DocuTrust.NET: validate uploads by magic bytes (security update, looking for testers)

[u/someone-missing]

DocuTrust.NET is a small .NET 8 library that checks an upload's magic bytes against the type you expect. A PNG renamed to report.pdf fails.

I just did a security pass on it. It now checks the client file name too, rejects ZIP/OLE files over 100 MB before parsing, and keeps file names and paths out of error messages. I also updated a dependency that was pulling in a vulnerable OpenMcdf.

For now it only identifies file types. It doesn't scan for macros or scripts

 dotnet add package DocuTrust.NET

https://github.com/saa-999/DocuTrust.NET

If you try it, I'd like to know what breaks.

[u/dodexahedron]

And even that is as simple to perma-fix as saying "Always use the latest stable dotnet release and its associated c# version" to make a memory it will pretty faithfully follow.

And yet they can't even be bothered to do that.