uploadshield 2.0.0__py3-none-any.whl

uploadshield/core/types.py

@@ -0,0 +1,319 @@
+"""A deterministic registry of the file types this library can reason about.
+
+The standard library's :mod:`mimetypes` reads ``/etc/mime.types`` and the Windows
+registry, so its answers differ between machines.  Validation results must not depend
+on the host, so every type we detect or allow is declared here explicitly.
+"""
+
+from __future__ import annotations
+
+import threading
+from dataclasses import dataclass, field
+from typing import TYPE_CHECKING
+
+if TYPE_CHECKING:
+    from collections.abc import Iterable, Iterator
+
+__all__ = [
+    "GB",
+    "KB",
+    "MB",
+    "FileType",
+    "GiB",
+    "KiB",
+    "MiB",
+    "all_types",
+    "get_type",
+    "register_type",
+    "resolve_mime",
+    "types_for_extension",
+]
+
+KB = 1000
+MB = 1000 * KB
+GB = 1000 * MB
+KiB = 1024
+MiB = 1024 * KiB
+GiB = 1024 * MiB
+
+
+@dataclass(frozen=True, slots=True)
+class FileType:
+    """A file format identified by its canonical MIME type.
+
+    ``extensions`` are lowercase, start with a dot and the first one is canonical.
+    ``aliases`` are non-canonical MIME strings that clients commonly send.
+    ``container`` names the physical container (``"zip"``/``"ole"``) so that
+    container-level checks can apply to every format built on it.
+    ``parent`` marks a *refinement*: content can prove a file is ``text/plain`` but not
+    that it is CSV, so a ``.csv`` name may narrow ``text/plain`` to ``text/csv``.
+    """
+
+    mime: str
+    extensions: tuple[str, ...]
+    label: str
+    aliases: tuple[str, ...] = ()
+    container: str | None = None
+    is_text: bool = False
+    parent: str | None = None
+    executable: bool = field(default=False, compare=False)
+
+    def __post_init__(self) -> None:
+        if self.mime != self.mime.lower() or "/" not in self.mime:
+            raise ValueError(f"MIME type must be lowercase 'type/subtype': {self.mime!r}")
+        for ext in self.extensions:
+            if not ext.startswith(".") or ext != ext.lower():
+                raise ValueError(f"Extensions must be lowercase and start with '.': {ext!r}")
+
+    @property
+    def category(self) -> str:
+        """The top-level media type, e.g. ``"image"`` for ``image/png``."""
+        return self.mime.split("/", 1)[0]
+
+    @property
+    def canonical_extension(self) -> str:
+        return self.extensions[0] if self.extensions else ""
+
+    def matches(self, mime: str) -> bool:
+        """Whether ``mime`` (canonical or alias, parameters ignored) denotes this type."""
+        bare = normalize_mime(mime)
+        return bare == self.mime or bare in self.aliases
+
+
+def normalize_mime(mime: str) -> str:
+    """Strip parameters and whitespace and lowercase a MIME string."""
+    return mime.split(";", 1)[0].strip().lower()
+
+
+def format_size(num_bytes: int) -> str:
+    """Human-readable decimal size: ``format_size(2_500_000) == "2.5 MB"``."""
