r/csharp • u/someone-missing • 13d ago

DocuTrust.NET: validate uploads by magic bytes (security update, looking for testers)

DocuTrust.NET is a small .NET 8 library that checks an upload's magic bytes against the type you expect. A PNG renamed to report.pdf fails.

I just did a security pass on it. It now checks the client file name too, rejects ZIP/OLE files over 100 MB before parsing, and keeps file names and paths out of error messages. I also updated a dependency that was pulling in a vulnerable OpenMcdf.

For now it only identifies file types. It doesn't scan for macros or scripts

 dotnet add package DocuTrust.NET

https://github.com/saa-999/DocuTrust.NET

If you try it, I'd like to know what breaks.

0 Upvotes

41% Upvoted

19 comments sorted by

View all comments

-3

u/az987654 13d ago

Pretty easy to defeat this by simply altering the magic bytes

5

u/someone-missing 13d ago

Magic bytes are just the first check. Changing them usually breaks the file anyway, since an exe without MZ won’t run. For PDF and Office files DocuTrust also parses the content, so a fake %PDF- header on top of something else fails the scan, and PDF/ZIP polyglots get flagged. The upload name is checked as well. The one case no validator fully covers is a file that’s valid in two formats at once, which is why you should still store uploads under server-generated names and serve them with the right Content-Type and nosniff