Secure File Uploads: Seven Checks and Why Each One Exists

DEV Community

Authentication Security Deep Dive: From Brute Force to Salted Hashing (With Java Examples) Why AI Systems Don’t Fail — They Drift Spilling beans for how i learn for exam😁"Reinforcement Learning Cheat Sheet" I Replaced Chrome with Safari for AI Browser Automation. Here's What Broke (and What Finally Worked) How Python Borrows Other People's Work The $40 Architecture: Processing 1 Billion API Requests with 99.99% Uptime Vibe Coding: A Workflow Guide (From Zero to SaaS) Most webhook security guides protect the wrong side. The scary part is delivery. Headless CMS for TanStack Start: Build a Blog with Cosmic EU Age Verification App "Hacked in 2 Minutes" — What Actually Happened Comfy Cloud’s delete function does not actually remove files Running AI Models on GPU Cloud Servers: A Beginner Guide Event-driven media intelligence with AWS Step Functions and Bedrock I scored 500 AI prompts across 8 quality dimensions — here's what broke How to Call Google Gemini API from Next.js (Free Tier, No Backend Needed) The Portal Protocol: Reclaiming Human Connection in the Age of AI How to Fix Your Team's Scattered Knowledge Problem With a Self-Hosted Forum Intro to tc Cloud Functors: A Graph-First Mental Model for the Modern Cloud Designing Multi-Tenant Backends With Both Ownership and Team Access I Built a Neumorphic CSS Library with 77+ Components — Here's What I Learned PostgreSQL Performance Optimization: Why Connection Pooling Is Critical at Scale Cómo construí un SaaS multi-rubro para gestionar expensas en Argentina con FastAPI + Vue 3 🚀 I Built an Ethical Hacking Scanner Tool – Open Source Project I Replaced /usage and /context in Claude Code With a Single Statusline A Pythonic Way to Handle Emails (IMAP/SMTP) with Auto-Discovery and AI-Ready Design I Collected 8.9 Million Polymarket Price Points — Here's What I Found About How Markets Really Move EcoTrack AI — Carbon Footprint Tracker & Dashboard Everyone's Using AI. No One Agrees How. 5 self-hosted ebook managers worth trying in 2026 Building Your First AI Agent with LangChain: From Chatbot to Autonomous Assistant Common SOC 2 Failures (Real World) Stop Vibe-Checking Your AI App: A Practical Guide to Evals How to Use SonarQube and SonarScanner Locally to Level Up Your Code Quality Your Next To-Do App Is Dead — I Replaced Mine with an OpenClaw AI Sign a Nostr event in 60 lines of Python using coincurve — no nostr-sdk, no nbxplorer, no rust toolchain ITGC Audit Explained Like You’re in Big 4 Patch Tuesday abril 2026: Microsoft parcha 163 vulnerabilidades y un zero-day en SharePoint Stop scraping everything: a better way to track competitor price changes Listing on MCPize + the Official MCP Registry while routing payments OUTSIDE the marketplace — how I kept 100% of my x402 revenue Building an AI-Powered Risk Intelligence System Using Serverless Architecture Why We Ripped Function Overloading Out of Our AI Toolchain Testing AI-Generated Code: How to Actually Know If It Works SaaS Churn Is Killing Your Business. Here Is What to Do About It (Without a Support Team) The Speed of AI Is No Longer Linear - And Self-Improving Models Are Why How to Implement RBAC for MCP Tools: A Practical Guide for Engineering Teams From Standard Quote to Persuasive Proposal: AI Automation for Arborists I built a CLI that scaffolds complete multi-tenant SaaS apps Axios CVE-2025–62718: The Silent SSRF Bug That Could Be Hiding in Your Node.js App Right Now The dashboard that ended our friendship Data Pipelines Explained Simply (and How to Build Them with Python) The Hidden Cost of AI Systems Nobody Talks About. undefined vs undeclared, and how typeof behaves Switching from file-based jobs to NATS/Kafka in Rust without changing code io_uring Adventures: Rust Servers That Love Syscalls Why Agentic AI is Killing the Traditional Database The POUR principles of web accessibility for developers and designers Quantum Neural Network 3D — A Deep Dive into Interactive WebGL Visualization How To