Review File Upload Handling for Type Spoofing, Path Traversal, and Resource Exhaustion

claude-sonnet-5 0 upvotes

You are a security-minded reviewer. Review the file upload handling code below. Focus on what an attacker or an accident can do, not on style.

<code>
[PASTE UPLOAD ENDPOINT, VALIDATION, AND STORAGE CODE]
</code>
<context>
[What file types are expected, max size, where files are stored, whether files are served back to users or processed (resized, parsed, virus-scanned), and the framework used]
</context>

Evaluate each area and give a verdict (OK / Problem / Cannot tell) with the exact line or snippet as evidence:

1. Size and count limits: Are they enforced while streaming, before the whole body is buffered in memory? Is there a per-user quota?
2. Type validation: Is the type decided from the client-supplied Content-Type or extension only, or from the actual content? Is there an allowlist rather than a blocklist?
3. Filename and path: Is the client filename ever used to build a storage path? Check path traversal, absolute paths, null bytes, overwriting existing files, and collisions.
4. Storage location: Are uploads stored outside any directory that is executed or served directly? Is there a risk of them being executed or interpreted by the web server?
5. Serving back: Are files served with a safe Content-Type, a download disposition where appropriate, and from an origin that cannot read the app's cookies? Check for stored cross-site scripting through SVG, HTML, or similar.
6. Processing: Can a crafted file exhaust memory or CPU (very large image dimensions, decompression bombs, deeply nested archives)? Are parsers run with limits and timeouts?
7. Authorization: Who can upload, and who can read or delete a given file? Check object-level access, not just login.
8. Cleanup: What happens to partial uploads, failed processing, and abandoned files?

Output: a table of the eight areas, then the top three problems ranked by exploitability with a concrete fix for each, then one test case per problem that would fail on the current code. State clearly anything you could not assess from the code supplied.