Accepting files.
WHAT TO VALIDATE
That a file was actually uploaded Its size Its type, determined from content rather than name or the declared type Its dimensions, for images
WHY NOT THE NAME
The extension is supplied by the client and means nothing.
WHAT TO NEVER DO
Store uploads inside a directory that executes code Use the supplied filename Trust the declared type
WHY THE FILENAME MATTERS
It can contain path components, directing the file elsewhere.
WHAT TO DO INSTEAD
Generate your own name and keep the original only as a label.
WHERE TO STORE THEM
Outside the web root, served through code that checks entitlement.
Or in a location configured not to execute anything.
WHAT TO CHECK BEFORE SERVING
That the requester is entitled to the file.
WHAT TO SET
Limits on size, in both the application and the server configuration.
WHAT TO BE CAREFUL WITH
Image processing of untrusted files, which has its own risks.
WHAT TO SCAN
Uploads, where the risk warrants it.
