How can I ensure that data uploaded to my server via my website is of a specific type?

Question

I am developing a website that accepts uploading a specific type of data. In particular, the data must be a human-readable text string in the order of thousands of characters. The data is input into a text field that is then uploaded to the server when the user clicks a button.

I want to ensure that all data entered into the text area conforms to the accepted format, i.e., I want to filter out any content that malicious users might upload, such as images, video, executables (or any binary for that matter), etc... How can I achieve this goal? My current ideas are the following:

Backend (written in Java)

• Data stream content guessing (magic characters, identifiers at the beginning of the stream),
• File type probing (by considering the entire uploaded stream as a single file),
• MIME type probing.

Frontend (running on Tomcat, plain old HTML + Javascript)

• Content length verfication (data must not be huge, i.e., > x KB/MB),
• Javascript MIME type verification (don't have any experience with any libraries for this...).

What other options are there to minimize the risk of users uploading unwanted content, or in general content that is not of a given type?

Answer 1

Of course do the check on the backend. The user may manipulate the frontend all they wish.

It is a good idea to add such check on the front-end too, if there is a realistic chance that the user may make an accidental mistake, and the back-end cannot provide enough information to the front-end to handle the error (e.g. if the back-end returns 403/forbidden without any additional info). Otherwise, don't bother.

As for the check on the back-end: is it enough that the input is ASCII, or does it need to be Unicode? If former: just refuse anything with characters outside of the range 32-127+ CR and LF. If the latter, I am worried that text written in some languages will often look like a binary... You can try to demand that it is utf-8 encoded, and then check, on the back-end (by simply decoding it) that it is valid utf-8. As a by-product, you are getting it in a String, at which point I guess your back-end will be able to handle it.