File upload functionality is a common feature in web applications, but it's also one of the most common attack vectors. A recent security review of our applications revealed some vulnerabilities in our file upload handling that needed our attention. This is the first post in a series where I'll share how we systematically secured our file upload functionality.
The problem
The fundamental issue with file uploads is trust. When users upload files, we're essentially allowing them to store content on our servers. Without proper validation, attackers can:
- Upload malicious scripts disguised as innocent files
- Bypass security controls by manipulating file extensions
- Execute server-side code through crafted payloads
- Consume excessive server resources with oversized files
The first line of defense? Content type validation.
Our approach: A validation pipeline
Rather than implementing ad-hoc validation checks scattered throughout our codebase, we designed a clean, extensible validation pipeline. This approach allows us to:
- Add new validation steps easily
- Maintain consistent validation logic across the application
- Test each validation step independently
- Fail fast when any validation step fails
Here's the core structure:
Content type validation: The first gate
Content type validation is our first checkpoint. It ensures that only files with approved MIME types can enter our system. Here's our implementation:
These are the key design decisions we took while developing this feature:
1. Explicit allow-list
We use a SupportedContentTypes configuration that explicitly defines which MIME types are allowed. This is much safer than trying to block known dangerous types, as new attack vectors emerge constantly.
2. Case-insensitive comparison
MIME types are compared using StringComparison.OrdinalIgnoreCase to handle variations in casing that might be used to bypass naive string matching. A way to easy mistake that we made too much before…
3. Comprehensive logging
Every validation failure is logged with context. This helps with debugging legitimate upload failures and provides audit trails for potential security incidents.
4. Null safety
The code explicitly checks for null or empty content types, which can occur with malformed requests or certain browser behaviors. Nothing extra-ordinary, but we like to stay of the safe side.
The complete pipeline
Why content type validation isn't enough
It's crucial to understand that content type validation is not a complete solution. The Content-Type header is controlled by the client and can be easily spoofed. An attacker could upload a malicious PHP script but set the content type to image/jpeg.
Content type validation provides our first layer of defense, but as mentioned, it's not sufficient on its own. In the next posts, we'll dive into:
- File signature validation: Verifying files are actually what they claim to be
- File size limits: Preventing resource exhaustion attacks
- Malware scanning: The final safety net against malicious content
- Storage security: Safe handling of uploaded files
Stay tuned for the next post where we'll explore file signature validation and how to detect files that lie about their true format.