injection: an attacker supplies input that a vulnerable server treats as executable code, commands, or instructions. The result can range from disruption to bypassed authentication, stolen data, or ransomware installed on the server. section 12.0
Ransomware illustrates the stakes. It is malicious software that encrypts a victim’s files and withholds access until a cryptocurrency ransom is paid. Attackers may deploy it after finding a vulnerable server or acquiring access to one, turning a coding flaw into an operational and financial incident. section 12.0 section 1.1
Treat untrusted input as a possible delivery path, and use defenses at the server boundary:
- Validate requests on the server, not only in browser code. Client-side checks can improve feedback, but attackers can send requests with scripts or bots instead of using the intended form. section 4.7
- Recognize that injection can target more than application code: web-server behavior, data stores, operating-system commands, line feeds, and regular expressions can all become attack surfaces. section 12.0
- Handle uploads cautiously. Simple file-header or MIME-type checks are only an initial filter and do not establish that uploaded content is safe. section 4.7
- Consider keeping uploaded files at arm’s length in a third-party content-management or web-storage service when appropriate. section 4.7
A file that claims to be an image
A server can inspect an uploaded file’s detected MIME type before accepting it as an image. This is useful screening, but it is not a complete malicious-content scan; upload handling needs server-side controls beyond trusting a filename, browser claim, or basic header check. section 4.7
import magic
file_type = magic.from_file("upload.png", mime=True)
assert file_type == "image/png"
This Python snippet detects a file’s MIME type and asserts that an upload is an image; use it as one small server-side check, not proof that content is harmless. section 4.7
