sast-fileupload

Name: sast-fileupload
Author: utkusen

40installs56forks

How to install sast-fileupload?

utkusen/sast-skills/sast-fileupload

$npx -y skills add utkusen/sast-skills --skill sast-fileupload

Installs into the current project.

Summary

Detect insecure file upload vulnerabilities in a codebase using a three-phase approach: discovery (find all upload sites), batched verify (check extension bypass and related issues in parallel subagents, 3 sites each), and merge (consolidate batch results). Requires sast/architec

Files · 1

View on GitHub

SKILL.md

1	# Insecure File Upload Detection
2
3	You are performing a focused security assessment to find insecure file upload vulnerabilities in a codebase. This skill uses a three-phase approach with subagents: discovery (find all places where uploaded files are received and stored), batched verify (check bypass vectors in parallel batches of up to 3 upload sites each), and merge (consolidate batch reports into one results file).
4
5	Prerequisites: `sast/architecture.md` must exist. Run the analysis skill first if it doesn't.
6
7	---
8
9	## What is an Insecure File Upload
10
11	Insecure file upload occurs when an application accepts files from users without properly validating or restricting what can be uploaded, allowing an attacker to upload executable or malicious files. The most critical outcome is Remote Code Execution (RCE): an attacker uploads a web shell (e.g., a `.php` file) and the server executes it when accessed via a direct URL.
12
13	The core pattern: a user-supplied file reaches a storage location without adequate extension validation, and the stored file is accessible or executable.
14
15	### What Insecure File Upload IS
16
17	- Accepting any file type with no extension or content check: `file.save(upload_path)` with no validation
18	- Content-Type-only validation: checking `Content-Type: image/png` without verifying the actual extension or file content — trivially bypassed by setting the header manually
19	- Extension blocklist with gaps: `.php` is blocked but `.php3`, `.php4`, `.php5`, `.phtml`, `.phar`, `.shtml` are not
20	- Case-insensitive bypass: blocking `.php` but allowing `.PHP`, `.Php`, `.pHp`
21	- Double extension bypass: `shell.php.jpg` — code extracts the last `.jpg` and considers it safe, but the server (Apache) serves it as PHP
22	- Path traversal in filenames: `../../webroot/shell.php` stored via an unsanitized filename
23	- Incomplete filename sanitization: only stripping `../` but not encoded variants `%2e%2e%2f`
24	- Serving uploaded files from a web-executable directory without disabling execution
25
26	### What Insecure File Upload is NOT
27
28	Do not flag these as file upload vulnerabilities:
29
30	- Stored XSS via SVG: uploading an SVG with embedded `<script>` that is reflected back — that's XSS, not an upload execution issue
31	- SSRF via file content: uploading an XML or SVG that triggers an outbound request — that's XXE/SSRF, not a file upload execution issue
32	- DoS via large files: missing file size limits — a separate availability issue
33	- IDOR on download: accessing another user's uploaded file without authorization — that's IDOR
34	- Secure uploads: files stored outside the web root, or served through a controlled download endpoint that sets `Content-Disposition: attachment`, or stored in an object storage bucket with no public execution capability
35
36	### Patterns That Prevent Insecure File Upload
37
38	When you see these patterns together, the code is likely not vulnerable:
39
40	1. Allowlist of safe extensions (most important)
41	```python
42	ALLOWED_EXTENSIONS = {'png', 'jpg', 'jpeg', 'gif', 'pdf'}
43	ext = filename.rsplit('.', 1)[-1].lower()
44	if ext not in ALLOWED_EXTENSIONS:
45	abort(400)
46	```
47
48	2. Magic byte / file content validation (defense in depth)
49	```python
50	import magic
51	mime = magic.from_buffer(file.read(2048), mime=True)
52	ALLOWED_MIMES = {'image/png', 'image/jpeg', 'image/gif'}
53	if mime not in ALLOWED_MIMES:
54	abort(400)
55	```
56
57	3. Filename sanitization using a trusted library
58	```python
59	from werkzeug.utils import secure_filename
60	filename = secure_filename(file.filename) # strips path separators and dangerous chars
61	```
62
63	4. Storing uploads outside the web root
64	```
65	/var/uploads/ ← not served by the web server
66	/var/www/html/ ← web root (do NOT store uploads here)
67	```
68
69	5. Serving uploads through a controlled endpoint with Content-Disposition
70	```python
71	@app.route('/download/<filename>')
72	def download(filename):
73	return send_from_directory(UPLOAD_FOLDER, filename,
74	as_attachment=True) # forces download, prevents execution
75	```
76
77	6. Renaming the file to a server-generated UUID
78	```python
79	import uuid
80	stored_name = str(uuid.uuid4()) + '.jpg' # extension is server-controlled, not user-controlled
81	```
82
83	---
84
85	## Vulnerable vs. Secure Examples
86
87	### Python — Flask
88
89	```python
90	# VULNERABLE: no extension check, file stored in web-accessible directory
91	@app.route('/upload', methods=['POST'])
92	def upload():
93	f = request.files['file']
94	f.save(os.path.join('static/uploads', f.filenam

