How to fix Insecure File Upload

What an attacker can do

The concrete impact of leaving Insecure File Upload unpatched.

How to fix Insecure File Upload

5 ordered steps. Apply them in order — each builds on the previous.

1. 1

   Validate extension AND content type AND magic bytes

   Three checks because each can be bypassed alone. Whitelist allowed extensions; verify MIME from server-side detection (not request header); check magic bytes match.

   For images, use library-level validation (Pillow/sharp/ImageMagick) that fails on malformed input — not just header sniffing.

   javascriptStep 1

   import { fileTypeFromBuffer } from "file-type";
   
   const ALLOWED_EXTS = new Set([".jpg", ".jpeg", ".png", ".webp", ".pdf"]);
   const ALLOWED_MIMES = new Set([
     "image/jpeg", "image/png", "image/webp", "application/pdf",
   ]);
   
   async function validateUpload(buffer, originalName) {
     // 1. Extension whitelist
     const ext = path.extname(originalName).toLowerCase();
     if (!ALLOWED_EXTS.has(ext)) throw new Error("Extension not allowed");
   
     // 2. Magic-byte detection (ignores Content-Type from request)
     const detected = await fileTypeFromBuffer(buffer);
     if (!detected || !ALLOWED_MIMES.has(detected.mime)) {
       throw new Error("File content does not match allowed types");
     }
   
     // 3. Extension matches detected type
     const expectedExts = { jpg: ".jpg", jpeg: ".jpg", png: ".png", webp: ".webp", pdf: ".pdf" };
     if (expectedExts[detected.ext] !== ext.replace("jpeg", "jpg")) {
       throw new Error("Extension does not match content");
     }
   }

2. 2

   Save under a server-generated random filename

   Never save with the user's filename. Use UUID or hash. Prevents path traversal, predictable naming attacks, and keeps the original extension confusion contained.

   Store original filename in DB metadata if you need to display it. Use random name on disk.

   pythonStep 2

   import uuid
   from pathlib import Path
   
   UPLOAD_DIR = Path("/var/uploads")  # NOT in web root
   
   def save_upload(file, allowed_exts, max_bytes=10_000_000):
       if file.size > max_bytes:
           raise ValueError("File too large")
   
       # Magic byte check via Pillow / similar
       file.stream.seek(0)
       detected_ext = sniff_magic(file.stream.read(16))
       file.stream.seek(0)
       if detected_ext not in allowed_exts:
           raise ValueError("Type not allowed")
   
       # Generate random name; store metadata in DB
       new_name = f"{uuid.uuid4().hex}.{detected_ext}"
       path = UPLOAD_DIR / new_name
       file.save(path)
       return new_name  # return ID to store in DB

3. 3

   Serve uploads from a separate origin (cookieless, no execution)

   User uploads at `app.example.com` should be SERVED from `uploads.example.com` or an S3 CDN. Separates the upload origin from your app's session cookies and prevents server-side execution.

   S3 + CloudFront is the easy path. Configure CloudFront to set Content-Disposition: attachment for non-images and X-Content-Type-Options: nosniff.

   yamlStep 3

   # Separate subdomain for uploads — no app cookies, no PHP/Node executor
   # nginx config snippet for uploads.example.com
   server {
       listen 443 ssl http2;
       server_name uploads.example.com;
       root /var/uploads;
   
       # Block any execution of script files
       location ~ \.(php|jsp|jspx|asp|aspx|cgi|pl|py|sh)$ {
           deny all;
       }
   
       # Force download for non-images
       location ~* \.(pdf|doc|docx|xls|xlsx|zip|tar)$ {
           add_header Content-Disposition "attachment";
           add_header X-Content-Type-Options "nosniff";
       }
   
       # Images served inline but with strict headers
       location ~* \.(jpg|jpeg|png|webp|gif)$ {
           add_header X-Content-Type-Options "nosniff";
           add_header Content-Security-Policy "default-src 'none'; img-src 'self'";
       }
   }

4. 4

   Sanitize SVGs (or convert to raster)

   SVG can contain `<script>` and event handlers. Sanitize via DOMPurify-equivalent for SVG, or convert to PNG server-side and discard the original.

   If users don't strictly need SVG (most apps don't), reject them. If you need them: use `svg-sanitizer` (PHP), `dompurify` (Node) with SVG profile.

   javascriptStep 4

   import DOMPurify from "isomorphic-dompurify";
   
   function sanitizeSvg(svgString) {
     return DOMPurify.sanitize(svgString, {
       USE_PROFILES: { svg: true, svgFilters: true },
       FORBID_TAGS: ["script", "foreignObject"],
       FORBID_ATTR: ["onload", "onerror", "onclick"],
     });
   }
   
   // Better: convert to PNG server-side
   import sharp from "sharp";
   const png = await sharp(svgBuffer).png().toBuffer();
   // Discard original SVG, store the PNG

5. 5

   Scan uploads with ClamAV before serving

   Defense-in-depth: even if a malicious file passes all your checks, AV catches known malware patterns. Scan async after upload, mark file as 'pending' until clean.

   ClamAV via clamd daemon is the standard. For SaaS, use VirusTotal API or similar. Cost: ~10-100ms per file.

   pythonStep 5

   import clamd
   
   cd = clamd.ClamdNetworkSocket("clamav-daemon", 3310)
   
   def scan_file(path: str) -> bool:
       """Returns True if clean, False if infected."""
       result = cd.scan(path)
       if result is None:
           raise RuntimeError("ClamAV unreachable")
       status = result.get(path, ("ERROR",))[0]
       return status == "OK"
   
   # In upload flow:
   # 1. Save to /tmp/staging/<id>
   # 2. Mark file as pending in DB
   # 3. Async worker: scan_file → if clean, move to /var/uploads, mark ready
   # 4. App serves only files marked ready