uploadshield 2.0.0__tar.gz

uploadshield-2.0.0/LICENSE

@@ -0,0 +1,202 @@
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

uploadshield-2.0.0/PKG-INFO

@@ -0,0 +1,239 @@
+Metadata-Version: 2.4
+Name: uploadshield
+Version: 2.0.0
+Summary: Content-aware validation and sanitization of file uploads for Django, Flask and FastAPI.
+Keywords: django,flask,fastapi,upload,file,validation,sanitization,security,malware
+Author: IV1T3
+Author-email: IV1T3 <xandi98@web.de>
+License-Expression: Apache-2.0
+License-File: LICENSE
+Classifier: Development Status :: 4 - Beta
+Classifier: Framework :: Django
+Classifier: Framework :: Django :: 4.2
+Classifier: Framework :: Django :: 5.2
+Classifier: Framework :: Django :: 6.0
+Classifier: Framework :: FastAPI
+Classifier: Framework :: Flask
+Classifier: Intended Audience :: Developers
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3 :: Only
+Classifier: Topic :: Security
+Classifier: Typing :: Typed
+Requires-Dist: django>=4.2 ; extra == 'all'
+Requires-Dist: flask>=2.3 ; extra == 'all'
+Requires-Dist: fastapi>=0.110 ; extra == 'all'
+Requires-Dist: python-multipart>=0.0.9 ; extra == 'all'
+Requires-Dist: pillow>=10.0 ; extra == 'all'
+Requires-Dist: yara-python>=4.3 ; extra == 'all'
+Requires-Dist: python-magic>=0.4.27 ; extra == 'all'
+Requires-Dist: magika>=1.0 ; python_full_version < '3.15' and extra == 'all'
+Requires-Dist: django>=4.2 ; extra == 'django'
+Requires-Dist: fastapi>=0.110 ; extra == 'fastapi'
+Requires-Dist: python-multipart>=0.0.9 ; extra == 'fastapi'
+Requires-Dist: flask>=2.3 ; extra == 'flask'
+Requires-Dist: pillow>=10.0 ; extra == 'images'
+Requires-Dist: python-magic>=0.4.27 ; extra == 'magic'
+Requires-Dist: magika>=1.0 ; python_full_version < '3.15' and extra == 'magika'
+Requires-Dist: yara-python>=4.3 ; extra == 'yara'
+Requires-Python: >=3.11
+Project-URL: Homepage, https://github.com/IV1T3/uploadshield
+Project-URL: Issues, https://github.com/IV1T3/uploadshield/issues
+Provides-Extra: all
+Provides-Extra: django
+Provides-Extra: fastapi
+Provides-Extra: flask
+Provides-Extra: images
+Provides-Extra: magic
+Provides-Extra: magika
+Provides-Extra: yara
+Description-Content-Type: text/markdown
+
+# uploadshield
+
+Content-aware validation and sanitization of file uploads for Django, Flask and FastAPI.
+
+Web frameworks hand you the filename and `Content-Type` of an upload as if they were
+facts. They are whatever the client sent: a PHP web shell named `cat.png` with
+`Content-Type: image/png` arrives as an image in Django, Flask and FastAPI alike.
+uploadshield judges the **bytes** instead. It detects the real format, checks it
+against what the endpoint accepts, looks inside documents and archives for active
+content, and can rewrite images so that hidden payloads and metadata are destroyed.
+
+## Try it in 10 seconds
+
+No code needed; [uv](https://docs.astral.sh/uv/) runs it straight from PyPI:
+
+```console
+$ uvx uploadshield scan uploads/
+uploads/
+  ✗ avatar.png  PHP script · 30 bytes
+      type_not_allowed  PHP script files are not allowed.
+      embedded_code  The file contains embedded code.  <?php
+  ? backup.tar.gz  gzip archive · 132 bytes
+      type_not_allowed  Its contents cannot be inspected: unpack it and scan the files, or add --clamav.
+  ! holiday.png  JPEG image · 14.6 KB
+      extension_mismatch  The file extension '.png' does not match its content (JPEG image).
+  ✗ invoice.pdf  PDF document · 293 bytes
+      pdf_active_content  The PDF contains active content such as scripts or embedded files.  JS, JavaScript
+  ✓ notes.txt  Plain text · 14 bytes
+  ✓ report.pdf  PDF document · 180 KB
+
+6 files in 0.0 s: 2 clean, 2 dangerous, 1 refused, 1 not verified.
+```
+
+`uploadshield validate FILE --policy NAME` shows exactly why a policy accepts or
+refuses a file. See the [command line guide](docs/cli.md).
+
+## What it protects against
+
+- **Disguised files**: scripts and executables named `.png` or `.pdf`. The format
+  comes from the content, never from the name.
+- **Dangerous names**: `shell.php.jpg`, `.htaccess`, `../../etc/passwd`, `CON.txt`,
+  bidi-override tricks, and their percent-encoded and fullwidth variants.
+- **Active documents**: PDFs with JavaScript or embedded files, Office files with
+  macros, DDE fields or remote templates, SVGs with scripts, XML with entity bombs.
+- **Archive attacks**: ZIP bombs, zip slip, symbolic links, deeply nested archives,
+  and members a server would run once extracted.
+- **Hidden payloads**: PHP in image metadata, polyglots such as GIFAR, CSV cells that
+  run commands through DDE (`=cmd|' /C calc'!A0`).
+- **Malware**, with ClamAV or your own YARA rules, and optionally Google's Magika model
+  for scripts disguised as data.
+
+It fails closed: a check that crashes, a file too large to inspect, an encrypted file
+or an unreachable virus scanner means a refusal. Image decoding needs Pillow, the
+`images` extra (`uvx --from "uploadshield[images]" uploadshield scan ...`); without it
+the command line warns that image checks are inactive. The
+[checks reference](docs/checks.md) lists everything each check catches, and what it
+does not.
+
+## Add it to your app
+
+```bash
