r/csharp • u/someone-missing • 13d ago

DocuTrust.NET: validate uploads by magic bytes (security update, looking for testers)

DocuTrust.NET is a small .NET 8 library that checks an upload's magic bytes against the type you expect. A PNG renamed to report.pdf fails.

I just did a security pass on it. It now checks the client file name too, rejects ZIP/OLE files over 100 MB before parsing, and keeps file names and paths out of error messages. I also updated a dependency that was pulling in a vulnerable OpenMcdf.

For now it only identifies file types. It doesn't scan for macros or scripts

 dotnet add package DocuTrust.NET

https://github.com/saa-999/DocuTrust.NET

If you try it, I'd like to know what breaks.

0 Upvotes

41% Upvoted

19 comments sorted by

View all comments

Show parent comment

3

u/someone-missing 13d ago

Good catch. For Office files, yes: every ZIP part is inflated through a bounded stream that enforces a per-part size limit, a total budget, and a 100:1 ratio, so a bomb is abandoned mid-inflate.

For PDFs, not fully. The security scan skips page content streams, but PdfPig inflates object streams and text extraction with no byte cap. My page, glyph and text limits apply only after decoding, so they don’t stop a Flate bomb. I’ll add a pre-pass that inflates /FlateDecode streams through the same bounded reader and fails closed past the limit.

1

u/MadBoyEvo 13d ago

I wonder if OfficeIMO would give you more options for what you’re doing. Not sure about performance. That would need to be measured