Upload Policy Reviewer

Describe the policy, not an example file

Enter simple extensions such as jpg and png rather than wildcard patterns. A leading dot is accepted, case is normalised and repeated entries are removed. The size limit represents a positive whole number of bytes. No universal file-size threshold is labelled safe: an appropriate limit depends on the application and the content it needs to accept.

Choose only protections you can establish

The form covers MIME and file-signature checks, random filenames, storage outside the web root, malware scanning, authentication, authorization, CSRF protection, rate limiting and archive acceptance. A disabled protection creates a review point; an unknown one remains unassessed. Selecting an enabled setting does not test the server. CSRF advice still depends on how the application handles credentials.

Content and storage change the boundary

Active content types receive an additional review point. Allowing archives adds a reminder about extraction paths and decompressed-size limits. Extension, type and signature checks answer different questions. Original filenames also need careful handling. This tool does not decode content, extract an archive or send a sample to an antivirus service.

Verify the complete request path

Use the result as a policy discussion, not proof that a file is harmless. Check proxy limits, authenticated upload permissions and controlled retrieval in your own tests. Keep storage names and service credentials out of the input. Export contains the normalised declared policy settings.

References

• OWASP file upload guidance
• OWASP input validation guidance

Documentation reviewed: 1 November 2026. Rule results describe the supplied text, not a live application test.

Useful next steps

• API Access Matrix Planner
• Security Report Builder
• Practical guides and coding projects

Maintained by MetaCyberGuru. A review point may need source, runtime or deployment context before you act on it.