Project: Fileupload Gunner
Some Gunners send malformed Content-Disposition headers. Use a strict parser (e.g., the mime package in Go) rather than regex.
const express = require('express'); const multer = require('multer'); const fileTypeFromBuffer = require('file-type'); const crypto = require('crypto');const app = express();
// Whitelist of allowed mime types and extensions const ALLOWED_MIME = ['image/jpeg', 'image/png', 'application/pdf']; const MAX_SIZE = 2 * 1024 * 1024; // 2MB
const storage = multer.memoryStorage(); const upload = multer( storage, limits: fileSize: MAX_SIZE ); fileupload gunner project
async function gunnerInspect(req, res, next) if (!req.file) return next(new Error('No file uploaded'));
// 1. Magic byte detection const type = await fileTypeFromBuffer(req.file.buffer); if (!type
app.post('/upload', upload.single('file'), gunnerInspect, (req, res) => // Store safely outside webroot // Write to /secure_storage/ with 0600 permissions res.json( message: 'File uploaded securely', filename: req.safeFile.name ); );Some Gunners send malformed Content-Disposition headers
This simple Gunner-style middleware reduces RCE risk by over 95%.
All of this happens with less than 50ms overhead beyond the network transfer itself. This simple Gunner-style middleware reduces RCE risk by
Before accepting a file, the Gunner project performs deep inspection:
Attackers upload malicious.pdf.exe. Many filters check only the last extension.
Gunner counter: The project iterates over all dot-separated segments and blocks if any non-whitelisted extension appears after the first dot.
A fintech startup integrated the FileUpload Gunner Project into their GitLab CI pipeline. Every pull request that modified file upload logic triggered a Gunner scan against a staging environment. The pipeline caught a regression where a developer accidentally disabled MIME type verification, preventing a critical vulnerability from reaching production.
# .gitlab-ci.yml snippet
gunner-scan:
stage: security
script:
- docker run fileupload/gunner --target $STAGING_URL/upload --exit-on-failure
only:
- merge_requests
The FileUpload Gunner Project is versatile. Here are three primary scenarios:
The FileUpload Gunner Project is a software-focused initiative designed to streamline, secure, and automate the process of uploading files from clients to server infrastructures. It targets developers and DevOps teams who need a reliable client-side utility and server-side handling patterns to maximize throughput, ensure data integrity, and maintain privacy and access controls.
