Treat uploads as hostile. Require authentication and authorization, cap request and file size, allow-list expected formats, and validate file signatures rather than trusting extensions or Content-Type. Generate storage names; never use a client path. Stream to quarantined storage outside the web root, scan with malware tooling, and promote only clean files. Serve through an indirect ID or short-lived signed URL with Content-Disposition and nosniff headers; prevent script-capable content from executing in your origin. Encrypt storage, restrict service identity access, record ownership/tenant, define retention, and clean abandoned uploads. Image decoding and archive extraction need limits against decompression bombs and parser vulnerabilities.
Backbencher Developer · · 0 likes