People who liked this also viewed

6 picks

Type

sast-fileupload

40installs56forks

View on GitHub

How to install sast-fileupload?

utkusen/sast-skills/sast-fileupload

$npx -y skills add utkusen/sast-skills --skill sast-fileupload

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# Insecure File Upload Detection
2
3	You are performing a focused security assessment to find insecure file upload vulnerabilities in a codebase. This skill uses a three-phase approach with subagents: discovery (find all places where uploaded files are received and stored), batched verify (check bypass vectors in parallel batches of up to 3 upload sites each), and merge (consolidate batch reports into one results file).
4
5	Prerequisites: `sast/architecture.md` must exist. Run the analysis skill first if it doesn't.
6
7	---
8
9	## What is an Insecure File Upload
10
11	Insecure file upload occurs when an application accepts files from users without properly validating or restricting what can be uploaded, allowing an attacker to upload executable or malicious files. The most critical outcome is Remote Code Execution (RCE): an attacker uploads a web shell (e.g., a `.php` file) and the server executes it when accessed via a direct URL.
12
13	The core pattern: a user-supplied file reaches a storage location without adequate extension validation, and the stored file is accessible or executable.
14
15	### What Insecure File Upload IS
16
17	- Accepting any file type with no extension or content check: `file.save(upload_path)` with no validation
18	- Content-Type-only validation: checking `Content-Type: image/png` without verifying the actual extension or file content — trivially bypassed by setting the header manually
19	- Extension blocklist with gaps: `.php` is blocked but `.php3`, `.php4`, `.php5`, `.phtml`, `.phar`, `.shtml` are not
20	- Case-insensitive bypass: blocking `.php` but allowing `.PHP`, `.Php`, `.pHp`
21	- Double extension bypass: `shell.php.jpg` — code extracts the last `.jpg` and considers it safe, but the server (Apache) serves it as PHP
22	- Path traversal in filenames: `../../webroot/shell.php` stored via an unsanitized filename
23	- Incomplete filename sanitization: only stripping `../` but not encoded variants `%2e%2e%2f`
24	- Serving uploaded files from a web-executable directory without disabling execution
25
26	### What Insecure File Upload is NOT
27
28	Do not flag these as file upload vulnerabilities:
29
30	- Stored XSS via SVG: uploading an SVG with embedded `<script>` that is reflected back — that's XSS, not an upload execution issue
31	- SSRF via file content: uploading an XML or SVG that triggers an outbound request — that's XXE/SSRF, not a file upload execution issue
32	- DoS via large files: missing file size limits — a separate availability issue
33	- IDOR on download: accessing another user's uploaded file without authorization — that's IDOR
34	- Secure uploads: files stored outside the web root, or served through a controlled download endpoint that sets `Content-Disposition: attachment`, or stored in an object storage bucket with no public execution capability
35
36	### Patterns That Prevent Insecure File Upload
37
38	When you see these patterns together, the code is likely not vulnerable:
39
40	1. Allowlist of safe extensions (most important)
41	```python
42	ALLOWED_EXTENSIONS = {'png', 'jpg', 'jpeg', 'gif', 'pdf'}
43	ext = filename.rsplit('.', 1)[-1].lower()
44	if ext not in ALLOWED_EXTENSIONS:
45	abort(400)
46	```
47
48	2. Magic byte / file content validation (defense in depth)
49	```python
50	import magic
51	mime = magic.from_buffer(file.read(2048), mime=True)
52	ALLOWED_MIMES = {'image/png', 'image/jpeg', 'image/gif'}
53	if mime not in ALLOWED_MIMES:
54	abort(400)
55	```
56
57	3. Filename sanitization using a trusted library
58	```python
59	from werkzeug.utils import secure_filename
60	filename = secure_filename(file.filename) # strips path separators and dangerous chars
61	```
62
63	4. Storing uploads outside the web root
64	```
65	/var/uploads/ ← not served by the web server
66	/var/www/html/ ← web root (do NOT store uploads here)
67	```
68
69	5. Serving uploads through a controlled endpoint with Content-Disposition
70	```python
71	@app.route('/download/<filename>')
72	def download(filename):
73	return send_from_directory(UPLOAD_FOLDER, filename,
74	as_attachment=True) # forces download, prevents execution
75	```
76
77	6. Renaming the file to a server-generated UUID
78	```python
79	import uuid
80	stored_name = str(uuid.uuid4()) + '.jpg' # extension is server-controlled, not user-controlled
81	```
82
83	---
84
85	## Vulnerable vs. Secure Examples
86
87	### Python — Flask
88
89	```python
90	# VULNERABLE: no extension check, file stored in web-accessible directory
91	@app.route('/upload', methods=['POST'])
92	def upload():
93	f = request.files['file']
94	f.save(os.path.join('static/uploads', f.filenam

People who liked this also viewed

6 picks

Type