Start here. This is the direct spoken answer to practice first.
Overview
An upload is untrusted content plus untrusted metadata; validation starts before application code receives the part.
Spring MVC can bind an uploaded part as MultipartFile or Part, and @RequestPart can convert and validate a JSON metadata part. I configure request and part size limits so oversized input is rejected before consuming excessive memory or disk. I check required presence, allowed business file types, and content signatures rather than trusting only the client filename or Content-Type. Storage uses a generated identifier outside any client-controlled path.