Express.js / Advanced: resource, write and release contracts / Lesson 15

Uploads, external input and security review

Design bounded file intake and safe downstream use without trusting filenames, content types or destination URLs.

About 4 min readContent reviewed 2026-10-28

On this page

Lesson goals

Separate transport limits, file inspection, storage identity and publication.
Review external URL and error disclosure boundaries without running scans.

Multipart parsing is not a built-in safety guarantee

Express core JSON and URL-encoded parsers do not implement a complete multipart upload workflow. A separately chosen parser needs reviewed maintenance, size, part-count, field-count and cleanup behavior. A declared Content-Type or filename is supplied by the caller and does not prove the file’s actual format or safety. Define allowed business content and bounded inspection, keep original names as metadata only when appropriate, and assign server-controlled storage identity. Do not publish a newly received file directly under a public static root before the intended authorization and review workflow completes.

Write the intake policy before selecting middleware

The JSON is a synthetic policy note, not configuration for an installed multipart package. It separates private quarantine, server-generated keys and release approval. The actual workflow must also handle parser rejection, source disconnection, partial temporary files and an interrupted review. Bound temporary storage and cleanup under a clear owner; rejecting the request after writing an unlimited temporary file is too late to establish a resource bound. Match policy to authorized content and infrastructure instead of prescribing universal file-size or scanning commands. No files are uploaded or inspected by this course.

json Synthetic upload policy record

{"intake":"synthetic-only","storage":"private-quarantine","storageKey":"server-generated","originalName":"metadata-only","limits":["bytes","parts","fields","temporary-space"],"publication":"after-authorized-review"}

The record names boundaries and changes no parser, storage or publication setting. It contains no accepted upload result.

A URL is another capability request

An endpoint that fetches a caller-provided URL can grant access to internal services or unexpected protocols through the server’s network authority. A hostname substring allowlist is insufficient when redirects, DNS behavior and resolved addresses matter. Prefer fixed approved destinations and narrow domain operations over an arbitrary URL fetcher. If external retrieval is required, use a reviewed policy for schemes, destination resolution, redirects, credentials, bytes and deadlines at each hop. This course does not issue such requests or test internal reachability; it explains the boundary without providing a scanning workflow.

Validate the declared business category without claiming file safety

The local function permits only two declared import categories and a bounded row count. Its values are synthetic teaching limits. The predicate validates metadata needed by a domain operation; it does not inspect actual bytes, identify a media type, neutralize active content or authorize a principal. Keeping that limitation explicit prevents a simple extension or MIME check from being advertised as a complete security mechanism. A real upload path should apply its content policy and resource limits before publication, then pass a narrow storage reference into the domain rather than a user-controlled filesystem path.

javascript Complete offline metadata predicate

function importMetadata(category,rows) {
  return ["course-labels","course-tags"].includes(category) &&
    Number.isInteger(rows) && rows >= 1 && rows <= 100;
}
console.assert(importMetadata("course-tags",100));
console.assert(!importMetadata("private-accounts",1));
console.assert(!importMetadata("course-tags",101));

Only the approved category within the declared row bound passes. No file bytes, parser or network destination is examined.

Review the whole untrusted-input chain

Security also includes dependency patch review, TLS, intentional response headers, safe redirects, output encoding and private error disclosure. These controls complement object policy and cannot replace it. Choose maintained middleware versions and record actual integration assumptions rather than copying a long configuration with unexplained defaults. Test accepted and rejected synthetic inputs, cleanup after partial intake and denied publication. Use official advisories and project-approved checks; do not run a real scan or load operation as editorial verification. A policy file and local predicate are useful review artifacts but are not evidence that production uploads are safe.

Common errors and fixes

A filename determines a public storage path

Why it happens: Caller metadata was treated as storage authority.
How to fix it: Use server-controlled private keys and an authorized publication step.
Prevent it next time: Test path-like names without reading arbitrary files.

A MIME label is called verified file safety

Why it happens: Declared metadata was confused with actual content inspection.
How to fix it: Apply the specific bounded content policy separately.
Prevent it next time: Document exactly what each inspection establishes.

A URL importer accesses unintended destinations

Why it happens: Server network authority was exposed through unrestricted input.
How to fix it: Prefer fixed capabilities or a reviewed per-hop destination policy.
Prevent it next time: Review redirects and resolution without probing real targets.

Check your understanding

1. Why does a metadata predicate not certify an uploaded document?

Show worked solution

It sees declared category and count only. It cannot establish the content, size or behavior of bytes it never inspects. The upload parser, bounded content review, private storage and authorized publication each need separate evidence. Keep that distinction so an accepted category does not become permission to publish arbitrary active content.

2. Why should temporary-space cleanup be part of rejection tests?