Secure File Upload Implementation

The Risk of File Uploads

File upload functionality is one of the most dangerous features an application can expose. An unrestricted file upload can lead to remote code execution, malware distribution, data breaches, and server compromise. Every file upload endpoint must be treated as a critical attack surface.

Threat Model

| Attack | Description |

|--------|-------------|

| Malicious file upload | Attacker uploads a PHP shell or executable |

| File size DoS | Huge files exhaust disk space or memory |

| Path traversal | Filename manipulates directory traversal |

| MIME type spoofing | File extension does not match content |

| Malware distribution | Legitimate-looking files containing malware |

| Zip bombs | Compressed archive that expands to enormous size |

| SSRF via file processing | Server-side parsing of attacker-controlled files |

Validation Strategy

1. Validate File Extension

Allowlist-based validation is essential. Blocklisting (e.g., rejecting `.exe` files) will always miss edge cases.

ALLOWED_EXTENSIONS = {

    # Images

    '.jpg', '.jpeg', '.png', '.gif', '.webp', '.svg',

    # Documents

    '.pdf', '.doc', '.docx', '.xls', '.xlsx',

    # Other

    '.txt', '.csv'

}



def validate_extension(filename):

    ext = os.path.splitext(filename)[1].lower()

    if ext not in ALLOWED_EXTENSIONS:

        raise ValueError(f"Extension {ext} not allowed")

2. Validate MIME Type

Never trust the `Content-Type` header from the client. Inspect the actual file content:

import magic



def validate_mime(file_stream):

    mime = magic.from_buffer(file_stream.read(2048), mime=True)

    file_stream.seek(0)

    ALLOWED_MIMES = {

        'image/jpeg', 'image/png', 'image/gif',

        'image/webp', 'application/pdf',

        'text/plain', 'text/csv'

    }

    if mime not in ALLOWED_MIMES:

        raise ValueError(f"MIME type {mime} not allowed")

3. Validate File Size

Enforce strict limits at multiple layers:

// Express middleware

const multer = require('multer');

const upload = multer({

    limits: {

        fileSize: 10 * 1024 * 1024, // 10 MB

        files: 1

    },

    fileFilter: (req, file, cb) => {

        const allowed = ['image/jpeg', 'image/png', 'application/pdf'];

        if (!allowed.includes(file.mimetype)) {

            return cb(new Error('Invalid file type'), false);

        }

        cb(null, true);

    }

});

4. Validate File Content

For images, attempt to re-process them. This strips embedded metadata and breaks hidden payloads:

from PIL import Image

import io



def sanitize_image(file_bytes):

    """Re-encode image to strip metadata and break embedded payloads."""

    img = Image.open(io.BytesIO(file_bytes))

    # Convert to ensure clean output

    img = img.convert('RGB')

    output = io.BytesIO()

    img.save(output, format='PNG')

    return output.getvalue()

Secure Storage

Never Store in Webroot

Storing uploaded files inside the web server's document root is dangerous. If the filename or path is guessable, files can be accessed directly.

# UNSAFE: Stored in webroot

upload_dir = '/var/www/html/uploads/'



# SAFE: Outside webroot

upload_dir = '/data/uploads/'  # Served through app logic

Generate Safe Filenames

Never use user-provided filenames. Generate random filenames:

import uuid

import os



def safe_filename(original_name):

    ext = os.path.splitext(original_name)[1].lower()

    return f"{uuid.uuid4().hex}{ext}"

Object Storage

For production systems, use object storage with pre-signed URLs:

import boto3



s3 = boto3.client('s3')



def upload_file(file_bytes, content_type):

    key = f"uploads/{uuid.uuid4().hex}.pdf"

    s3.put_object(

        Bucket='my-app-uploads',

        Key=key,

        Body=file_bytes,

        ContentType=content_type

    )

    return key



def get_download_url(key, expires=3600):

    return s3.generate_presigned_url(

        'get_object',

        Params={'Bucket': 'my-app-uploads', 'Key': key},

        ExpiresIn=expires

    )

Antivirus Scanning

Integrate virus scanning into the upload pipeline:

import subprocess



def scan_file(file_path):

    result = subprocess.run(

        ['clamscan', '--stdout', file_path],

        capture_output=True,

        text=True

    )

    if 'FOUND' in result.stdout:

        os.remove(file_path)

        raise SecurityError("Malware detected in uploaded file")

Storage Limits and Quotas

| Level | Limit | Mitigation |

|-------|-------|------------|

| Per file | 10 MB | Reject on client and server |

| Per user | 500 MB | Track in database, reject when exceeded |

| Per day (total) | 5 GB | Aggregate monitoring, rate limit |

| Disk usage | 80% capacity | Alert, stop accepting uploads |

Server Configuration

Prevent uploaded files from being executed by the web server:

# Nginx configuration

location /uploads/ {

    # Only serve specific file types

    location ~* \.(jpg|jpeg|png|gif|pdf)$ {

        add_header Content-Disposition 'attachment';

        expires 30d;

    }

    # Deny everything else

    location ~* \. {

        deny all;

        return 404;

    }

}

Summary

Secure file upload requires defense in depth. Validate extensions and MIME types server-side, sanitize images by re-encoding them, generate random filenames, store files outside the webroot or in object storage, enforce strict size limits at multiple layers, and scan for malware. Never trust client-provided metadata, and process uploaded files with minimal privileges in isolated environments.