Class UploadPolicy

Namespace

HeroKit.FileTypes

Assembly

HeroKit.FileTypes.dll

Settings for UploadValidator.

public sealed class UploadPolicy

Inheritance

object

UploadPolicy

Inherited Members

object.Equals(object)

object.Equals(object, object)

object.GetHashCode()

object.GetType()

object.ReferenceEquals(object, object)

object.ToString()

Extension Methods

TypeControlExtensions.IsDefaultValue<T>(T)

ObjectControlExtensions.IsNotNull(object?)

ObjectControlExtensions.IsNull(object?)

ObjectControlExtensions.IsNumeric(object?)

ObjectConversionExtensions.ConvertTo<T>(object?, T?)

ObjectConversionExtensions.TryConvertTo<T>(object?, out T?)

Examples

var imagesOnly = new UploadPolicy { AllowedTypes = [FileTypes.Jpeg, FileTypes.Png, FileTypes.WebP] };
var validator = new UploadValidator(imagesOnly);
UploadCheckResult result = validator.Validate(stream, file.FileName);
if (!result.IsSafe) return BadRequest(result.Message);

Properties

AllowMacros

Gets whether documents with macros are accepted: macro-enabled types (HasMacros, for example DOCM and XLSM) and legacy DOC and XLS files with a VBA project. Defaults to false.

public bool AllowMacros { get; init; }

Property Value

bool

Remarks

A legacy file is searched for a VBA project only when its directory is available: pass the whole file as a span, or a seekable stream. Excel 4.0 (XLM) macro sheets and PowerPoint 97-2003 macros are not found.

AllowUnknownContent

Gets whether content that no detector recognizes is accepted when its extension is allowed. Defaults to false.

public bool AllowUnknownContent { get; init; }

Property Value

bool

AllowedTypes

Gets the allowed types, or null to allow every type that is not a program or script. The extension's type must be in the list.

public IReadOnlyCollection<FileType>? AllowedTypes { get; init; }

Property Value

IReadOnlyCollection<FileType>

BlockedExtensions

Gets the extensions that are always rejected, in lower case without a dot. Extensions of program and script types (IsExecutable) in the registry are rejected as well. Defaults to DefaultBlockedExtensions.

public IReadOnlySet<string> BlockedExtensions { get; init; }

Property Value

IReadOnlySet<string>

Examples

var policy = new UploadPolicy { BlockedExtensions = new HashSet<string>(UploadPolicy.DefaultBlockedExtensions) { "dwg" } };

Default

Gets the default policy: any type that is not a program or script, with a known extension that fits the content.

public static UploadPolicy Default { get; }

Property Value

UploadPolicy

DefaultBlockedExtensions

Gets server-side and Windows script extensions that are not built-in types: "asp", "aspx", "jsp", "cgi", "py", "config", "reg" and similar.

public static IReadOnlySet<string> DefaultBlockedExtensions { get; }

Property Value

IReadOnlySet<string>

MaxFileNameLength

Gets the longest allowed file name. Defaults to 255.

public int MaxFileNameLength { get; init; }

Property Value

int

MaxLength

Gets the largest allowed file in bytes, or null for no limit. Defaults to null.

public long? MaxLength { get; init; }

Property Value

long?

Remarks

The length of a span is its length; the length of a stream is read only when the stream can seek. Also limit the request body in the web server (for example [RequestSizeLimit] in ASP.NET Core), so a large upload is refused before it is read.

MaxSvgScanLength

Gets the largest SVG that is scanned for active content when a stream is checked; larger SVG files are rejected. Defaults to 1 MB.

public int MaxSvgScanLength { get; init; }

Property Value

int

Rules

Gets extra rules that run after the built-in checks.

public IReadOnlyList<IUploadRule> Rules { get; init; }

Property Value

IReadOnlyList<IUploadRule>