File Upload Security

Implement defense-in-depth for file uploads through multi-layered validation, secure storage, proper access controls, and monitoring. Never rely on a single validation method.

Extension Validation

• Allow-list extensions only for business-critical functionality.
• Apply input validation before validating extensions.
• Avoid double extensions (e.g., .jpg.php) and null byte injection (e.g., .php%00.jpg).
• Use allow-list approach rather than deny-list for file extensions.
• Validate extensions after decoding the filename to prevent bypass attempts.

Content Type and File Signature Validation

• Never trust client-supplied Content-Type headers -- they can be spoofed.
• Validate file signatures (magic numbers) in conjunction with Content-Type checking.
• Implement allow-list approach for MIME types as a quick protection layer.
• Use file signature validation but not as a standalone security measure.