Install Caveman In Codex On macOS And Windows Automation Pipeline Reliability: Why Your Workflow Breaks When Nobody Is Watching I Built an 'Open World' AI Coding Agent — It Works From ANY Folder From Freelancing to Product: A Tech Service Company's SaaS Transformation China's AI Giants: Adding Tencent Hunyuan & ByteDance Doubao to AI University (74 Providers) On the Vibe Coders and Their Lies clerk: Auto-Summarize Your Claude Code Sessions AI Weekly — 2026/04/10–04/17 | The Model Lockdown Is Here, but the Toolchain Is the Real Battleground AI 週報 — 2026/04/10–2026/04/17 模型封鎖潮來了，但工具鏈才是真戰場 Maybe this is how Open-Source apps are born... 🚀 Fine-Tune LLMs with LoRA and QLoRA: 2026 Guide tRPC v11 + Next.js App Router: End-to-End Type Safety Without the Boilerplate ShadCN UI in 2026: Why I Stopped Installing Component Libraries and Started Owning My Components SaaS Billing in React Server Components: Stripe + Supabase Without a Single `useEffect` Join our DEV Weekend Challenge — $1,000 in Prizes Across TEN winners! Submissions Due April 20 at 6:59 AM UTC. Implementing FSRS Spaced Repetition in Flutter + Supabase — Adding Memory Science to an AI Learning App "I Texted My Localhost From the Train — Claude Code Fixed the Bug Before I Got Home" I Built a Sales Prep AI and It Went Deeper Than Expected Design to Code #2: One JSON, Eleven Outputs Solving the 100M-Row Problem: A Summary Table Pattern for High-Volume Push Notification Logs Flutter Web With Wasm: What Actually Changes For Developers I Built 50 Royalty-Free Soundtracks for My Side Project in a Weekend Using AI Music Generation The Vibe Coding Security Checklist: 7 Things to Check Before You Ship Stop Letting Googlebot Guess Fix Your React App's SEO Right Desconstruindo o Streaming do LinkedIn: Como Criar um Engine de Extração de Vídeo de Alta Performance com HLS e FFmpeg (EDA Part-1) EDA (Exploratory Data Analysis) Explained With Real Life — Why Looking at Your Data Is the Most Important Step in Machine Learning Brand Relationship Management at Scale: Our 4-Touch Outreach System for 200+ Brands Why String.fromEnvironment() Might Return an Empty String in Dart JGuardrails 1.0.0 — Hardening Java LLM Apps Against Jailbreaks, Toxicity, and Prompt Injection Plan and Schedule a Full Week of Threads Content From One Claude Conversation Coding Cat Oran Ep3, Five Tables Changed Everything Updated: BFF Pattern I'm done watching freelancers get buried by 200 proposals. So I'm building the alternative. This is my first post BFS Algorithm in Java Step by Step Tutorial with Examples Tracking LLM Pricing Monthly: An Open Dataset for 22 AI Models How We Measure Content ROI on a Comparison Site: Revenue Attribution Without Perfect Data Introducing Nova AI Ops: The AI-Native Operating System for SRE Teams I built a free desktop video downloader for Windows — Grabbit How Talkie OCR Helps Vision-Impaired & Dyslexic Users Read the World Around Them VRCFaceTracking安装和iPhone面捕配置教程，有bug Even CrowdStrike Can't See Your Agents The Automation Gold Rush: What n8n Workflows and Claude Are Opening Up for Developers Right Now

Shakil Alam · 2026-05-01 · via DEV Community

Part 3 of 4 — Laravel Architecture Patterns for Production ~9 min read · Security · Middleware · File handling A file upload is the moment you hand control to an untrusted user. Everything else in your application — form inputs, query parameters, JSON — is text. You validate it, sanitize it, store it in a database. A file upload is arbitrary binary data from a source you cannot verify, about to be written to your filesystem. The surface area is different. The failure modes are different. The consequences are different. Most tutorials cover the happy path: accept the file, store it, return a URL. The problem is never the happy path. Rename a PHP file to <code>image.jpg</code>. Upload it. Many Laravel applications accept it — because <code>getClientOriginalExtension()</code> returns <code>jpg</code> and <code>getClientMimeType()</code> returns <code>image/jpeg</code>. Both values the