Forum Discussion

Regular Visitor

7 years ago

Prevent end-user from uploading malicious file types

We recently performed penetration testing and found several vulnerabilities including the issue with unrestricted file upload that pose significant risk. Is there a configuration in Power BI Repo...

Microsoft Employee

7 years ago

Yes, this is whitelisted under the TrustedFileFormat property, editable through SQL Management Studio when you connect to the PBIRS instance.

Jon-Heide
Microsoft Employee
7 years ago
You can also use server permissions to disallow users from uploading content in general.
- ynt
  Regular Visitor
  7 years ago
  Jon-Heide
  Jon-Heide wrote:
  You can also use server permissions to disallow users from uploading content in general.
  
  Can you please point me to this particular setting?
  - Jon-Heide
    Microsoft Employee
    7 years ago
    https://docs.microsoft.com/en-us/sql/reporting-services/security/granting-permissions-on-a-native-mode-report-server?view=sql-server-2017
ynt
Regular Visitor
7 years ago
Jon-Heide wrote:
Yes, this is whitelisted under the TrustedFileFormat property, editable through SQL Management Studio when you connect to the PBIRS instance.

This setting does not prevent user from downloading/uploading malicious file types

https://docs.microsoft.com/en-us/sql/reporting-services/tools/server-properties-advanced-page-reporting-services?view=sql-server-2017

TrustedFileFormat Set all the external file formats that open within the browser under the Reporting Services portal site. External file formats not listed prompts to download the option in the browser. The default values are jpg, jpeg, jpe, wav, bmp, pdf, img, gif, json, mp4, web, png.