+    value = float(num_bytes)
+    for unit in ("bytes", "KB", "MB", "GB"):
+        if value < 1000 or unit == "GB":
+            return f"{int(value)} {unit}" if unit == "bytes" else f"{value:.3g} {unit}"
+        value /= 1000
+    raise AssertionError("unreachable")  # pragma: no cover
+
+
+_OOXML = "application/vnd.openxmlformats-officedocument"
+_ODF = "application/vnd.oasis.opendocument"
+
+_BUILTIN_TYPES: tuple[FileType, ...] = (
+    # --- raster & vector images -------------------------------------------------------
+    FileType(
+        "image/jpeg",
+        (".jpg", ".jpeg", ".jpe", ".jfif"),
+        "JPEG image",
+        aliases=("image/jpg", "image/pjpeg"),
+    ),
+    FileType("image/png", (".png",), "PNG image", aliases=("image/x-png",)),
+    FileType("image/gif", (".gif",), "GIF image"),
+    FileType("image/webp", (".webp",), "WebP image"),
+    FileType("image/bmp", (".bmp", ".dib"), "BMP image", aliases=("image/x-ms-bmp", "image/x-bmp")),
+    FileType("image/tiff", (".tif", ".tiff"), "TIFF image"),
+    FileType("image/vnd.microsoft.icon", (".ico",), "ICO icon", aliases=("image/x-icon",)),
+    FileType("image/avif", (".avif",), "AVIF image"),
+    FileType("image/heic", (".heic", ".heif"), "HEIC image", aliases=("image/heif",)),
+    FileType("image/svg+xml", (".svg",), "SVG image", is_text=True),
+    # --- documents --------------------------------------------------------------------
+    FileType("application/pdf", (".pdf",), "PDF document", aliases=("application/x-pdf",)),
+    FileType(f"{_OOXML}.wordprocessingml.document", (".docx",), "Word document", container="zip"),
+    FileType(f"{_OOXML}.spreadsheetml.sheet", (".xlsx",), "Excel workbook", container="zip"),
+    FileType(
+        f"{_OOXML}.presentationml.presentation",
+        (".pptx",),
+        "PowerPoint presentation",
+        container="zip",
+    ),
+    FileType(
+        "application/vnd.ms-word.document.macroenabled.12",
+        (".docm",),
+        "Word macro-enabled document",
+        container="zip",
+    ),
+    FileType(
+        "application/vnd.ms-excel.sheet.macroenabled.12",
+        (".xlsm",),
+        "Excel macro-enabled workbook",
+        container="zip",
+    ),
+    FileType(
+        "application/vnd.ms-powerpoint.presentation.macroenabled.12",
+        (".pptm",),
+        "PowerPoint macro-enabled presentation",
+        container="zip",
+    ),
+    FileType(f"{_ODF}.text", (".odt",), "OpenDocument text", container="zip"),
+    FileType(f"{_ODF}.spreadsheet", (".ods",), "OpenDocument spreadsheet", container="zip"),
+    FileType(f"{_ODF}.presentation", (".odp",), "OpenDocument presentation", container="zip"),
+    FileType("application/epub+zip", (".epub",), "EPUB e-book", container="zip"),
+    FileType(
+        "application/x-ole-storage",
+        (".doc", ".xls", ".ppt", ".msg"),
+        "OLE2 compound document (legacy Office)",
+        container="ole",
+        aliases=(
+            "application/msword",
+            "application/vnd.ms-excel",
+            "application/vnd.ms-powerpoint",
+            "application/vnd.ms-outlook",
+        ),
+    ),
+    FileType("application/rtf", (".rtf",), "Rich Text Format", aliases=("text/rtf",)),
+    FileType("application/postscript", (".ps", ".eps"), "PostScript"),
+    # --- text -------------------------------------------------------------------------
+    FileType("text/plain", (".txt", ".text", ".log"), "Plain text", is_text=True),
+    FileType(
+        "text/csv",
+        (".csv",),
+        "CSV",
+        is_text=True,
+        parent="text/plain",
+        aliases=("application/csv",),
+    ),
+    FileType("text/tab-separated-values", (".tsv",), "TSV", is_text=True, parent="text/plain"),
+    FileType("text/markdown", (".md", ".markdown"), "Markdown", is_text=True, parent="text/plain"),
+    FileType("application/json", (".json",), "JSON", is_text=True, parent="text/plain"),
+    FileType("text/html", (".html", ".htm", ".xhtml"), "HTML document", is_text=True),
+    FileType("application/xml", (".xml",), "XML document", is_text=True, aliases=("text/xml",)),
+    FileType(
+        "application/x-sh",
+        (".sh",),
+        "Shell script",
+        is_text=True,
+        aliases=("text/x-shellscript",),
+        executable=True,
+    ),
+    FileType(
+        "application/x-httpd-php",
+        (".php",),
+        "PHP script",
+        is_text=True,
+        aliases=("application/x-php", "text/x-php"),
+        executable=True,
+    ),
+    # --- archives ---------------------------------------------------------------------
+    FileType(
