File Uploads

Treat File Uploads as Untrusted Content

A file-upload feature can appear simple: accept bytes, save them, and let another user download them later. The security problem is that the uploaded file crosses several trust boundaries. Its name, declared type, contents, and eventual delivery behavior are all influenced by the uploader. If the application treats any of those properties as trustworthy, an ordinary upload can become an unintended way to consume excessive resources, overwrite data, feed dangerous content into a parser, or make a browser handle attacker-controlled bytes in a more powerful context than intended.