Validate upload file properly

To validate uploaded files properly, you must implement a series of checks both on the client and server sides. Below is a step-by-step guide to properly validate uploaded files:

---

1. Validate File Type

• Check File Extensions:
  • Allow only specific extensions, such as .jpg, .png, .pdf, etc.
  • Be cautious—extensions can be faked.
• Check MIME Type:
  • Use server-side libraries to verify the file's MIME type (e.g., image/png, application/pdf).

Example in Java:

java

String mimeType = Files.probeContentType(uploadedFile.toPath()); if (!Arrays.asList("image/png", "image/jpeg", "application/pdf").contains(mimeType)) { throw new IllegalArgumentException("Invalid file type."); }

---

2. Validate File Size

• Set a maximum file size limit to prevent overloading the server or storage.

Example in JavaScript (Client-Side):

const maxSize = 5 * 1024 * 1024; // 5 MB if (file.size > maxSize) { alert("File size exceeds the 5 MB limit."); }

Example in Java (Server-Side):

if (uploadedFile.length() > MAX_FILE_SIZE) { // MAX_FILE_SIZE in bytes throw new IllegalArgumentException("File size exceeds the allowed limit."); }

---

3. Sanitize File Name

• Remove or replace special characters in the file name to prevent path traversal attacks.
• Assign a new unique name to the file.

Example in Java:

String sanitizedFileName = originalFileName.replaceAll("[^a-zA-Z0-9\\.\\-]", "_"); String uniqueFileName = UUID.randomUUID().toString() + "_" + sanitizedFileName;

---

4. Validate Content

• Read a portion of the file and validate the content matches the expected format (e.g., an image header).
• Use libraries for deeper validation:
  • Image validation: Use tools like ImageIO in Java or Pillow in Python.
  • Document validation: Use libraries to parse PDFs or Word files.

Example in Python:

from PIL import Image try: img = Image.open(file_path) img.verify() # Verifies file integrity except Exception: raise ValueError("Uploaded file is not a valid image.")

---

5. Check for Malicious Content

• Scan files for viruses or malware using antivirus tools like ClamAV or VirusTotal.

Example with ClamAV (Command Line):

clamscan --infected --remove uploaded_file

---

6. Enforce HTTPS

• Use HTTPS to encrypt file uploads and protect data in transit.

---

7. Validate on Server Side

• Even if client-side validation is implemented, always revalidate on the server side to avoid bypass by malicious users.

---

8. Restrict File Permissions

• Set strict permissions on uploaded files to prevent unauthorized access or execution.
• Example: Store files outside the web root and access them through secure APIs.

---

9. Rate Limit Uploads

• Limit the number of files or the total size of files a user can upload within a certain timeframe to prevent abuse.

---

10. Perform Logging

• Log details about uploaded files (e.g., user ID, file name, size, and type) for auditing purposes.

---

Example Secure File Upload Workflow

1. Client Side:

   • Validate file size and type before uploading.
   • Limit the number of files selected for upload.

2. Server Side:

   • Check file type using MIME type and extension.
   • Validate file size.
   • Sanitize the file name.
   • Scan the file for malware.
   • Save the file in a secure directory with appropriate permissions.