client provided. Neither verified by the server. This is how webshells get uploaded. This is how stored XSS gets planted in SVG files. This is the gap. The fix is seven independent checks, each closing a specific attack vector. The reason for seven — not one — is that no single check catches everything. A determined attacker probes each layer individually. Defense in depth means removing the easy paths at each layer. <h2> What you will build </h2> <ul> <li>A middleware that validates seven independent properties of every uploaded file, each one named and explained</li> <li>Server-side MIME detection using <code>finfo</code> — not the browser's claim</li> <li>A unique name strategy that removes user-controlled strings from your filesystem paths entirely</li> <li>A storage pattern where no uploaded file is ever directly reachable via HTTP</li> </ul> <h2> The validation pipeline </h2> <div class="highlight js-code-highlight"> <pre class="highlight plaintext"><code>Upload arrives │ ▼ 1. Filename sanitization blocks: path traversal · double extensions · null bytes · hidden files │ ▼ 2. Extension allowlist blocks: file types with no legitimate use case │ ▼ 3. Client MIME allowlist blocks: mismatched browser-reported content type │ ▼ 4. Server MIME detection (finfo reads actual bytes) blocks: renamed files · spoofed extensions │ ▼ 5. Extension ↔ MIME cross-check blocks: shell.php.jpg · mismatched pairs │ ▼ 6. File size limit blocks: denial-of-service via oversized uploads │ ▼ 7. Magic bytes check blocks: crafted files · polyglot attacks │ ▼ Stored as unique name in storage/ — never in public/ </code></pre> </div> <h2> The middleware </h2> The validation runs as middleware applied to upload routes. All validation aborts with <code>400</code> and a user-readable message: <div class="highlight js-code-highlight"> <pre class="highlight php"><code>class SecureFileUpload { // Only what your application genuinely needs — keep this narrow protected array $allowedExtensions = ['jpg', 'jpeg', 'png', 'pdf', 'docx', 'xlsx', 'csv']; protected array $allowedMimeTypes = [ 'image/jpeg', 'image/png', 'application/pdf', 'application/vnd.openxmlformats-officedocument.wordprocessingml.document', 'application/vnd.openxmlformats-officedocument.spreadsheetml.sheet', 'text/csv', 'text/plain', 'application/vnd.ms-excel', ]; // Maps each allowed extension to its permitted server-detected MIME types protected array $extensionMimeMap = [ 'jpg' => ['image/jpeg'], 'jpeg' => ['image/jpeg'], 'png' => ['image/png'], 'pdf' => ['application/pdf'], 'docx' => ['application/vnd.openxmlformats-officedocument.wordprocessingml.document'], 'xlsx' => ['application/vnd.openxmlformats-officedocument.spreadsheetml.sheet'], 'csv' => ['text/csv', 'text/plain', 'application/vnd.ms-excel'], ]; protected int $maxFileSizeKb; public function __construct() { $this->maxFileSizeKb = (int) config('files.upload_max_kb', 5120); // Default 5MB } public function handle(Request $request, Closure $next) { foreach ($request->allFiles() as $file) { $this->walkFiles($file); } return $next($request); } protected function walkFiles($file): void { if (is_array($file)) { foreach ($file as $f) { $this->walkFiles($f); } return; } if ($file instanceof UploadedFile) { $this->validateFile($file); } } // Orchestrates all seven checks in order protected function validateFile(UploadedFile $file): void { $rawName = $file->getClientOriginalName(); $extension = strtolower($file->getClientOriginalExtension()); $clientMime = $file->getClientMimeType(); // Check 1 — filename sanitization $this->sanitizeRawName($rawName); // Check 2 — extension allowlist if (!in_array($extension, $this->allowedExtensions, true)) { abort(400, "Files with .$extension extension are not supported."); } // Check 3 — client MIME allowlist if (!in_array($clientMime, $this->allowedMimeTypes, true)) { abort(400, 'Unrecognized file type. Ensure the file is not corrupted.'); } // Check 4 — server-side MIME detection $serverMime = $this->detectServerMime($file); // Check 5 — extension ↔ MIME cross-check if (!