Securing File Uploads: Validation and Sanitization

The File Upload Threat Model

File uploads can be exploited in multiple ways: executing uploaded scripts (web shells), overwriting system files via path traversal, denial of service through massive files, and delivering malware to other users who download the files.

Client-Side Validation (First Line, Not Security)

Validate file type and size on the client side for user experience (instant feedback), but never rely on it for security. Client-side checks are trivially bypassed. They prevent honest mistakes, not attacks.

Server-Side Validation

Check the file's magic bytes (first few bytes that identify the format), not just the extension. A file named photo.jpg might actually be a PHP script. Validate file size against a reasonable maximum. Check image dimensions to prevent decompression bombs (a tiny file that expands to gigapixels). Scan for known malware signatures if accepting files from untrusted users.

File Storage Best Practices

Never store uploaded files in the web server's document root — this prevents direct execution. Store files outside the web root and serve them through a controller that sets appropriate Content-Type and Content-Disposition headers. Use randomized filenames to prevent enumeration and path traversal attacks. Preserve the original filename in metadata only.

Content-Type Headers

When serving uploaded files, set the Content-Type header based on your own validation, not the user-provided MIME type. Add Content-Disposition: attachment for file downloads to prevent the browser from rendering potentially dangerous content inline. Set X-Content-Type-Options: nosniff to prevent the browser from guessing the content type.

Client-Side Processing Advantage

Browser-based tools that process files locally have an inherent security advantage — uploaded files never reach a server. The files exist only in the browser's sandboxed memory during processing. This eliminates server-side file upload vulnerabilities entirely. Communicate this privacy benefit to users as a trust signal.