File uploads and archives

Design a safer file-upload pipeline

Treat upload receipt, content processing, storage, and later delivery as separate security decisions.

Design, Development · Developers, AppSec engineers

Extract archives without escaping the destination

Prevent traversal, link tricks, overwrites and decompression exhaustion while preserving legitimate file extraction.

Design, Development · Developers, AppSec engineers

Convert untrusted office documents and PDFs in an isolated parser

DOCX, XLSX and ODF files are ZIP archives of XML, and PDFs can carry scripts; the converters that read them are large C and C++ programs with a long CVE history. Check the package before any parser reads it, convert each document in a container with no network, no writable root and hard limits, kill it at a deadline, and re-render to pixels when people will open the result.

Design, Development · Developers, AppSec engineers, Platform engineers and SREs

Prevent file inclusion: LFI, RFI, dynamic imports and template names

Stop request data from choosing which file, module or template your application loads: local and remote file inclusion in PHP, dynamic require() and import() in Node.js, importlib and template names in Python, Thymeleaf view names in Spring, render in Rails, and the allowlist fix that works in all of them.

Development · Developers, AppSec engineers

Create temporary files safely: mkstemp, O_EXCL and private directories

Stop symlink, hardlink and pre-created-file attacks on the temporary files your code writes in shared directories such as /tmp: create each file atomically with O_EXCL and owner-only permissions through mkstemp or its equivalent in shell, Python, Java, Node.js, Go, .NET and Rust, keep related files in a private directory, and treat the Linux protected_* sysctls and systemd PrivateTmp as a backstop.

Design, Development, Testing · Developers

Path traversal lab: Keep archive entries inside their extraction directory

An import job writes archive entry names directly beneath its work directory. An entry containing ../ can escape. Repair the entry-name policy before any file is created.

Path traversal lab: Serve an uploaded file without path traversal

A download endpoint joins the requested name onto the upload directory and opens it, so ../ or an absolute path reads files anywhere on disk, and a symlink in the directory points outside it. Repair it to resolve the final path and refuse anything outside the upload directory.

File upload lab: Accept avatars without publishing pages

A profile-picture upload trusts the client’s Content-Type and file name, stores files in the public folder and serves them with the client’s type, so an SVG with a script runs in the site’s origin. Repair the upload decision.

Path traversal

Path traversal happens when a file name or path from a request is joined to a base directory and opened without checking where the result lands.

Unrestricted file upload

Unrestricted file upload happens when an endpoint stores whatever a client sends and later serves or processes it as if it were the kind of file the feature expects.