Keep uploads unavailable until checks finish
Define pending, accepted, rejected, and expired upload states. Bind check results to immutable bytes and test publication races and worker failures.
Quarantine is an access rule, not a folder name. An object is not quarantined if a predictable URL, old signed link, or preview service can serve it while checks are pending. Start by listing every route that can return the uploaded bytes or a derivative.
OWASP describes file content checks and isolated storage. The state model below is a suggested way to connect those checks to publication. A successful check is evidence about that check, not proof that a document is harmless.
Define the publication states
Bind an upload record to a specific object version or digest. A worker result must identify the exact bytes examined. Otherwise a later replacement can inherit an earlier accepted result.
| State | May a normal user download it? | Allowed transition |
|---|---|---|
| Pending | No | Accept, reject, or expire after required checks |
| Accepted | Only after ordinary authorization | Revoke or replace through a new checked version |
| Rejected | No | Delete under the retention rule |
| Expired | No | Remove abandoned data and release reservations |
List the checks required for each supported type. Do not turn a missing parser, unavailable service, or timeout into an implicit acceptance.
Test the race around completion
Upload a harmless fixture and pause the test worker before it records a result. Attempt the normal download and preview routes with an authorized test account. They should remain unavailable because the state is pending, even though the account owns the object.
Resume the check and verify the accepted path. Then replace the source version in a controlled test and confirm that the old result cannot publish the replacement. Test duplicate completion messages and a worker that reports after the upload has expired.
Keep operational exceptions bounded
A manual release should identify the exact object version, accountable reviewer, reason, and expiry or follow-up. It must not become a general bypass for every pending object. Keep rejected content out of ordinary support tools unless a separately authorized review requires access.
Record cleanup outcomes for failures and abandoned uploads. Check that derived thumbnails and previews follow the same publication decision as their source. The final evidence should connect source identity, check results, state transition, and download behavior. That connection lets the team explain why a particular version became available without claiming that quarantine alone eliminates every file risk.
Find the gaps before your next launch
Use the release checklist to identify changed security boundaries and missing evidence. Discuss the application paths you want reviewed before launch.
Sources
- OWASP File Upload Cheat SheetAccessed