Build an authenticated document upload that treats browser file metadata as untrusted.

Accept one PDF up to 10 MB. Verify the PDF signature, store it under a server-generated key in quarantine, scan it, and persist only safe metadata and ownership.

Uploading invoice.exe renamed to .pdf fails signature validation and never becomes downloadable.

• Enforce request and application size limits.
• Do not trust extension or content type alone.
• Store outside the web root.
• Never use the original name as a storage path.

I reject impossible metadata early, inspect the content signature, and generate an opaque storage key. The file stays quarantined until scanning succeeds; the database stores ownership and safe display metadata.

[Authorize]
[HttpPost("documents")]
[RequestSizeLimit(10_500_000)]
public async Task<ActionResult<DocumentResponse>> Upload(
    IFormFile file, CancellationToken ct)
{
    const long maxBytes = 10_000_000;
    if (file.Length is <= 0 or > maxBytes)
        return ValidationProblem(new() {
            ["file"] = ["Choose a non-empty PDF up to 10 MB."]
        });

    await using var input = file.OpenReadStream();
    var signature = new byte[5];
    var read = 0;
    while (read < signature.Length) {
        var count = await input.ReadAsync(signature.AsMemory(read), ct);
        if (count == 0) break;
        read += count;
    }
    if (read != signature.Length || !signature.AsSpan().SequenceEqual("%PDF-"u8))
        return ValidationProblem(new() { ["file"] = ["The file is not a valid PDF."] });
    input.Seek(0, SeekOrigin.Begin);

    var storageKey = $"quarantine/{Guid.NewGuid():N}";
    var retained = false;
    try {
        await storage.WriteAsync(storageKey, input, maxBytes, ct);
        var scan = await scanner.ScanAsync(storageKey, ct);
        if (!scan.IsSafe)
            return ValidationProblem(new() {
                ["file"] = ["The file could not be accepted."]
            });

        var document = Document.Create(User.RequireUserId(), storageKey,
            FileNames.ForDisplay(file.FileName), file.Length, "application/pdf");
        db.Documents.Add(document);
        await db.SaveChangesAsync(ct);
        retained = true;
        return CreatedAtAction(nameof(GetDocument), new { id = document.Id },
            DocumentResponse.From(document));
    } finally {
        if (!retained)
            await storage.DeleteIfExistsAsync(storageKey, CancellationToken.None);
    }
}

Signature checks are only a first filter; malware scanning and storage policy remain separate controls. Large or slow scanning should become an asynchronous quarantine workflow rather than tying up the request.

• The body exceeds the server limit.
• The stream ends before five bytes.
• Scanning fails or times out.
• Storage succeeds but database save fails.

• Upload a renamed executable.
• Assert generated keys never contain the original name.
• Verify rejected quarantine objects are removed.
• Cancel during streaming.

• Trusting ContentType.
• Saving under the original filename.
• Putting uploads in wwwroot.
• Reading the whole file into one byte array.