Secure File Uploads: Test the Full Storage and Download Lifecycle

An upload endpoint is only the entrance to a file-handling system. Uploaded content may later be scanned, converted, indexed, shared, and downloaded. Each stage introduces a decision about trust, resources, and access.

Define what the feature actually accepts

A fictional expense application needs JPEG or PNG receipt images and PDF invoices. Write down the allowed formats, maximum size, owner, retention period, and intended download audience. Avoid accepting additional formats merely because the browser's file picker permits them.

The client-provided filename and content type are untrusted. Validate using a combination of an extension allowlist, content inspection, and appropriate parsing. No single check establishes that every possible file is harmless.

Keep storage separate from execution

Generate server-owned storage names and store originals outside executable web paths. Preserve a display filename separately when needed. Download private files through an authorization-aware handler rather than exposing a predictable public location.

For previews and conversions, use restricted workers with limited permissions and resource budgets. Parsing libraries are part of the attack surface and need maintenance. Antivirus or content scanning can add protection, but a scan result should not erase the other controls.

Use benign test fixtures

In an approved environment, upload normal files, a harmless file with a misleading extension, an oversized fixture within agreed limits, and duplicate display filenames. Observe whether errors are clear and whether failed uploads leave orphaned content.

Use two synthetic accounts to verify that one cannot download, preview, replace, or delete the other's private receipt. Check thumbnail and converted-file routes separately. A secure original-file endpoint does not guarantee secure derived artifacts.

Avoid decompression bombs or deliberately resource-exhausting documents unless a separate controlled resilience exercise explicitly includes them.

Check the lifecycle after acceptance

If scanning is asynchronous, confirm that files remain unavailable until the required checks finish. Review what happens when a scanner times out or a conversion fails. An operational failure should not silently change a file from untrusted to approved.

After deletion, verify that applicable originals, thumbnails, and temporary processing artifacts are removed according to the documented retention policy. Record any intentional retention in backups separately.

The OWASP File Upload Cheat Sheet provides defensive guidance for validation, storage, and file processing.