File Upload Quarantine and Promotion

Bounded lesson outcome

A file upload is not merely a successful transfer of bytes. It is an object crossing a trust boundary. The bounded outcome of this lesson is to keep every new upload untrusted, place it in quarantine, preserve evidence for each independent control, and perform promotion only when the declared evidence set is complete.

The evidence destination is File Intake Quarantine Promotion Record v1. It does not claim that a file has become universally safe, that one scanner sees every threat, or that a local green run proves production security. For the synthetic SEC009-LAB1 fixture it records Authorized Uploader, Declared Type, Observed Type Evidence, Size Policy, Scan/CDR Status, Quarantine Location, Generated Storage Name, Promotion Decision, Public Representation, and Residual Risk.

The lab is entirely local and synthetic. It downloads no real files, calls no public scanning service, constructs or executes no malicious payload, and touches no production path or real webroot. All “files” are fixed benign records.

1. Intake is not trust

A successful intake proves only that bytes reached the intake boundary. It does not prove that the type is allowed, the content is safe, the uploader is authorized, the storage location is safe, or public release is permitted. The first fixture state is QUARANTINED, never PROMOTED.

The intake boundary is the point at which the object is still untrusted and receives only preliminary metadata plus an internal identifier. Client headers and client filenames are observations, not final authority.

2. Extension, Content-Type, and signature have different roles

An extension allowlist should follow business need. If the product needs PNG and JPEG avatars, adding unrelated file types without a requirement expands risk. An extension alone, however, is not proof of actual file type.

Client-supplied Content-Type is a hint and can be spoofed. The fixture therefore stores declared MIME separately from Observed Type Evidence. For benign fixtures, a fixed local signature classification is compared with the policy. Even signature evidence alone is not a universal safety proof; it is only one promotion gate.

Negative Evidence: when the extension is allowed but the fixed observed signature disagrees with the policy, the object remains quarantined and promotion is denied. Renaming the file or ignoring the mismatch must not erase the failure.

3. Storage identity is application-controlled

The original client filename can be retained for display or audit, but it must not automatically become the storage identity or public path. The fixture requires a deterministic, application-controlled generated_storage_name for every accepted intake.

Renaming is a storage control, not a replacement for type validation, authorization, or scanning. If the generated identity is missing, the promotion gate fails even when other evidence is green.

4. Quarantine stays separate from public serving

Raw input is not assumed to be directly servable before the promotion decision. In this fixture quarantine://... is only a local namespace and does not represent a real filesystem or webroot. Promotion does not expose the raw upload directly; it returns only a synthetic public_representation_id.

This separation prevents “received” from silently becoming “publicly consumable.”

5. Authorization and size are independent gates

Correct type evidence does not authorize the uploader. The uploader must be allowed to submit that class of file. Size limits are also independent. Authorization cannot compensate for an oversize object, and a size PASS cannot compensate for missing authorization.

The control record preserves each gate independently so the final decision remains traceable.

6. Scan/CDR is policy-dependent defense in depth

OWASP recommends antivirus/sandbox processing when available and CDR when applicable, but this lesson does not make any product a universal authority. The fixture uses synthetic states such as NOT_REQUIRED_FOR_FIXTURE and PASS_SYNTHETIC only.

A scan PASS is not universal file safety. Downstream consumers, parsers, retention, and business context still carry residual risk.

7. Promotion is an explicit state transition

Promotion is allowed only when:

1. the uploader is authorized;
2. the extension is allowlisted;
3. declared type and observed signature agree with policy;
4. size is within policy;
5. an application-generated storage identity exists;
6. any required scan/CDR gate has PASS evidence; and
7. the evidence record is complete.

If any required condition fails or is missing, the object remains QUARANTINED or becomes REJECTED. “Most checks passed” is not the promotion rule.

8. Baseline lab

SEC009-LAB1 contains only benign fixed records: a small PNG avatar, a plain-text document, and a deliberate metadata/signature mismatch. There are no executable files and no malicious content.

The positive baseline promotes an allowed avatar from QUARANTINED to PROMOTED and exposes only a synthetic approved representation. The negative baseline rejects a type mismatch with DENY_TYPE_EVIDENCE_MISMATCH.

9. Failure probe one: type mismatch

The client claims a PNG while the fixed signature fixture identifies text. Expected behavior: an allowed extension does not override the mismatch, the declared Content-Type is not authority, and promotion is denied.

The denial itself is evidence. A green test process without the correct decision code is not sufficient.

10. Failure probe two: generated storage identity removed

If generated_storage_name is empty, the system must not fall back to the client filename. The decision is DENY_STORAGE_IDENTITY_MISSING and the object remains quarantined.

This shows that generated names are an independent storage control without claiming that renaming makes content safe.

11. Failure probe three: a required gate is missing

If the policy requires a scan gate for a fixture and the evidence state is MISSING, promotion stops with DENY_REQUIRED_GATE_MISSING. Missing evidence must never be silently converted into PASS.

12. Evidence contract

Each File Intake Quarantine Promotion Record v1 row requires:

• fixture_id
• authorized_uploader
• declared_type
• observed_type_evidence
• size_policy
• scan_cdr_status
• quarantine_location
• generated_storage_name
• promotion_decision
• public_representation
• residual_risk

Observed output is kept separate from inference. “The bounded policy allowed promotion” is not the same claim as “production is secure.”

13. Positive Evidence and Negative Evidence

Positive Evidence shows that an allowed benign fixture can complete the declared gates under stated assumptions.

Negative Evidence proves at least one shortcut is actually blocked: type mismatch, missing storage identity, or missing required gate. Security competence is incomplete if only the happy path is recorded.

14. Independent transfer

The changed context contains an avatar upload and a contract-document upload. Their allowed types, downstream consumers, and scan/CDR requirements differ. The learner rebuilds each promotion policy instead of copying the avatar policy into the document case.

The transfer decision must identify which controls remain invariant and which gates are context-specific.

15. Claim boundary and residual risk

This lab does not prove that a real production file is malware-free. It does not prove that a downstream parser is invulnerable. It does not decide retention, privacy, DLP, abuse moderation, or product-specific legal policy.

Residual risk stays explicit: this fixture proves only the declared local state machine and evidence gates.

16. Assessment boundary

Blocking responses must diagnose a failure, build a decision from evidence, and solve the changed context without decisive scaffold. Retrieval-only answers are insufficient for the blocking application, diagnosis, and transfer items.

Owner acceptance remains a separate human gate; a machine PASS does not prefill owner approval.

17. Source and freshness

The frozen authority boundary contains only OWASP-FILE-UPLOAD. During authoring on 2026-09-16, the same official source was rechecked without widening the source set. Its current defensive guidance remains consistent with the frozen claim boundary: allowlisted extensions, distrust of client Content-Type, signature/content checks, application-generated filenames, authorization and size controls, storage separation, and optional antivirus/sandbox/CDR layers.

Review due remains 2026-10-02. No additional authority was added.

18. Decision summary

The compact rule is: upload arrival is not trust; quarantine is the default state; promotion is an explicit evidence-complete transition. No header, filename, or single scan result is sufficient promotion authority by itself.