# File Handling Uploads

> >

- **Type:** Skill
- **Install:** `agentstack add skill-redhatproductsecurity-prodsec-skills-file-handling-uploads`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [RedHatProductSecurity](https://agentstack.voostack.com/s/redhatproductsecurity)
- **Installs:** 0
- **Category:** [Agent Skills](https://agentstack.voostack.com/c/agent-skills)
- **Latest version:** 0.1.0
- **License:** Apache-2.0
- **Upstream author:** [RedHatProductSecurity](https://github.com/RedHatProductSecurity)
- **Source:** https://github.com/RedHatProductSecurity/prodsec-skills/tree/main/module/skills/file-handling-uploads

## Install

```sh
agentstack add skill-redhatproductsecurity-prodsec-skills-file-handling-uploads
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# File Upload Security

Implement defense-in-depth for file uploads through multi-layered validation, secure storage, proper access controls, and monitoring. Never rely on a single validation method.

## Extension Validation

- Allow-list extensions only for business-critical functionality.
- Apply input validation before validating extensions.
- Avoid double extensions (e.g., `.jpg.php`) and null byte injection (e.g., `.php%00.jpg`).
- Use allow-list approach rather than deny-list for file extensions.
- Validate extensions after decoding the filename to prevent bypass attempts.

## Content Type and File Signature Validation

- Never trust client-supplied Content-Type headers -- they can be spoofed.
- Validate file signatures (magic numbers) in conjunction with Content-Type checking.
- Implement allow-list approach for MIME types as a quick protection layer.
- Use file signature validation but not as a standalone security measure.

## Filename Security

- Generate random filenames (UUID/GUID) instead of using user-supplied names.
- If user filenames are required, implement maximum length limits.
- Restrict characters to alphanumeric, hyphens, spaces, and periods only.
- Prevent leading periods (hidden files) and sequential periods (directory traversal).
- Avoid leading hyphens or spaces for safer shell script processing.

## File Content Validation

- For images, apply image rewriting techniques to destroy malicious content.
- For Microsoft documents, use Apache POI for validation.
- Avoid ZIP files due to numerous attack vectors.
- Implement manual file review in sandboxed environments when resources allow.
- Integrate antivirus scanning and Content Disarm and Reconstruct (CDR) for applicable file types.

## Storage Security

- Store files on different servers for complete segregation when possible.
- Store files outside webroot with administrative access only.
- If storing in webroot, set write-only permissions with proper access controls.
- Use application handlers that map IDs to filenames for public access.
- Consider database storage for specific use cases with DBA expertise.

## Access Control and Authentication

- Require user authentication before allowing file uploads.
- Implement proper authorization levels for file access and modification.
- Set filesystem permissions on the principle of least privilege.
- Scan files before execution if execution permission is required.

## Upload and Download Limits

- Set proper file size limits for upload protection.
- Consider post-decompression size limits for compressed files.
- Implement request limits for download services to prevent DoS attacks.
- Use secure methods to calculate ZIP file sizes safely.

## Additional Security Measures

- Protect file upload endpoints from CSRF attacks.
- Keep all file processing libraries securely configured and updated.
- Implement logging and monitoring for upload activities.
- Provide user reporting mechanisms for illegal content.
- Use secure extraction methods for compressed files.

## Implementation Checklist

- [ ] Extension allow-list enforced; double extension and null byte attacks blocked
- [ ] Magic number validation in addition to Content-Type checking
- [ ] Random filenames generated; user-supplied names sanitized or rejected
- [ ] Image rewriting and/or CDR applied to uploaded content
- [ ] Files stored outside webroot with least-privilege permissions
- [ ] Authentication required for uploads; authorization for access
- [ ] Size limits enforced for uploads and decompressed content
- [ ] CSRF protection on upload endpoints; logging enabled

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [RedHatProductSecurity](https://github.com/RedHatProductSecurity)
- **Source:** [RedHatProductSecurity/prodsec-skills](https://github.com/RedHatProductSecurity/prodsec-skills)
- **License:** Apache-2.0

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** no
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** no
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/skill-redhatproductsecurity-prodsec-skills-file-handling-uploads
- Seller: https://agentstack.voostack.com/s/redhatproductsecurity
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.