title: What security issues appear when users can upload their own files?
body: <p>I was wondering what security issues appear when the end user of a website can upload files to the server. </p>
  
  <p>For instance if my website allows the users to upload a profile picture, and one user uploads something harmful instead, what could happen? What kind of security should I set up to prevent attacks like this? I'm talking here about images, but what about the case where a user can upload anything into a file-vault kind of application?</p>
  
  <p>It's more a general question than a question about a specific situation, so what are the best practices in that situation? What do you usually do?</p>
  
  <p>I suppose: type validation on upload, <a href="https://stackoverflow.com/questions/290483/what-file-permissions-should-i-set-for-uploaded-files">different permissions for uploaded files</a>... what else?</p>
  
  <p><strong>EDIT</strong>: To clear up the context, I am thinking about a web application where a user can upload any kind of file and then display it in the browser. The file would be stored on the server. The users are whoever uses the website, so there is no trust involved.</p>
  
  <p>I am looking for general answers that could apply for different languages/framework and production environments.</p>