Forum Discussion

ynt's avatar
ynt
Regular Visitor
7 years ago

Prevent end-user from uploading malicious file types

We recently performed penetration testing and found several vulnerabilities including the issue with unrestricted file upload that pose significant risk.

 

Is there a configuration in Power BI Report Server to use a whitelist method to prevent end-user from uploading malicious file type like .exe, .py, etc.?

 

Thanks.

 

6 Replies

  • Jon-Heide's avatar
    Jon-Heide
    Microsoft Employee
    7 years ago

    Yes, this is whitelisted under the TrustedFileFormat property, editable through SQL Management Studio when you connect to the PBIRS instance.  

    • Jon-Heide's avatar
      Jon-Heide
      Microsoft Employee
      7 years ago

      You can also use server permissions to disallow users from uploading content in general. 

      • ynt's avatar
        ynt
        Regular Visitor
        7 years ago

        Jon-Heide 

        Jon-Heide wrote:

        You can also use server permissions to disallow users from uploading content in general. 


        Can you please point me to this particular setting?

    • ynt's avatar
      ynt
      Regular Visitor
      7 years ago
      Jon-Heide wrote:

      Yes, this is whitelisted under the TrustedFileFormat property, editable through SQL Management Studio when you connect to the PBIRS instance.  


      This setting does not prevent user from downloading/uploading malicious file types

       

      https://docs.microsoft.com/en-us/sql/reporting-services/tools/server-properties-advanced-page-reporting-services?view=sql-server-2017

       

      TrustedFileFormat Set all the external file formats that open within the browser under the Reporting Services portal site. External file formats not listed prompts to download the option in the browser. The default values are jpg, jpeg, jpe, wav, bmp, pdf, img, gif, json, mp4, web, png.