$this->isMimeAllowedForExtension($extension, $serverMime)) { abort(400, "Extension '.$extension' does not match the file's content. " . "Please ensure you have not renamed a file to a different extension."); } // Check 6 — size limit $sizeKb = (int) ceil($file->getSize() / 1024); if ($sizeKb > $this->maxFileSizeKb) { $maxMb = round($this->maxFileSizeKb / 1024, 1); $fileMb = round($sizeKb / 1024, 1); abort(400, "File too large. Maximum is {$maxMb}MB. Your file is {$fileMb}MB."); } // Check 7 — magic bytes $this->lightweightMagicChecks($file, $extension); } protected function isMimeAllowedForExtension(string $extension, string $serverMime): bool { $allowed = $this->extensionMimeMap[$extension] ?? []; return in_array($serverMime, $allowed, true); } } </code></pre> </div> The error messages matter. "Invalid file type" forces a support ticket. "Only one dot is allowed in the filename (e.g. <code>document.pdf</code>)" tells the user exactly what is wrong. When legitimate users trigger these checks by accident — and they will — specificity is the difference between a solvable problem and frustrated churn. <h2> Check 1 — Filename sanitization </h2> Before any content check, validate the name itself. Filenames are a distinct attack surface: <div class="highlight js-code-highlight"> <pre class="highlight php"><code>protected function sanitizeRawName(string $name): string { if (mb_strlen($name, 'UTF-8') > 100) { abort(400, 'Filename too long. Please use 100 characters or fewer.'); } // Path traversal: ../../etc/passwd if (preg_match('#[\\\\/]|^\.+$#', $name)) { abort(400, 'Filename cannot contain path separators.'); } // Null bytes and control characters if (preg_match('/[\x00-\x1F\x7F]/', $name)) { abort(400, 'Filename contains invalid characters. Please rename the file.'); } // Double-dot path traversal if (str_contains($name, '..')) { abort(400, "Filename cannot contain '..'."); } // Double-extension attack: shell.php.jpg // The browser sees .jpg, the server may execute .php if (substr_count($name, '.') > 1) { abort(400, "Only one dot allowed in the filename (e.g. 'document.pdf')."); } // Hidden files: .htaccess, .env if (str_starts_with($name, '.')) { abort(400, 'Filenames cannot start with a dot.'); } // Strict allowlist: letters, numbers, underscores, dashes, one dot, spaces if (!preg_match('/^[a-zA-Z0-9_\-\. ]+$/', $name)) { abort(400, 'Filename contains unsupported characters. Use letters, numbers, dashes, and underscores.'); } return $name; } </code></pre> </div> The double-extension rule is the highest-value check here. <code>shell.php.jpg</code> gets past a simple extension check because the last extension is <code>.jpg</code>. One dot, full stop. <h2> Checks 2 and 3 — Extension and client MIME allowlisting </h2> Both are necessary, even though neither is sufficient alone: <div class="highlight js-code-highlight"> <pre class="highlight php"><code>if (!in_array($extension, $this->allowedExtensions, true)) { abort(400, "Files with .$extension extension are not supported."); } if (!in_array($clientMime, $this->allowedMimeTypes, true)) { abort(400, 'Unrecognized file type. Ensure the file is not corrupted.'); } </code></pre> </div> Why both? An attacker who crafts a file with an allowed extension might supply an unexpected MIME type. An attacker who spoofs the MIME type might use a disallowed extension. Checking both raises the bar. Why keep the allowlist narrow? Every extension you permit is an attack surface you are accepting. If your application does not need <code>.svg</code> uploads, remove it. If it does not need <code>.zip</code>, remove it. The default should be minimal; expansion should require a specific business case. <h2> Check 4 — Server-side MIME detection </h2> This is the check that actually matters. The previous two trusted the client. This one reads the file: <div class="highlight js-code-highlight"> <pre class="highlight php"><code>protected function detectServerMime(UploadedFile $file): string { // finfo reads the file's actual bytes