5

I posted a question on Code Review (link below) on whether a webpage that takes a client's file and then displays (mirrors) it back to them (only stored as a temporary file, and only returned to the person who submitted in the first place) has software vulnerabilities.

https://codereview.stackexchange.com/questions/290792/is-showing-an-html-file-that-the-client-uploads-safe

I am wondering the same thing about legal liability. For instance, if someone submits child porn, could I be found liable even though this content only ever exists in a temporary file on my server? I think there are laws related to social media that would indemnify me... Am I correct on this? Do I need a disclaimer or something else to protect myself legally?

-- Update --

I've realized that this was actually a bad question: Because the backend assumes that HTML is the file type of the submitted file, binary files (like image files) will come back as gibberish. The temporary file associated with the upload either doesn't have a file extension, or it's ".tmp", so it's not useful without the content type (this information is available in a separate field which I am ignoring). There is a loophole (which I'm not going to mention for security's sake), but it would take effort to exploit - much more effort than it would be worth.

Still, thank you everyone! The answers and commentary you provided I think could still be useful for others.

6
  • 3
    I imagine this has already been defined and would be covered by the same protection that cloud storage solutions have but I'm already on enough lists so I'm not going to try and google it.
    – jesse_b
    Feb 29 at 19:21
  • 2
    From a technical standpoint, you could see if you can do all the processing in the browser, which would also lower your cloud infra costs ... Mar 1 at 1:33
  • 2
    I don't think the lack of extension makes any difference. First because it's trivial to recover it, and second that CSAM scans are usually by content hash, which is independent of path, name or extension. But you could reject uploading of non-HTML files (e.g., containing null bytes) to further reduce risk.
    – BoppreH
    Mar 1 at 12:55
  • @BoppreH Re: I don't think the lack of extension makes any difference. With respect, I think it does. I've made it clear on the webpage that the file data that is submitted is going to be interpreted as HTML when posted back to the client, and that if they post a binary file, they are going to see gibberish. For someone with CSAM to then go ahead and post this, get back gibberish and then to claim that I have a temporary file that contains CSAM - or for anyone else to say that I need to analyze / try to recover CSAM in all uploads - is this a legal requirement? I don't think so. Mar 1 at 15:01
  • 1
    @ControlAltDel Some browsers will actually auto-detect content not based on the given Content-Type or any extension but on the actual file format (magic numbers etc.). I would not trust a browser not to show an image even if you set the Content-Type to text/html.
    – jcaron
    Mar 1 at 17:19

1 Answer 1

11

You might have to look at this from a global viewpoint, and some legal systems are less attuned to the realities on cloud computing than others.

  • Holding content in a temporary file on your rented cloud instance, or even in memory, may be legally "having" it under "your" control. Not knowing that it is illicit content may or may not protect you.
  • You may not be considered a telecommunications provider or a social media platform if only the original poster gets to see it. That's the opposite of social media.
  • Disclaimers may not shield you. A contract with your user may or may not shield you.
8
  • In that case it seems like the company that actually owns the cloud server would also potentially be liable.
    – jesse_b
    Feb 29 at 19:15
  • @jesse_b, the cloud service company would probably have a well-written contract (from their view) with the operator of the website.
    – o.m.
    Feb 29 at 20:08
  • 1
    Yeah but with so many different jurisdictions at play and as you say the contract may or may not shield them. Seems like those companies must be pretty confident they are protected though. For example anyone can upload any images to google to do a reverse image search without signing any contract or even agreeing to any TOS. They wouldn't allow that unless they knew they were not liable for anything uploaded...I would hope.
    – jesse_b
    Feb 29 at 20:37
  • 1
    @ControlAltDel well I love using the dad joke "People are usually shocked when they find out I'm not an electrician." I don't know a clever one for this situation but I will say people are usually convicted when they find out I'm not an attorney.
    – jesse_b
    Feb 29 at 21:59
  • 1
    @jesse_b: Large hosting providers are comfortable offering that service because they comply with nation-specific requirements (such as scanning for known-bad hashes, forwarding suspect images to NCMEC or the local equivalent, etc.). They absolutely do not just put a couple of words down in a contract that nobody reads and call it a day. In general, criminal liability may not be contractually reassigned.
    – Kevin
    Mar 1 at 7:58

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .