OWASP File Upload Cheat Sheet

1. File Upload Threats

   Malicious files, webshells and public file retrieval risks.

2. Extension Validation

   Allow-listing extensions and handling double extensions.

3. Content-Type Validation

   Why client-supplied Content-Type cannot be trusted.

4. File Signature Validation

   Magic byte checks.

5. Filename Safety

   Renaming files and preventing path traversal.

6. File Content Validation

   Image rewriting, malware scanning and CDR.

7. File Storage Location

   Storing outside the webroot or on separate hosts.

8. User Permissions

   Authentication and authorization for uploads.

9. Filesystem Permissions

   Least-privilege storage and non-executable directories.

10. Upload and Download Limits

    Size and rate limits to prevent denial of service.

Each section links to the official page. Titles and summaries by Extra Credit; the docs belong to their authors.