Reject renamed HTML files masquerading as image uploads
The practical problem
An attacker can supply an HTML payload named picture.png and forge its Content-Type. An extension and MIME header are untrusted claims.
Implementation protocol
Allowlist file extensions, inspect magic bytes and validate using an actual image decoder under bounded dimensions and memory. Re-encode when appropriate.
Worked scenario
A claimed image/png beginning with HTML must fail before it reaches any public path. A valid PNG header with broken payload should also be rejected.
What could go wrong
File signatures are not complete safety guarantees.
Acceptance criteria
Test malformed formats, polyglot inputs, decompression bombs and oversized dimensions.
Source material and evidence boundaries
For the topic Reject renamed HTML files masquerading as image uploads, use the sources listed below to check relevant methods. Any worked figures illustrate a scenario, not measured MojPlayWin performance. Consult the shared evidence standards before applying the method.