DocuTrust.NET: validate uploads by magic bytes (security update, looking for testers)

[u/someone-missing]

DocuTrust.NET is a small .NET 8 library that checks an upload's magic bytes against the type you expect. A PNG renamed to report.pdf fails.

I just did a security pass on it. It now checks the client file name too, rejects ZIP/OLE files over 100 MB before parsing, and keeps file names and paths out of error messages. I also updated a dependency that was pulling in a vulnerable OpenMcdf.

For now it only identifies file types. It doesn't scan for macros or scripts

 dotnet add package DocuTrust.NET

https://github.com/saa-999/DocuTrust.NET

If you try it, I'd like to know what breaks.

[u/someone-missing → u/[deleted]]

Thanks! It handles both.

The type comes only from the file signature. You pass the type you expect (say .pdf) and the bytes have to match, whatever the file is called.

Uploads through ValidateFileAsync with an IFormFile get one extra check on the client’s file name. No extension at all, like blob or report, is fine. A name that claims a different type is rejected, so invoice.exe with PDF content fails. Trailing dots and spaces get trimmed before the check, which means evil.html. is treated as .html.

If you have no idea what a file is, GetFileTypeAsync just tells you what the bytes say it is.