Secure File Uploads: Validation and Quarantine
· PoolByte Technology
Adding a document to the quote form, a receipt to the customer portal, or an image to the content editor creates the need to upload a file. The file selector in the browser is just user experience. The content to be accepted, where the file will be kept, and who can download it must be determined on the server.
Multiple layers of verification required
The file extension and the type of content sent by the browser do not have the same trust level. Define a narrow list of allowed types; Consider size, file signature, and actual processing result together. OWASP file upload guide explains that these checks should not be reduced to a single verification.
A profile photo field does not need to accept executable files or compressed archives. In an area where a user agreement is uploaded, image conversion alone is not sufficient. Writing which file type is accepted for which business reason simplifies security control and support text.
Do not assume the filename is an authority or location
Do not use the user-provided filename as the file path on the server. Create a separate server-generated ID and secure storage path. If the original name is required, it can be kept securely as display data only. Test that two files with the same name are not overwritten by each other.
Private documents should not be kept directly in a public web folder. In a download request, the user's authority to view that document must be verified on the server. A complex URL can make it difficult to guess; but it does not replace authorization. A request made with the wrong client's document ID should not grant access even if the file exists.
Separate quarantine from ‘successfully uploaded’ status
If scanning for malicious content is required, the document can first sit in a closed area. The “received”, ‘under review’, “accepted” and “rejected” statuses must be clear. Instead of automatically counting the file as clean when the scanning service does not respond, specify waiting behavior appropriate to the risk of the product.
Also limit pixel size and memory consumption when processing images. An image with a small file size may require large memory when processing. If the archive is to be opened, the number of opened contents, total size and attempts to write outside the folder should be considered separately. Not accepting an unnecessary file type is often the simplest solution.
Trial scenarios
- Wrong extension, wrong content type and corrupt file.
- Zero byte file and upload beyond limit.
- Two different documents with the same name.
- Attempt to download another customer's document.
- Interrupted upload and scanning service outage.
- Behavior of old link after file is deleted.
Do not log the contents of the file or unnecessary personal information in upload and download logs. Include the retention period and deauthorization flow in the project scope. For general protection of the form, anti-spam guide may be helpful; File security is a separate server responsibility and is not complete with CAPTCHA.