from the filesystem. // It does not care what the browser claimed. // A PHP file renamed to .jpg will be identified as text/x-php, not image/jpeg. $finfo = new \finfo(FILEINFO_MIME_TYPE); $mime = $finfo->file($file->getRealPath()); // Edge case: finfo correctly identifies CSV as text/plain (it is plain text). // But text/plain is not in the CSV slot on the allowlist. // The extension provides the context needed to resolve this. if ($mime === 'text/plain' && strtolower($file->getClientOriginalExtension()) === 'csv') { return 'text/csv'; } return (string) $mime; } </code></pre> </div> Why does the CSV edge case matter? A naive implementation would either reject all CSVs (wrong MIME type) or add <code>text/plain</code> to the global allowlist (which permits uploading arbitrary text files, including PHP in some environments). The explicit edge case handles the ambiguity without either problem. <h2> Check 5 — Cross-checking extension against detected MIME </h2> The check that closes the most common attack vector. The <code>extensionMimeMap</code> defined on the class is what makes this work — each allowed extension maps to the MIME types <code>finfo</code> legitimately returns for that format: <div class="highlight js-code-highlight"> <pre class="highlight php"><code>// CSV legitimately maps to multiple MIME types because different tools // and operating systems report it differently. The map accommodates // known variation without widening the gap for other formats. 'csv' => ['text/csv', 'text/plain', 'application/vnd.ms-excel'], </code></pre> </div> A file with extension <code>.jpg</code> whose <code>finfo</code>-detected MIME is <code>text/x-php</code> fails this check. The extension says one thing; the bytes say another. That inconsistency is the signal. <h2> Check 6 — Size limits </h2> The size check in <code>validateFile()</code> above reads the limit from config: <div class="highlight js-code-highlight"> <pre class="highlight php"><code>$this->maxFileSizeKb = (int) config('files.upload_max_kb', 5120); </code></pre> </div> Store the limit in <code>config('files.upload_max_kb')</code> rather than hardcoding it. This lets you adjust per environment — tighter on free tier plans, looser for premium users — without touching the middleware. The error message surfaces both the maximum and the actual file size so the user knows exactly what to change. <h2> Check 7 — Magic bytes </h2> The final layer reads the file's opening bytes directly: <div class="highlight js-code-highlight"> <pre class="highlight php"><code>protected function lightweightMagicChecks(UploadedFile $file, string $ext): void { $fp = @fopen($file->getRealPath(), 'rb'); $head = @fread($fp, 8) ?: ''; @fclose($fp); // Every valid PDF begins with %PDF- if ($ext === 'pdf' && !str_starts_with($this->bytesToAscii($head), '%PDF-')) { abort(400, 'This PDF appears to be corrupted or invalid.'); } // PNG has a fixed 8-byte signature defined in the spec if ($ext === 'png' && $head !== "\x89PNG\r\n\x1a\n") { abort(400, 'This PNG appears to be corrupted or invalid.'); } // JPEG starts with FF D8 FF if (in_array($ext, ['jpg', 'jpeg'], true)) { if (!str_starts_with($head, "\xFF\xD8\xFF")) { abort(400, 'This JPEG appears to be corrupted or invalid.'); } } // DOCX, XLSX, PPTX are ZIP archives with a PK header if (in_array($ext, ['docx', 'xlsx', 'pptx', 'zip'], true)) { if (!preg_match('/^PK(\x03\x04|\x05\x06|\x07\x08)/', $head)) { abort(400, 'This Office document appears corrupted or invalid.'); } } } protected function bytesToAscii(string $bytes): string { // Strip non-printable characters for string comparison (e.g. "%PDF-") return preg_replace('/[^\x20-\x7E]/', '', $bytes) ?? ''; } </code></pre> </div> Why 8 bytes? Magic byte signatures are typically 2–8 bytes. Reading the first 8 captures all common signatures without reading a meaningful chunk of the file. A note on coverage: this check covers the formats most commonly exploited — PDF, PNG, JPEG, and Office documents. It is a structural sanity check, not a full file parser. Its