2026-09-06 · 8 min read
- http
- uploads
- security
Multipart form data carries fields and files in one byte stream separated by a boundary. Each file part commonly has a Content-Disposition header with a field name and optional filename metadata, followed by a declared media type and the file bytes.
Reliable upload handling requires independent rules for HTTP parsing, decoded metadata, content validation, storage identity, and later presentation. A client-provided filename is never a trustworthy filesystem path.
Let one parser own the byte grammar
Use a maintained multipart parser with strict request and part limits. The boundary in the Content-Type header must match every delimiter in the body, including the closing delimiter, and header lines must follow the parser's supported HTTP grammar.
- Limit total bytes, part count, header bytes, field bytes, and file bytes.
- Reject malformed or truncated boundaries instead of guessing.
- Stream large parts when possible rather than buffering the complete body.
- Keep raw upload data out of application and proxy logs.
Decode filename metadata deliberately
Clients may send a quoted filename parameter, an extended encoded parameter, both, or neither. Define which forms and character encodings the service accepts, how conflicts are resolved, and what fallback display name is used.
Decoding a filename is not sanitization. Reject control characters, separators, reserved device names where relevant, invisible ambiguity, and values beyond a documented length. Normalize only if the product has chosen a Unicode policy.
Separate identity, validation, and presentation
Generate a server-side object key unrelated to the supplied name. Validate content size and permitted type from bytes using the product's security policy; do not trust an extension or Content-Type value alone.
- Store the sanitized display name as metadata, not as an executable path.
- Apply authorization before upload and before every later download.
- Escape names for HTML and encode download headers according to their context.
- Define quarantine, scanning, retention, and partial-upload cleanup.
Build safe interoperability fixtures
Use Flashman's URL tool to inspect encoded parameters, Base64 for synthetic byte samples, hash to identify public fixtures, JSON formatter for sanitized parser output, and HTML entities tool to demonstrate presentation escaping. These utilities do not validate uploaded content.
Test ASCII and Unicode names, spaces, quotes, separators, duplicate parameters, missing names, empty files, repeated fields, malformed boundaries, exact size limits, cancellation, and every browser or SDK the service supports.