Version: v5.2

File type validation

Overview#

Platform version 5.2 introduced a new feature which ensures that every time a file is uploaded, a comprehensive validation check is performed on the file. The File Service inspects the actual bytes of every uploaded file to determine what the file actually is and cross-checks that information against the file's name extension. This file validation check applies to both normal and resumable file uploads.

This feature addresses an issue whereby a script or executable file could have been uploaded and the true nature of the file was disguised by having a misleading file extension. For example, invoice.pdf.exe.

Note: This is not a blanket allow-list that rejects any file that is not recognized. The decision on whether to validate the file depends on whether the File Service has a rule for that file extension type.

How the File Service evaluates file extensions#

When validating file extensions, the File Service considers the following:

Does this file have a recognized extension? The File Service maintains a list of around 50 recognized file types. (See List of recognized file types) The detected file content must match what is expected for a particular file extension or the upload will be rejected. This is the only scenario where a file gets rejected. When a file upload is rejected, the HTTP 400 error response is returned.

400 Bad Request"File content does not match its extension '.pdf' (detected: text/x-php)"

Does this file have a unrecognized extension? If the file has an unrecognized extension, then the upload will be allowed through unrestricted, for backward compatibility. However, the file will be recorded as unverified (the _contentTypeValidated field will be set to false. ).

How file validation works in the File Service#

The file validation feature works as follows:

The File Service determines the content type of a file by examining the bytes contained in the file. In this analysis, it ignores the file name or any client-supplied header.
The content type which is detected by the File Service is the information which gets stored as the file's content type. This information is stored in both object storage and in the file's metadata.
A new field _contentTypeValidated is stored on the file version which flags if a file has been validated or not.

How the field _contentTypeValidated works#

The field _contentTypeValidated is a Boolean type. It operates as follows, depending on its value:

Set to true: The file extension is recognized and the detected content matched what would be expected for that type of file.
Set to false: Either the file extension is not one which the File Service has in its catalog of file extensions or the detected content type doesn't have a specific matching signature for other reasons where a check could not be made.

Sample file version#

Refer to the file version information below with settings for _contentTypeValidated.

{    "_fileSize": 4548,    "_previews": [],    "_objMetadata": {        "_contentLength": "4548",        "_contentTypeValidated": false,        "_contentType": "application/xml"    },    "_id": "7d57c990-3704-4200-9f91-c3170e150b0f",    "_metadata": {        "_updatedById": "df24e92d-17f5-484d-b7e6-b4581fde4038",        "_createdAt": 1784716293449,        "_createdById": "df24e92d-17f5-484d-b7e6-b4581fde4038",        "_updatedAt": 1784716293449    },    "_version": 1,    "_fileId": "cfad337d-86da-4ce5-b101-2aaefceac1f6"}

List of recognized file types#

This section contains a list of all the file extensions which the File Service currently evaluates against file content. If you attempt to upload one of these file types and it contains mismatched file content then it is rejected.

Uploading file types which are not on this list is allowed, regardless of content but such files will be flagged as unverified.

File category	File extensions
Images, documents, media (exact MIME match)	`pdf, png, jpg, jpeg, jfif, gif, webp, svg, tiff, psd, mp4, mp3, webm, avi, rtf, json`
BIM, CAD (exact match, with fallbacks where the format has no reliable signature)	`dwg, dxf, glb, ifc, sql`
ZIP-based containers	`zip, bimpk, sgpk, docx, xlsx, pptx, odt, odp, dwfx`
Legacy MS Office	`doc, xls, ppt`
Plain text formats	`txt, csv, log, md, css, mjs, jsx, ttl, tsv, yml`
Archives	`gz, tgz, tar, rar`
Proprietary/opaque binaries	`rvt, nwd, fbx, joblib, pak, osts, scz`

Provisional file list#

The list of recognized file types is still being extended as new formats come up. The information is stored in the File Service configuration file config.json in file.allowedTypes.

Note: If your integration relies on knowing whether a given upload was actually verified (as opposed to just accepted), check the _contentTypeValidated flag on the file version rather than assuming that the file extension being in the list is the only signal that matters.