Class UploadValidator

Namespace

HeroKit.FileTypes

Assembly

HeroKit.FileTypes.dll

Checks whether an uploaded file is safe to accept, following the OWASP file upload advice.

public sealed class UploadValidator

Inheritance

object

UploadValidator

Inherited Members

object.Equals(object)

object.Equals(object, object)

object.GetHashCode()

object.GetType()

object.ReferenceEquals(object, object)

object.ToString()

Extension Methods

TypeControlExtensions.IsDefaultValue<T>(T)

ObjectControlExtensions.IsNotNull(object?)

ObjectControlExtensions.IsNull(object?)

ObjectControlExtensions.IsNumeric(object?)

ObjectConversionExtensions.ConvertTo<T>(object?, T?)

ObjectConversionExtensions.TryConvertTo<T>(object?, out T?)

Examples

var validator = new UploadValidator(new UploadPolicy { AllowedTypes = [FileTypes.Jpeg, FileTypes.Png] });

UploadCheckResult result = validator.Validate(file.OpenReadStream(), file.FileName);
if (!result.IsSafe)
    return BadRequest(result.Message);

Remarks

The checks run as a chain, in this order, and the first rejection stops it: file name, program or script extension (also hidden as in "a.php.jpg"), empty content, MaxLength, program or script content, known extension, detected content and whether it fits the extension, AllowedTypes, macros in Office documents (also VBA projects in legacy DOC and XLS files), active content in SVG, then the rules in Rules.

An instance is immutable and thread-safe; register one per policy as a singleton. The check does not replace a request size limit in the web server, generated file names, re-encoding images or virus scanning.

Constructors

UploadValidator()

Creates a validator with Default and Default.

public UploadValidator()

UploadValidator(UploadPolicy)

Creates a validator with a policy and Default.

public UploadValidator(UploadPolicy policy)

Parameters

policy UploadPolicy

The policy.

UploadValidator(UploadPolicy, FileTypeRegistry)

Creates a validator with a policy and a registry of file types.

public UploadValidator(UploadPolicy policy, FileTypeRegistry registry)

Parameters

policy UploadPolicy

The policy.

registry FileTypeRegistry

The registry used for detection and extension lookups.

Properties

Policy

Gets the policy.

public UploadPolicy Policy { get; }

Property Value

UploadPolicy

Registry

Gets the registry used for detection and extension lookups.

public FileTypeRegistry Registry { get; }

Property Value

FileTypeRegistry

Methods

Validate(Stream, string)

Checks an uploaded file from a stream. Reads like Detect(Stream) (the header and, for ZIP files, the central directory), or the whole file up to MaxSvgScanLength for SVG, and restores the position of a seekable stream.

public UploadCheckResult Validate(Stream stream, string fileName)

Parameters

stream Stream

The stream, positioned at the start of the file.

fileName string

The file name as uploaded.

Returns

UploadCheckResult

The result with the reason of a rejection.

Validate(ReadOnlySpan<byte>, string)

Checks an uploaded file from its bytes.

public UploadCheckResult Validate(ReadOnlySpan<byte> content, string fileName)

Parameters

content ReadOnlySpan<byte>

The file content, or at least its first HeaderSize bytes.

fileName string

The file name as uploaded.

Returns

UploadCheckResult

The result with the reason of a rejection.

Examples

validator.Validate(pngBytes, "photo.png").IsSafe;        // true
validator.Validate(exeBytes, "photo.png").Rejection;     // DangerousContent
validator.Validate(pngBytes, "photo.php.png").Rejection; // DoubleExtension

Remarks

An SVG is scanned only as far as content goes; pass the whole file or use Validate(Stream, string).