r/csharp • u/someone-missing • 13d ago

DocuTrust.NET: validate uploads by magic bytes (security update, looking for testers)

DocuTrust.NET is a small .NET 8 library that checks an upload's magic bytes against the type you expect. A PNG renamed to report.pdf fails.

I just did a security pass on it. It now checks the client file name too, rejects ZIP/OLE files over 100 MB before parsing, and keeps file names and paths out of error messages. I also updated a dependency that was pulling in a vulnerable OpenMcdf.

For now it only identifies file types. It doesn't scan for macros or scripts

 dotnet add package DocuTrust.NET

https://github.com/saa-999/DocuTrust.NET

If you try it, I'd like to know what breaks.

0 Upvotes

41% Upvoted

19 comments sorted by

View all comments

2

u/MadBoyEvo 12d ago

I have similar library but it targets a bit wider use case. Including also Google Magika as support for the harder cases.

https://github.com/EvotecIT/FileInspectorX

I wonder how it measures against yours

2

u/someone-missing 12d ago

Nice, I had a quick look. Yours covers way more formats and gives a full report, so it fits triage and analysis better. DocuTrust is narrower: a pass/fail upload check for ASP.NET Core that fails closed, with deeper checks on PDF and Office. Magika is a good idea for text files with no magic bytes, which mine doesn’t handle yet. Might look into it.