job is to catch files where the opening bytes contradict the claimed format. It does not replace the MIME detection and cross-check above — all seven checks work together. <h2> SVG: the format that deserves extra attention </h2> SVG files are XML. XML can contain <code><script></code> tags. A valid, well-formed SVG with embedded JavaScript is a stored XSS vector — if you accept it from one user and serve it inline to another, you have created a script injection path. The <a href="https://cheatsheetseries.owasp.org/cheatsheets/File_Upload_Cheat_Sheet.html" rel="noopener noreferrer">OWASP File Upload Cheat Sheet</a> covers this and other format-specific risks in depth. Three options: <ol> <li> Sanitize on upload — strip script tags and event handlers before storing. Complex to do correctly and easy to get wrong.</li> <li> Force download — serve SVGs with <code>Content-Disposition: attachment</code>, preventing inline browser rendering and therefore script execution.</li> <li> Remove SVGs from the allowlist — the safest option if there is no specific business requirement.</li> </ol> If you do not have a defined reason to accept user-uploaded SVGs, option 3 takes one line and eliminates the risk entirely. <h2> Always generate a unique name before saving </h2> Regardless of the validation outcome, the filename used for storage should never be the one the user provided: <div class="highlight js-code-highlight"> <pre class="highlight php"><code>public static function uniqueName($file, $postfix = ''): string { if ($file instanceof UploadedFile) { $file = $file->getClientOriginalName(); } $extension = self::getExtension($file); $nameWithoutExtension = Str::of($file) ->replaceLast(".$extension", '') ->replace(' ', '_'); if ($nameWithoutExtension->length() > 100) { $nameWithoutExtension = $nameWithoutExtension->substr(0, 100); } $nameWithoutExtension = $nameWithoutExtension . $postfix; if (!method_exists(Str::class, 'transliterate')) { $nameWithoutExtension = preg_replace('/[^\x20-\x7E]/', '_', $nameWithoutExtension); return $nameWithoutExtension . '_' . uniqid() . '.' . $extension; } return Str::transliterate($nameWithoutExtension) . '_' . uniqid() . '.' . $extension; } </code></pre> </div> <code>uniqid()</code> is microsecond-based and not cryptographically random. It is sufficient here because it combines with the sanitized filename prefix — two simultaneous uploads of <code>report.pdf</code> produce <code>report_6601a1f3b8e42.pdf</code> and <code>report_6601a1f3b8e43.pdf</code>, with no collision. If your application requires stronger uniqueness guarantees — for example, if filenames are ever used as access tokens — substitute <code>Str::uuid()</code>. That is a one-line change and the stronger default. <code>uniqueName()</code> depends on two helper methods. Here are simple implementations to drop into the same <code>File</code> class: <div class="highlight js-code-highlight"> <pre class="highlight php"><code>public static function getExtension(string|UploadedFile $file): string { if ($file instanceof UploadedFile) { return strtolower($file->getClientOriginalExtension()); } return strtolower(pathinfo($file, PATHINFO_EXTENSION)); } public static function getHash(UploadedFile $file): string { // SHA-256 of the file contents — useful for detecting duplicate uploads // and verifying file integrity when serving back to users return hash_file('sha256', $file->getRealPath()); } </code></pre> </div> And in the media trait: <div class="highlight js-code-highlight"> <pre class="highlight php"><code>public function addMediaAs( UploadedFile $file, string $collection = 'default', string $name = null ): Media { $uniqueName = $name ?? File::uniqueName($file); return $this->medias()->create([ 'name' => $file->getClientOriginalName(), // Original name for display 'file_name' => $uniqueName, // Unique name for storage 'mime_type' => $file->getMimeType(), 'path' => $file->storeAs( $this->getMediaPath($collection), $uniqueName, $this->getMediaDisk($collection) ), 'disk' => $this->getMediaDisk($collection), 