File-type validation vs malware scanning
These are different controls with different goals.
File-type validation
Section titled “File-type validation”Purpose: decide whether the route should even accept the format.
Examples:
- Extension allowlists.
- Declared MIME allowlists.
- Magic-byte checks.
Malware scanning
Section titled “Malware scanning”Purpose: inspect whether the file carries suspicious or malicious characteristics beyond its nominal type.
Examples:
- Risky PDF actions.
- Macro-enabled Office files.
- Signature-based matches via YARA or ClamAV.
Practical rule
Section titled “Practical rule”Validation answers “is this the kind of file we expect?”
Scanning answers “is this file risky even if it looks like the right kind of file?”
If you want the broader Node.js route model that puts both controls in order, read Secure file uploads in Node.js: Beyond Extension and MIME Checks.