+uv add "uploadshield[django,images]"    # or [flask,images] or [fastapi,images]
+```
+
+**Django**: every file is checked while the request body streams in, in views, forms,
+the admin and Django REST framework.
+
+```python
+# settings.py
+INSTALLED_APPS += ["uploadshield.django"]
+FILE_UPLOAD_HANDLERS = ["uploadshield.django.handlers.ValidatingUploadHandler"]
+
+# urls.py (root URLconf): answer refusals with 413/415/400, as JSON or HTML
+handler400 = "uploadshield.django.views.bad_request"
+```
+
+**Flask**: every multipart request is checked before it reaches a view.
+
+```python
+from flask import Flask
+
+from uploadshield.flask import UploadShield
+
+app = Flask(__name__)
+app.config["MAX_CONTENT_LENGTH"] = 50 * 1024 * 1024  # Werkzeug parses the body first
+UploadShield(app)
+```
+
+**FastAPI**: dependencies validate and sanitize uploads; `all_files()` covers the
+whole app.
+
+```python
+from typing import Annotated
+
+from fastapi import Depends, FastAPI, UploadFile
+
+from uploadshield.fastapi import UploadShield
+
+shield = UploadShield()
+app = FastAPI(dependencies=[Depends(shield.all_files())])
+
+
+@app.post("/avatar")
+async def avatar(
+    file: Annotated[UploadFile, Depends(shield.file("sanitized_images"))],
+): ...  # re-encoded, renamed, with the content type detected from the bytes
+```
+
+That's it: every upload is now checked against the built-in `default` policy (common
+images, PDF, Office and OpenDocument files, text and CSV, audio and video, up to
+50 MB). Your code only receives files that passed; the others are answered with 413,
+415 or 400. On an existing site, start with `"MODE": "report"` to log would-be
+refusals without blocking anything.
+
+The guides cover every option: [Django](docs/django.md), [Flask](docs/flask.md),
+[FastAPI](docs/fastapi.md).
+
+## Decide what to accept
+
+A **policy** says which files an endpoint accepts. Pick a built-in one, or derive your
+own:
+
+```python
+from uploadshield import MB, Policy, presets
+
+AVATARS = presets.SANITIZED_IMAGES.replace(name="avatars", max_size=2 * MB)
+INVOICES = Policy(
+    name="invoices",
+    allowed_types={"application/pdf", "image/png", "image/jpeg"},
+    max_size=5 * MB,
+)
+```
+
+| Built-in policy | Accepts | Size limit |
+|---|---|---|
+| `default` | everything below | 50 MB |
+| `images` | JPEG, PNG, GIF, WebP | 10 MB |
+| `sanitized_images` | the same, re-encoded and randomly renamed | 10 MB |
+| `pdf` | PDF | 25 MB |
+| `documents` | PDF, Word, Excel, PowerPoint, OpenDocument, text, CSV | 25 MB |
+| `media` | common audio and video formats | 500 MB |
+
+Use one per view (`@validate_uploads("pdf")` in Django and Flask,
+`shield.file("pdf")` in FastAPI), per URL pattern, or per form field. The
+[policy guide](docs/policies.md) covers allowed types, filename rules, tuning checks,
+virus scanners and sanitizers.
+
+## How it works
+
+![The client's upload is parsed by Django, Flask or FastAPI, which hands every file to
+uploadshield. uploadshield checks size, filename, the type proven by the bytes, the
+allow-list and the content, then sanitizes. Passing files reach your view; refused
+files never do, and the client receives a 400, 413 or 415.](docs/images/upload-flow.svg)
+
+- **Cheapest checks first.** A forbidden name is refused before any content is read;
+  expensive parsers only see files that passed the cheap checks.
+- **Your code only sees files that passed**, sanitized if the policy says so, with the
+  content type detected from the bytes.
+- **Every refusal is answered and recorded**: a stable code, a 400/413/415 response, a
+  structured log record and a signal or callback.
+
+[Concepts](docs/concepts.md) explains the model; [Architecture](docs/ARCHITECTURE.md)
+how it is built.
+
+## Documentation
+
+| Page | What you find there |
+|---|---|
+| [Concepts](docs/concepts.md) | how uploadshield works, in one read |
+| [Django](docs/django.md) · [Flask](docs/flask.md) · [FastAPI](docs/fastapi.md) | setup, every option, refusals, testing |
+| [Command line](docs/cli.md) | `scan`, `validate`, JSON output for CI |
+| [Policies](docs/policies.md) | choosing and configuring what to accept |
+| [Checks and sanitizers](docs/checks.md) | every check with all its options |
+| [Refusals](docs/refusals.md) | codes, status codes, messages, logs |
+| [Python API](docs/python-api.md) | using the engine directly, custom checks and types |
+| [All docs](docs/README.md) | the full map, and [`llms.txt`](llms.txt) for AI agents |
+
+## Security and compatibility
+
+- **Mapped to OWASP**: every recommendation of OWASP's File Upload Cheat Sheet and
+  every test case of its Unrestricted File Upload page, with its coverage and the tests
+  that prove it, is in [docs/OWASP.md](docs/OWASP.md).
+- **Supported**: Python 3.11+, Django 4.2+, Flask 2.3+, FastAPI 0.110+.
+- **No required dependencies.** Pillow, YARA, Magika and libmagic are optional extras.
+- **Typed** (`py.typed`), with about 2500 tests including property-based fuzzing.
+- **Coming from django-middleware-fileuploadvalidation 1.x?** See
+  [Migrating from 1.x](docs/migrating-from-1.x.md).
+
+Contributing: see [Development](docs/development.md). License: Apache-2.0.