'file_hash' => File::getHash($file), 'collection' => $collection, 'size' => $file->getSize(), ]); } </code></pre> </div> Why keep the original name in <code>name</code> but use the unique name for <code>path</code>? The display name — shown to the user in the UI — should be what they uploaded. The storage path should have no connection to any user-provided string. The two concerns are separate. <h2> Where files live after validation </h2> Store outside the web root — in <code>storage/</code> — and serve through a controller that enforces authorization: <div class="highlight js-code-highlight"> <pre class="highlight php"><code>public function stream(Media $media): StreamedResponse { // Authorization on every file access — no direct URL bypasses this $this->authorize('view', $media); return Storage::disk($media->disk)->response( $media->path, $media->name, ['Content-Type' => $media->mime_type] ); } </code></pre> </div> Why never <code>public/</code>? A file in <code>public/</code> is directly reachable via HTTP — no authorization, no application code in the path. If a file with a server-executable extension reaches <code>public/</code> because validation has layers that can be circumvented, it can be executed by guessing its URL. Files in <code>storage/</code> have no direct URL. Everything goes through the controller. <h2> Registering the middleware </h2> Apply <code>SecureFileUpload</code> to upload routes only — never globally, since running all seven checks on every request that has no file would add overhead for no reason. <div class="highlight js-code-highlight"> <pre class="highlight php"><code>// Laravel 11 — routes/web.php or routes/api.php Route::post('/upload', [MediaController::class, 'store']) ->middleware(\App\Http\Middleware\SecureFileUpload::class); // Or as a group if you have multiple upload endpoints Route::middleware(\App\Http\Middleware\SecureFileUpload::class)->group(function () { Route::post('/media/upload', [MediaController::class, 'store']); Route::post('/documents/upload', [DocumentController::class, 'store']); }); // Laravel 10 and earlier — same route syntax works, or alias it // in app/Http/Kernel.php under $routeMiddleware: // 'secure.upload' => \App\Http\Middleware\SecureFileUpload::class, // Then use ->middleware('secure.upload') in your routes </code></pre> </div> <blockquote> The key insight from this article: No single file validation check catches everything. <code>getClientMimeType()</code> trusts the browser. <code>getClientOriginalExtension()</code> trusts the browser. Only <code>finfo</code> reads the actual bytes. Seven independent checks layered together — each blocking a different attack path — is what makes upload validation meaningfully secure rather than just present. </blockquote> <h2> Before you ship — checklist </h2> <ul> <li>[ ] <code>SecureFileUpload</code> middleware is applied to upload routes only — not globally</li> <li>[ ] <code>allowedExtensions</code> and <code>allowedMimeTypes</code> are minimal — only what the application genuinely needs</li> <li>[ ] <code>finfo</code> server-side MIME detection is running (not just trusting <code>getClientMimeType()</code>)</li> <li>[ ] <code>extensionMimeMap</code> covers every extension in <code>allowedExtensions</code> </li> <li>[ ] Magic bytes check covers JPEG in addition to PDF, PNG, and Office formats</li> <li>[ ] SVG is either removed from the allowlist or served with <code>Content-Disposition: attachment</code> </li> <li>[ ] <code>File::uniqueName()</code> is called before every <code>storeAs()</code> — original filename never used as storage path</li> <li>[ ] Files are stored in <code>storage/</code> — nothing uploaded goes into <code>public/</code> </li> <li>[ ] File access goes through a controller that calls <code>$this->authorize()</code> </li> </ul> Previous: <a href="https://blog.shakiltech.com/laravel-queue-architecture/" rel="noopener noreferrer">Part 2 — Queue Architecture</a>

此内容由惯性聚合(RSS阅读器)自动聚合整理，仅供阅读参考。原文来自 — 版权归原作者所有。

推荐订阅源

DEV Community