+        "application/zip",
+        (".zip",),
+        "ZIP archive",
+        container="zip",
+        aliases=("application/x-zip-compressed",),
+    ),
+    FileType("application/gzip", (".gz", ".tgz"), "gzip archive", aliases=("application/x-gzip",)),
+    FileType("application/x-tar", (".tar",), "tar archive"),
+    FileType("application/x-bzip2", (".bz2",), "bzip2 archive"),
+    FileType("application/x-xz", (".xz",), "xz archive"),
+    FileType("application/x-7z-compressed", (".7z",), "7-Zip archive"),
+    FileType(
+        "application/vnd.rar", (".rar",), "RAR archive", aliases=("application/x-rar-compressed",)
+    ),
+    FileType(
+        "application/java-archive", (".jar",), "Java archive", container="zip", executable=True
+    ),
+    FileType(
+        "application/vnd.android.package-archive",
+        (".apk",),
+        "Android package",
+        container="zip",
+        executable=True,
+    ),
+    # --- audio ------------------------------------------------------------------------
+    FileType("audio/mpeg", (".mp3",), "MP3 audio", aliases=("audio/mp3",)),
+    FileType(
+        "audio/wav", (".wav",), "WAV audio", aliases=("audio/x-wav", "audio/wave", "audio/vnd.wave")
+    ),
+    FileType("audio/ogg", (".ogg", ".oga", ".opus"), "Ogg audio"),
+    FileType("audio/flac", (".flac",), "FLAC audio", aliases=("audio/x-flac",)),
+    FileType("audio/mp4", (".m4a",), "MPEG-4 audio", aliases=("audio/x-m4a",)),
+    FileType("audio/aac", (".aac",), "AAC audio"),
+    # --- video ------------------------------------------------------------------------
+    FileType("video/mp4", (".mp4", ".m4v"), "MPEG-4 video"),
+    FileType("video/quicktime", (".mov", ".qt"), "QuickTime video"),
+    FileType("video/webm", (".webm",), "WebM video"),
+    FileType("video/x-matroska", (".mkv",), "Matroska video"),
+    FileType("video/x-msvideo", (".avi",), "AVI video", aliases=("video/avi", "video/msvideo")),
+    FileType("video/mpeg", (".mpeg", ".mpg"), "MPEG video"),
+    FileType("video/3gpp", (".3gp",), "3GPP video"),
+    # --- executables & other binaries (detected so they can be named and refused) -----
+    FileType(
+        "application/vnd.microsoft.portable-executable",
+        (".exe", ".dll", ".sys", ".scr"),
+        "Windows executable",
+        aliases=("application/x-msdownload", "application/x-dosexec"),
+        executable=True,
+    ),
+    FileType("application/x-elf", (".elf", ".so"), "ELF executable", executable=True),
+    FileType("application/x-mach-binary", (".dylib",), "Mach-O executable", executable=True),
+    FileType("application/java-vm", (".class",), "Java class file", executable=True),
+    FileType("application/wasm", (".wasm",), "WebAssembly module", executable=True),
+    FileType("application/vnd.sqlite3", (".sqlite", ".sqlite3", ".db"), "SQLite database"),
+)
+
+
+class _Registry:
+    """Thread-safe lookup tables built from the declared types."""
+
+    def __init__(self, types: Iterable[FileType]) -> None:
+        self._lock = threading.Lock()
+        self._by_mime: dict[str, FileType] = {}
+        self._by_alias: dict[str, FileType] = {}
+        self._by_ext: dict[str, list[FileType]] = {}
+        for ft in types:
+            self.register(ft)
+
+    def register(self, file_type: FileType) -> None:
+        with self._lock:
+            existing = self._by_mime.get(file_type.mime)
+            if existing is not None and existing != file_type:
+                raise ValueError(f"A different FileType is already registered for {file_type.mime}")
+            self._by_mime[file_type.mime] = file_type
+            for alias in file_type.aliases:
+                self._by_alias.setdefault(alias, file_type)
+            for ext in file_type.extensions:
+                bucket = self._by_ext.setdefault(ext, [])
+                if file_type not in bucket:
+                    bucket.append(file_type)
+
+    def get(self, mime: str) -> FileType | None:
+        bare = normalize_mime(mime)
+        return self._by_mime.get(bare) or self._by_alias.get(bare)
+
+    def for_extension(self, ext: str) -> tuple[FileType, ...]:
+        return tuple(self._by_ext.get(ext.lower(), ()))
+
+    def __iter__(self) -> Iterator[FileType]:
+        return iter(tuple(self._by_mime.values()))
+
+
+_registry = _Registry(_BUILTIN_TYPES)
+
+
+def get_type(mime: str) -> FileType | None:
+    """Look up a type by canonical MIME or alias (case and parameters ignored)."""
+    return _registry.get(mime)
+
+
+def resolve_mime(mime: str) -> FileType:
+    """Like :func:`get_type` but raise a helpful ``ValueError`` for unknown types."""
