File Upload Security in Depth: Magic Byte Checks, Re-encoding Images, Malware Scanning, Zip Bombs and Direct-to-Blob Uploads with SAS
Both the name and the Content-Type of an uploaded file are text written by the client; safety comes from validating the content and keeping the file in quarantine until it is approved. On Bookstore we build, end to end, magic byte checks with an allowlist, re-encoding that defuses polyglots, zip bomb and Zip Slip limits for EPUBs, scanning with ClamAV and Defender for Storage, short-lived single-blob SAS uploads and signed download links.
15 Nov 2026
·
15 min
·
8
