Hi In SharePoint how to stop malicious files (XSS files) upload even for admin users who have full permissions to site collection. For example, in a custom list or document library, no one can upload malicious files who has permissions to this list or library, what are the recommended approaches to prevent this.
Go to Central Admin site - > Security -> Click on the Define Blocked File Types under the General Security section -> Now we will see the list of blocked file types box - include the .xss in that box. -> Click on Ok button.
- This file security works on the web application level - so you need to repeat the same configuration for all the web applications you want.
How to prevent users to prevent to upload infected documents in SharePoint?
For this, we need to configure the "Configure Antivirus Settings And Features" in SharePoint CA.
Below are the steps to configure the security and use their features in SharePoint:
Open SharePoint Central Administrator with administrator rights
Central Administrator page will be displayed at browser page, here we need to select a security option from left side of the page.
- Once you have clicked on security page, it will redirect us to security wizard where many options will be available. Here we need to select Manage Antivirus option from General security; shown below,
- Once you have clicked there, we will get Antivirus page where we need to do configuration and settings for the same,
- We can see there will many options available on this page, below I have described each one,
will specify the behavior while uploading documents in the list or Library. Following option will be available for those.
Scan documents on upload
by selecting this setting to scan uploaded documents. This helps prevent users with infected documents from allocating them to other users in the farm.
The above solution applies to SharePoint 2013 & 2016
For details refer to the below article:
What happens when an infected file is uploaded to SharePoint Online?
- A user uploads a file to SharePoint Online.
- SharePoint Online determines whether the file meets the criteria for a scan.
- The virus detection engine scans the file.
- If a virus is found, the virus engine sets a property on the file indicating that it's infected.
For details refer to the below MSDN article: