File uploads: extensions prove nothing
What to check between selecting a file, storing it and serving it back.
Follow the entire path
An upload assessment does not end at “file accepted.” Record allowed formats, storage location, processing and delivery. Thumbnail generators and converters are part of that path and may process data differently from the main application.
Do not trust client metadata
The client supplies the filename and declared Content-Type. With test files, check that content, extension and permitted type agree. No single indicator replaces the others, and size limits need server-side enforcement.
Check access after upload
An uploaded document may become accessible to an unintended user. Use two test accounts and known files. Separately check how the browser displays the content and which headers are returned when the file is downloaded.
Separate storage from execution
The server must not execute user-uploaded files as code. Separate storage, server-generated names, format restrictions and safe processing can help. Malware scanning can complement these measures, but cannot replace access control and architectural safeguards.