Web Form File Validation Implementation Checklist

Implementing file upload functionality involves numerous security considerations and many easily overlooked pitfalls. This article explains a checklist for implementing file uploads that operate safely in production environments.

Checklist Overview

1. File size validation

• <input type="checkbox" disabled> Upload limit is defined in bytes (no confusion between MB and MiB)
• <input type="checkbox" disabled> For PHP, both <code>upload_max_filesize</code> and <code>post_max_size</code> are configured
• <input type="checkbox" disabled> For Nginx, <code>client_max_body_size</code> includes an allowance for multipart overhead
• <input type="checkbox" disabled> Error handling is in place for when <code>$_FILES['file']['error']</code> is UPLOAD_ERR_INI_SIZE / UPLOAD_ERR_FORM_SIZE
• <input type="checkbox" disabled> Minimum file size check is in place (excluding 0-byte files)

 $maxBytes) {
        throw new \RuntimeException(sprintf(
            'ファイルサイズ（%s）が上限（%s）を超えています',
            number_format($file['size']),
            number_format($maxBytes)
        ));
    }
}

2. File format validation (MIME type)

• <input type="checkbox" disabled> The <code>Content-Type</code> (<code>$_FILES['file']['type']</code>) sent from the client is not trusted
• <input type="checkbox" disabled> Server-side MIME type validation is performed using <code>finfo</code> / <code>mime_content_type()</code>
• <input type="checkbox" disabled> A whitelist of allowed MIME types is defined

file($file['tmp_name']);

if (!in_array($mimeType, $allowed, true)) {
    throw new \RuntimeException('許可されていないファイル形式です: ' . $mimeType);
}

3. File extension validation

• <input type="checkbox" disabled> A whitelist of file extensions is defined (whitelist, not blacklist)
• <input type="checkbox" disabled> Double extensions (e.g., <code>shell.php.jpg</code>) are detected and rejected
• <input type="checkbox" disabled> Case normalization is applied during validation (treating <code>.JPG</code> and <code>.jpg</code> as the same)

 2) {
    throw new \RuntimeException('不正なファイル名です');
}

$ext = strtolower(pathinfo($originalName, PATHINFO_EXTENSION));
if (!in_array($ext, $allowed, true)) {
    throw new \RuntimeException('許可されていない拡張子です: ' . $ext);
}

4. Magic byte (file signature) validation

• <input type="checkbox" disabled> Magic bytes are validated for critical files (e.g., excluding executable files)