Services
Technology Web App Development Mobile App Development Windows App Development Database Development UI/UX Development Cloud Development SEO Digital Marketing Guest Posting Content Writing Artificial Intelligence Data Science ERP Development CRM Development CMS Development LMS Development Business Listing Blockchain Technology Startup Promotion AI Tools Integration
Products
Data Converter Cleaner TUC - Unit Converter Import Export Survey Manager Tweet Controller
Developer
Article Blog Forum Interview Beginner News Startup Quiz
Users
Career
Apply Job Internship
Pricing
Login Sign Up Get a Quote

forum

Home Forums How can you validate whether a file is safe before uploading or reading it? – MindStick
Ask Question

1 Answers

Anubhav Sharma
Anubhav Sharma 22 May 2025
Report Abuse

Validating whether a file is safe before uploading or reading is essential to prevent security risks such as malware, viruses, or malicious code injection. Below are best practices and techniques for validating file safety:

1. Validate File Type (MIME Type and Extension)

Check File Extension

Ensure only allowed extensions (e.g., .jpg, .pdf, .docx, etc.):

var allowedExtensions = new[] { ".jpg", ".png", ".pdf" };
var fileExtension = Path.GetExtension(file.FileName).ToLowerInvariant();

if (!allowedExtensions.Contains(fileExtension))
{
    throw new InvalidOperationException("Invalid file type.");
}

Check MIME Type (Content-Type)

Don't trust file.ContentType from the browser. Instead, inspect the file's content (see below).

2. Inspect File Content (Magic Bytes/Signature)

Use magic numbers to verify the file type:

using (var reader = new BinaryReader(file.OpenReadStream()))
{
    var bytes = reader.ReadBytes(4); // Read enough for signature
    var signature = BitConverter.ToString(bytes);

    // Example for PNG (89-50-4E-47)
    if (signature != "89-50-4E-47")
    {
        throw new InvalidOperationException("File content does not match expected type.");
    }
}

Refer to file signature databases like Gary Kessler's File Signatures Table.

3. Limit File Size

Set a max file size limit (e.g., 5MB):

const long maxSize = 5 * 1024 * 1024;
if (file.Length > maxSize)
{
    throw new InvalidOperationException("File is too large.");
}

Also configure server-side limits in settings (e.g., in ASP.NET Core: RequestSizeLimit or MaxRequestBodySize).

4. Scan for Malware

Use antivirus APIs or malware scanners before accepting the file:

  1. ClamAV (open-source, cross-platform)
  2. Windows Defender (MpCmdRun.exe -Scan)
  3. VirusTotal API (send hash or file for scanning — usage-limited)

Example (with VirusTotal API):

POST https://www.virustotal.com/api/v3/files
Headers: x-apikey: YOUR_API_KEY
Body: (multipart/form-data file upload)

5. Rename Files to Avoid Path Injection

Never trust client filenames. Sanitize and/or replace with GUID:

var safeFileName = Path.GetRandomFileName() + fileExtension;

6. Store Outside Web Root

Never store uploaded files in a public web directory. This prevents accidental execution or download.

Store files in a secured directory like /app_data/uploads.

7. Avoid Inline Execution

Do not allow direct rendering of uploaded files (e.g., don't return HTML/JS from user-uploaded files).

Set the correct content-disposition headers:

return File(fileBytes, "application/octet-stream", downloadFileName);

Summary Checklist

Check Purpose
Extension Basic type validation
MIME / Magic Byte Signature Confirms actual content type
File Size Prevents DoS via oversized files
Malware Scan Detects malicious content
Sanitize File Name Prevents path traversal & injection
Store Outside Web Root Protects against execution in browser
Secure Headers Prevents XSS or injection
advertising
Markdown for AI

A clean, structured version of this page for AI assistants and LLMs.

Open .md