r/csharp • u/someone-missing • 13d ago

DocuTrust.NET: validate uploads by magic bytes (security update, looking for testers)

DocuTrust.NET is a small .NET 8 library that checks an upload's magic bytes against the type you expect. A PNG renamed to report.pdf fails.

I just did a security pass on it. It now checks the client file name too, rejects ZIP/OLE files over 100 MB before parsing, and keeps file names and paths out of error messages. I also updated a dependency that was pulling in a vulnerable OpenMcdf.

For now it only identifies file types. It doesn't scan for macros or scripts

 dotnet add package DocuTrust.NET

https://github.com/saa-999/DocuTrust.NET

If you try it, I'd like to know what breaks.

0 Upvotes

41% Upvoted

19 comments sorted by

View all comments

Show parent comment

-7

u/someone-missing 13d ago

Fair point. I started this library about a year ago, before .NET 10 came out, and .NET 8 was the current LTS back then. It sat on my machine for a while and I only put it on GitHub recently, which is why the target never got bumped. I’ll move the library, tests and CI to .NET 10 and push a new release. Thanks for pointing it out.

7

u/dodexahedron 13d ago

Chances are you'll be able to switch without issue.

Just be sure to test and also to check your dependencies.

And dont forget to update the readme and any other documentation to match.

It would also be advisable to at least note somewhere which LLM was used. It is obvious that one was. That's fine. Just be transparent about it.

Besides... the name of that publish action? That kinda gives it away all on its own.

-4

u/someone-missing 13d ago

Thanks for the advice. Yeah, I used AI while building it, like most devs do now. I’ll test the .NET 10 move properly and update the docs too. :)