## File Upload (High)

### Trigger Signals

- File upload endpoints (`multer`, `multipart`, `upload`, `formidable`, `@UploadFile`)
- Route handlers receiving `multipart/form-data`
- File storage operations (`fs.writeFile`, `move`, `save`) following file reception

### Key Sinks

| Vulnerability Type | Check Points |
|---------|--------|
| File Type Bypass | MIME type validation, extension whitelist |
| File Content Bypass | Magic bytes validation, file content scanning |
| Storage Path Traversal | Upload path concatenated with user input |
| File Size | Content-Length/size validation |
| Filename Injection | Filename special character filtering |

### Judgment Process

1. **Identify upload entry point**: `Read` extracts file upload middleware and handlers, marking upload handler functions
2. **Check file type validation**: `Read` confirms whether the following validations exist (all must be present):
   - Extension whitelist (only allowing `.jpg`/`.png` etc., not blacklist)
   - MIME type validation (`file.mimetype` check)
   - Magic bytes validation (file header magic number verification, preventing extension forgery)
3. **Check storage security**: `Read` confirms file storage strategy:
   - Whether storage path uses safe filenames (UUID rename vs. retaining original filename)
   - Whether stored outside web root directory (preventing direct access to execute uploaded scripts)
   - Whether storage path is vulnerable to path traversal (whether filename contains `../`)
4. **Check file size limit**: `Read` confirms whether there is a size cap (`limits.fileSize`, `maxSize`)
5. **Check filename handling**: `Read` confirms whether special characters are filtered (`;`, `\n`, `..`, null bytes)

### Evidence Construction

After confirming a defect, the output must include:
- Upload entry point (route and handler function, with file:line number)
- Missing validations (no type check/no size limit/unsafe storage path)
- Bypass scenario (e.g., double extension `shell.php.jpg`, null byte `shell.php%00.jpg`)
- Business impact (WebShell upload, storage exhaustion, path traversal)

### Exclusions

- Already using cloud storage (S3/OSS) with type and size limits
- Already has complete type validation (extension + MIME + Magic bytes)
- File already renamed to UUID and stored outside web root
- Only trusted internal users can upload (e.g., admin backend)
