Harden filename handling

[cincuranet]

No description provided.

[guardrex]

Hi @cincuranet ... Is it ok if I review this tomorrow (Thursday) morning? I'm OOF for most of the rest of today.

[cincuranet]

@guardrex Yes.

[guardrex]

Thanks ... we'll get this merged first thing tomorrow morning.

[guardrex]

I'm BACK! Sorry for the delay. I'll look now.

[guardrex]

UPDATED ...

Copilot threw a couple of wrenches into the works here! 😄

One thing to note about this process of using client-supplied filenames is that it often isn't considered a best practice in the first place. In most cases IMO, it's best to generate a random filename with the name provided by the client only used as a human-readable identifier. Now, I don't think that we necessarily need to get into the weeds with that, but it really comes down to how @wadepickett feels about it.

Anyway, Wade will take over from here. The article that this code goes with maps to an article that he works with.

Wade, I have some basics along these lines in the Blazor file uploads article at ...

https://learn.microsoft.com/en-us/aspnet/core/blazor/file-uploads?view=aspnetcore-10.0#file-name-security

[Copilot]

Pull request overview

This PR hardens file handling in the static-file authorization samples and the minimal API IFormFile sample by adding server-side validation for requested/stored file names.

Changes:

• Added a route-parameter validation step for /files/{fileName} in the StaticFileAuth samples (8.0 and 9.0).
• Introduced GeneratedRegex-based helpers (FileNameValidator, MyUtils.IsValidFileName) to validate stored/uploaded file names.
• Added server-side validation checks in the minimal API /upload endpoints to prevent bypassing client-side patterns.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 5 comments.

File	Description
fundamentals/static-files/9.0/StaticFileAuth/Program.cs	Adds stored-name validation for download requests and introduces a generated-regex validator.
fundamentals/static-files/8.0/StaticFileAuth/Program.cs	Same validation/validator additions as the 9.0 sample.
fundamentals/minimal-apis/samples/IFormFile/Program.cs	Adds server-side filename validation before saving uploads (both snippet variants).
fundamentals/minimal-apis/samples/IFormFile/MyUtils.cs	Adds generated-regex filename validation helper used by the upload endpoints.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[wadepickett]

Approved. Great work @cincuranet, thanks!

I also guardrex rasied issues were addresed: The latest code now validates fileSaveName at upload time with the same regex used by the download endpoint (lines 162–165), returning BadRequest if it doesn't match. So generation and validation are now guaranteed to be consistent.