I am developing a website that accepts uploading a specific type of data. In particular, the data must be a human-readable text string in the order of thousands of characters. The data is input into a text field that is then uploaded to the server when the user clicks a button.
I want to ensure that all data entered into the text area conforms to the accepted format, i.e., I want to filter out any content that malicious users might upload, such as images, video, executables (or any binary for that matter), etc... How can I achieve this goal? My current ideas are the following:
Backend (written in Java)
- Data stream content guessing (magic characters, identifiers at the beginning of the stream),
- File type probing (by considering the entire uploaded stream as a single file),
- MIME type probing.
Frontend (running on Tomcat, plain old HTML + Javascript)
- Content length verfication (data must not be huge, i.e., > x KB/MB),
- Javascript MIME type verification (don't have any experience with any libraries for this...).
What other options are there to minimize the risk of users uploading unwanted content, or in general content that is not of a given type?
The data is input into a text field
, but also talk about MIME types and file types. If it's just a text field, all you would need to do is some sort of validation on that string, no?