I have a project briefly described as follows:
- There is a server which allows clients to upload 7z-compressed files which are expected to contain only XML files. The uploading is via FTP (server-side using FileZilla Server). I have did some basic restriction like enforce firewall rules that only IP's in the white list can do file transfer.
- On scheduled time, the server-side batch script will decompress the 7z files and then some PHP programs will process the XML files.
It works fine so far. But I guess it is lack of security considerations. Is it possible that the PHP program opens some fake XML file which might result in some bad consequence? Or is it possible the 7z files are camouflages of virus or something dangerous, and the decompressing just trigger their malicious behavior? I would like to ask for opionions about how I can validate the files before using them?
Thank you!