+    ft = _registry.get(mime)
+    if ft is None:
+        raise ValueError(
+            f"Unknown file type {mime!r}. Use a canonical MIME type such as 'image/jpeg', "
+            "a wildcard such as 'image/*', or register custom types with register_type()."
+        )
+    return ft
+
+
+def types_for_extension(ext: str) -> tuple[FileType, ...]:
+    """All registered types that use ``ext`` (e.g. ``".jpg"``)."""
+    return _registry.for_extension(ext)
+
+
+def all_types() -> tuple[FileType, ...]:
+    return tuple(_registry)
+
+
+def register_type(file_type: FileType) -> None:
+    """Register a custom type, e.g. one produced by a custom :class:`Sniffer`."""
+    _registry.register(file_type)

uploadshield/core/upload.py

@@ -0,0 +1,192 @@
+"""Framework-agnostic representation of an uploaded file."""
+
+from __future__ import annotations
+
+import hashlib
+import io
+import logging
+import shutil
+import tempfile
+from contextlib import contextmanager
+from dataclasses import dataclass
+from functools import cached_property
+from typing import IO, TYPE_CHECKING, Any, cast
+
+from .types import FileType, MiB, types_for_extension
+
+if TYPE_CHECKING:
+    from collections.abc import Generator, Iterator
+
+    from .sniffing import Sniffer
+
+__all__ = ["HEAD_SIZE", "ContentTooLargeError", "InspectedFile", "Upload"]
+
+logger = logging.getLogger("uploadshield")
+
+#: Bytes read from the start of a file for signature and text detection.
+HEAD_SIZE = 8 * 1024
+_CHUNK_SIZE = 1 * MiB
+
+
+class ContentTooLargeError(Exception):
+    """Raised when a check asks for more content than it is allowed to buffer."""
+
+
+@dataclass(frozen=True, slots=True)
+class Upload:
+    """The raw facts about an upload, as provided by the web framework.
+
+    ``name`` and ``declared_type`` are client-controlled and therefore untrusted.
+    """
+
+    stream: IO[bytes]
+    name: str
+    size: int | None = None
+    declared_type: str | None = None
+    field: str | None = None
+
+    @classmethod
+    def from_bytes(
+        cls,
+        data: bytes,
+        name: str,
+        *,
+        declared_type: str | None = None,
+        field: str | None = None,
+    ) -> Upload:
+        return cls(io.BytesIO(data), name, len(data), declared_type, field)
+
+
+class InspectedFile:
+    """A read-only, lazily analysed view over an :class:`Upload`.
+
+    Facts that several checks need (head bytes, detected type, hashes, container
+    listings) are computed at most once.  The underlying stream position is restored
+    after every read so the application can still consume the file afterwards.
+    """
+
+    def __init__(self, upload: Upload, sniffer: Sniffer) -> None:
+        self.upload = upload
+        self.name = upload.name or ""
+        self.field = upload.field
+        self.declared_type = upload.declared_type
+        self._sniffer = sniffer
+        self._stream = _ensure_seekable(upload.stream)
+        self._owns_stream = self._stream is not upload.stream
+        self._origin = self._stream.tell()
+        self.size = upload.size if upload.size is not None else self._measure()
+        self._head = b""
+        #: Scratch space so checks can share expensive parse results.
+        self.cache: dict[str, Any] = {}
+
+    def __repr__(self) -> str:
+        return f"<InspectedFile {self.name!r} size={self.size}>"
+
+    @property
+    def stream(self) -> IO[bytes]:
+        """The seekable stream (a private copy if the upload's stream was not seekable)."""
+        return self._stream
+
+    def close(self) -> None:
+        """Release the private copy made for non-seekable streams, if any."""
+        if self._owns_stream:
+            self._stream.close()
+
+    # -- raw access -------------------------------------------------------------------
+
+    @contextmanager
+    def open(self) -> Generator[IO[bytes], None, None]:
+        """Yield the stream positioned at the start; restore the position afterwards."""
+        try:
+            self._stream.seek(0)
+            yield self._stream
+        finally:
+            self._stream.seek(self._origin)
+
+    def head(self, n: int = HEAD_SIZE) -> bytes:
+        if len(self._head) < n and len(self._head) < self.size:
+            with self.open() as fh:
+                self._head = fh.read(max(n, HEAD_SIZE))
+        return self._head[:n]
+
+    def tail(self, n: int) -> bytes:
+        with self.open() as fh:
+            fh.seek(max(0, self.size - n))
+            return fh.read(n)
+
+    def read(self, limit: int) -> bytes:
+        """Return the whole content, refusing to buffer more than ``limit`` bytes."""
