File upload validation enforced server-side

Unrestricted file uploads (CWE-434) allow attackers to upload executable scripts disguised as images, exhaust server storage with oversized files, or store malware for later retrieval. OWASP A04 (Insecure Design) specifically flags accepting files based solely on client-supplied Content-Type as a design flaw. NIST 800-53 SI-10 requires input validation including file content. A PHP file uploaded to a web-accessible directory and served by Apache becomes a remote code execution vector. Relying on the Content-Type header is trivially bypassed: any HTTP client can send Content-Type: image/png with an executable payload.

Validate file type by inspecting magic bytes — not the client-provided Content-Type — and store uploads in external blob storage, never in the web root:

import { fileTypeFromBuffer } from 'file-type'

const ALLOWED = new Set(['image/jpeg', 'image/png', 'image/webp'])
const MAX_BYTES = 5 * 1024 * 1024  // 5 MB

const buffer = Buffer.from(await file.arrayBuffer())
if (buffer.byteLength > MAX_BYTES) return Response.json({ error: 'File too large' }, { status: 413 })

const detected = await fileTypeFromBuffer(buffer)
if (!detected || !ALLOWED.has(detected.mime)) {
  return Response.json({ error: 'File type not permitted' }, { status: 415 })
}

// Store in Vercel Blob / S3 — never in public/
await put(`uploads/${crypto.randomUUID()}.${detected.ext}`, buffer, { contentType: detected.mime })