I am developing a website that accepts uploading a specific type of data. In particular, the data must be a human-readable text string in the order of thousands of characters. The data is input into a text field that is then uploaded to the server when the user clicks a button.
I want to ensure that all data entered into the text area conforms to the accepted format, i.e., I want to filter out any content that malicious users might upload, such as images, video, executables (or any binary for that matter), etc... How can I achieve this goal? My current ideas are the following:
Backend (written in Java)
- Data stream content guessing (magic characters, identifiers at the beginning of the stream),
- File type probing (by considering the entire uploaded stream as a single file),
- MIME type probing.
- Content length verfication (data must not be huge, i.e., > x KB/MB),
What other options are there to minimize the risk of users uploading unwanted content, or in general content that is not of a given type?