Prevent end-user from uploading malicious file types

[ynt]

We recently performed penetration testing and found several vulnerabilities including the issue with unrestricted file upload that pose significant risk.

Is there a configuration in Power BI Report Server to use a whitelist method to prevent end-user from uploading malicious file type like .exe, .py, etc.?

Thanks.

[Jon-Heide]

Yes, this is whitelisted under the TrustedFileFormat property, editable through SQL Management Studio when you connect to the PBIRS instance.  

[ynt]

@Jon-Heide wrote:

Yes, this is whitelisted under the TrustedFileFormat property, editable through SQL Management Studio when you connect to the PBIRS instance.  

---

This setting does not prevent user from downloading/uploading malicious file types

https://docs.microsoft.com/en-us/sql/reporting-services/tools/server-properties-advanced-page-report...

TrustedFileFormat Set all the external file formats that open within the browser under the Reporting Services portal site. External file formats not listed prompts to download the option in the browser. The default values are jpg, jpeg, jpe, wav, bmp, pdf, img, gif, json, mp4, web, png.

[Jon-Heide]

You can also use server permissions to disallow users from uploading content in general. 

[ynt]

@Jon-Heide 

---

@Jon-Heide wrote:

You can also use server permissions to disallow users from uploading content in general. 

---

Can you please point me to this particular setting?

[Jon-Heide]

https://docs.microsoft.com/en-us/sql/reporting-services/security/granting-permissions-on-a-native-mo...

[ynt]

---

@Jon-Heide wrote:

https://docs.microsoft.com/en-us/sql/reporting-services/security/granting-permissions-on-a-native-mo...

---

For our use case, we can't disable the upload feature. We need to be able to whitelist certain file types that can be uploaded to PBI Report Server.