+        if self.size > limit:
+            raise ContentTooLargeError(f"{self.size} bytes exceeds the buffer limit of {limit}")
+        with self.open() as fh:
+            return fh.read(limit + 1)[:limit]
+
+    def iter_chunks(self, chunk_size: int = _CHUNK_SIZE) -> Iterator[bytes]:
+        with self.open() as fh:
+            while chunk := fh.read(chunk_size):
+                yield chunk
+
+    # -- derived facts ----------------------------------------------------------------
+
+    @cached_property
+    def extensions(self) -> tuple[str, ...]:
+        """Every dot-separated suffix, lowercased: ``"a.tar.GZ"`` -> ``(".tar", ".gz")``."""
+        stem = self.name.lstrip(".")
+        parts = stem.split(".")[1:]
+        return tuple(f".{p.lower()}" for p in parts if p)
+
+    @property
+    def extension(self) -> str:
+        """The final extension (``""`` if there is none)."""
+        return self.extensions[-1] if self.extensions else ""
+
+    @cached_property
+    def detected_type(self) -> FileType | None:
+        """The type proven by the file's content, or ``None`` if unidentifiable.
+
+        A crashing sniffer is logged and treated as "unidentifiable", which every
+        allow-list rejects (fail closed).
+        """
+        try:
+            return self._sniffer.sniff(self)
+        except Exception:
+            logger.exception("Sniffer %r crashed on %r", self._sniffer, self.name)
+            return None
+
+    @cached_property
+    def file_type(self) -> FileType | None:
+        """The detected type, narrowed by the extension where content cannot decide.
+
+        Content proves ``text/plain``; a ``.csv`` name may narrow it to ``text/csv``.
+        The extension can only ever *refine* the detected type, never contradict it.
+        """
+        detected = self.detected_type
+        if detected is None or not self.extension:
+            return detected
+        for candidate in types_for_extension(self.extension):
+            if candidate.parent == detected.mime:
+                return candidate
+        return detected
+
+    @cached_property
+    def sha256(self) -> str:
+        digest = hashlib.sha256()
+        for chunk in self.iter_chunks():
+            digest.update(chunk)
+        return digest.hexdigest()
+
+    # -- internals --------------------------------------------------------------------
+
+    def _measure(self) -> int:
+        end = self._stream.seek(0, io.SEEK_END)
+        self._stream.seek(self._origin)
+        return end
+
+
+def _ensure_seekable(stream: IO[bytes]) -> IO[bytes]:
+    if stream.seekable():
+        return stream
+    spooled = tempfile.SpooledTemporaryFile(max_size=8 * MiB)  # noqa: SIM115 - returned to caller
+    shutil.copyfileobj(stream, spooled)
+    spooled.seek(0)
+    return cast("IO[bytes]", spooled)

uploadshield/core/violations.py

@@ -0,0 +1,79 @@
+"""Structured reasons why a file was rejected."""
+
+from __future__ import annotations
+
+from dataclasses import dataclass, field
+from enum import StrEnum
+from types import MappingProxyType
+from typing import TYPE_CHECKING, Any
+
+if TYPE_CHECKING:
+    from collections.abc import Mapping
+
+__all__ = ["Code", "Violation"]
+
+
+class Code(StrEnum):
+    """Stable, machine-readable violation codes.
+
+    Codes are part of the public API: clients, log pipelines and translations key on
+    them.  Custom checks may use their own string codes.
