VAPT: File Upload Validation and Security Hardening #288
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
π Description
JIRA ID: AMM-1519
Please provide a summary of the change and the motivation behind it. Include relevant context and details.
β Type of Change
βΉοΈ Additional Information
Summary
This PR introduces changes as part of VAPT (Vulnerability Assessment & Penetration Testing) remediation to strengthen file upload handling and ensure secure processing.
Changes Implemented
1.Enforced allowed file extensions via environment property allowed.file.extensions.
2. Extracted and validated file extensions both from filename and payload.
3. Enforced strict extension matching between filename and payload.
4. Rejected uploads if file extension is missing, mismatched, or not in the allowed list.
5. Normalized file names by removing risky/special characters (', $, , /, ;, etc.) to prevent path traversal / injection attacks.
6. Logged extension validation, checksum, and file details for traceability.
7. Generated MD5 checksum for file integrity validation.
8. Secured file write to a temp directory before further processing.
Configuration
Added allowed.file.extensions=msg,pdf,png,jpeg,doc,docx,xlsx,xls,csv,txt to configuration.
Impact
Prevents malicious file uploads (e.g., scripts, executables).
Mitigates risks of path traversal, injection, and arbitrary file execution.
Provides safer handling of uploaded files with checksum verification.
Testing
Verified uploads succeed for allowed extensions.
Verified rejection for disallowed/mismatched extensions.
Verified checksum generation and logging.