+    """
+
+    FILE_EMPTY = "file_empty"
+    FILE_TOO_LARGE = "file_too_large"
+    FILENAME_INVALID = "filename_invalid"
+    FILENAME_TOO_LONG = "filename_too_long"
+    FILENAME_HIDDEN = "filename_hidden"
+    FILENAME_RESERVED = "filename_reserved"
+    FILENAME_DANGEROUS_EXTENSION = "filename_dangerous_extension"
+    FILENAME_MISSING_EXTENSION = "filename_missing_extension"
+    TYPE_UNKNOWN = "type_unknown"
+    TYPE_NOT_ALLOWED = "type_not_allowed"
+    EXTENSION_MISMATCH = "extension_mismatch"
+    CONTENT_MISMATCH = "content_mismatch"
+    DECLARED_TYPE_MISMATCH = "declared_type_mismatch"
+    IMAGE_CORRUPT = "image_corrupt"
+    IMAGE_TOO_LARGE = "image_too_large"
+    PDF_ACTIVE_CONTENT = "pdf_active_content"
+    ARCHIVE_CORRUPT = "archive_corrupt"
+    ARCHIVE_UNSAFE_PATH = "archive_unsafe_path"
+    ARCHIVE_BOMB = "archive_bomb"
+    ARCHIVE_ENCRYPTED = "archive_encrypted"
+    ARCHIVE_DANGEROUS_MEMBER = "archive_dangerous_member"
+    OFFICE_MACROS = "office_macros"
+    OFFICE_EXTERNAL_REFERENCE = "office_external_reference"
+    SVG_ACTIVE_CONTENT = "svg_active_content"
+    XML_DTD = "xml_dtd"
+    EMBEDDED_CODE = "embedded_code"
+    POLYGLOT = "polyglot"
+    MALWARE_DETECTED = "malware_detected"
+    SIGNATURE_MATCH = "signature_match"
+    SCANNER_UNAVAILABLE = "scanner_unavailable"
+    SANITIZATION_FAILED = "sanitization_failed"
+    CHECK_FAILED = "check_failed"
+
+
+@dataclass(frozen=True, slots=True)
+class Violation:
+    """One reason a file failed validation.
+
+    ``message`` is a short English sentence that is safe to show to the uploader.
+    ``details`` carries diagnostics (detected type, matched signatures, ...) that are
+    meant for logs and must not be exposed to clients by default.
+    """
+
+    code: str
+    message: str
+    check: str = ""
+    details: Mapping[str, Any] = field(default_factory=dict, compare=False)
+
+    def __post_init__(self) -> None:
+        object.__setattr__(self, "details", MappingProxyType(dict(self.details)))
+
+    def as_dict(self, *, include_details: bool = False) -> dict[str, Any]:
+        data: dict[str, Any] = {"code": str(self.code), "message": self.message}
+        if include_details:
+            data["check"] = self.check
+            data["details"] = dict(self.details)
+        return data

uploadshield/django/__init__.py

@@ -0,0 +1,36 @@
+"""Django integration, built on Django's own extension points.
+
+* ``FILE_UPLOAD_HANDLERS``: :class:`~uploadshield.django.handlers.ValidatingUploadHandler`
+  validates every uploaded file while the body is parsed (views, forms, admin, DRF).
+* :func:`validate_uploads` / :func:`skip_upload_validation`: per-view policies.
+* :class:`FileValidator` / :class:`ValidatedFileField`: per-field validation with
+  inline errors in forms, model ``full_clean`` and DRF serializers.
+* ``STORAGES``: :class:`~uploadshield.django.storage.ValidatingStorage`
+  validates everything that is persisted, inside or outside requests.
+* ``handler400``: :func:`uploadshield.django.views.bad_request` renders
+  rejections as 413/415/400 JSON or HTML.
+"""
+
+from .decorators import skip_upload_validation, validate_uploads
+from .exceptions import UploadRejected
+from .forms import ValidatedFileField
+from .responses import redirect_with_messages
+from .service import FileOutcome, RejectedUpload, UploadValidation, get_upload_validation
+from .signals import file_rejected, upload_rejected, upload_validated
+from .validators import FileValidator
+
+__all__ = [
+    "FileOutcome",
+    "FileValidator",
+    "RejectedUpload",
+    "UploadRejected",
+    "UploadValidation",
+    "ValidatedFileField",
+    "file_rejected",
+    "get_upload_validation",
+    "redirect_with_messages",
+    "skip_upload_validation",
+    "upload_rejected",
+    "upload_validated",
+    "validate_uploads",
+]

uploadshield/django/apps.py

@@ -0,0 +1,13 @@
+from django.apps import AppConfig
+
+
+class UploadShieldConfig(AppConfig):
+    """Registers system checks and ships the overridable rejection template."""
+
+    name = "uploadshield.django"
+    label = "uploadshield"
+    verbose_name = "UploadShield"
+
+    def ready(self) -> None:
+        # Importing the module registers the system checks.
+        from uploadshield.django import checks  # noqa: F401