uploadshield-2.0.0/README.md

@@ -0,0 +1,189 @@
+# uploadshield
+
+Content-aware validation and sanitization of file uploads for Django, Flask and FastAPI.
+
+Web frameworks hand you the filename and `Content-Type` of an upload as if they were
+facts. They are whatever the client sent: a PHP web shell named `cat.png` with
+`Content-Type: image/png` arrives as an image in Django, Flask and FastAPI alike.
+uploadshield judges the **bytes** instead. It detects the real format, checks it
+against what the endpoint accepts, looks inside documents and archives for active
+content, and can rewrite images so that hidden payloads and metadata are destroyed.
+
+## Try it in 10 seconds
+
+No code needed; [uv](https://docs.astral.sh/uv/) runs it straight from PyPI:
+
+```console
+$ uvx uploadshield scan uploads/
+uploads/
+  ✗ avatar.png  PHP script · 30 bytes
+      type_not_allowed  PHP script files are not allowed.
+      embedded_code  The file contains embedded code.  <?php
+  ? backup.tar.gz  gzip archive · 132 bytes
+      type_not_allowed  Its contents cannot be inspected: unpack it and scan the files, or add --clamav.
+  ! holiday.png  JPEG image · 14.6 KB
+      extension_mismatch  The file extension '.png' does not match its content (JPEG image).
+  ✗ invoice.pdf  PDF document · 293 bytes
+      pdf_active_content  The PDF contains active content such as scripts or embedded files.  JS, JavaScript
+  ✓ notes.txt  Plain text · 14 bytes
+  ✓ report.pdf  PDF document · 180 KB
+
+6 files in 0.0 s: 2 clean, 2 dangerous, 1 refused, 1 not verified.
+```
+
+`uploadshield validate FILE --policy NAME` shows exactly why a policy accepts or
+refuses a file. See the [command line guide](docs/cli.md).
+
+## What it protects against
+
+- **Disguised files**: scripts and executables named `.png` or `.pdf`. The format
+  comes from the content, never from the name.
+- **Dangerous names**: `shell.php.jpg`, `.htaccess`, `../../etc/passwd`, `CON.txt`,
+  bidi-override tricks, and their percent-encoded and fullwidth variants.
+- **Active documents**: PDFs with JavaScript or embedded files, Office files with
+  macros, DDE fields or remote templates, SVGs with scripts, XML with entity bombs.
+- **Archive attacks**: ZIP bombs, zip slip, symbolic links, deeply nested archives,
+  and members a server would run once extracted.
+- **Hidden payloads**: PHP in image metadata, polyglots such as GIFAR, CSV cells that
+  run commands through DDE (`=cmd|' /C calc'!A0`).
+- **Malware**, with ClamAV or your own YARA rules, and optionally Google's Magika model
+  for scripts disguised as data.
+
+It fails closed: a check that crashes, a file too large to inspect, an encrypted file
+or an unreachable virus scanner means a refusal. Image decoding needs Pillow, the
+`images` extra (`uvx --from "uploadshield[images]" uploadshield scan ...`); without it
+the command line warns that image checks are inactive. The
+[checks reference](docs/checks.md) lists everything each check catches, and what it
+does not.
+
+## Add it to your app
+
+```bash
+uv add "uploadshield[django,images]"    # or [flask,images] or [fastapi,images]
+```
+
+**Django**: every file is checked while the request body streams in, in views, forms,
+the admin and Django REST framework.
+
+```python
+# settings.py
+INSTALLED_APPS += ["uploadshield.django"]
+FILE_UPLOAD_HANDLERS = ["uploadshield.django.handlers.ValidatingUploadHandler"]
+
+# urls.py (root URLconf): answer refusals with 413/415/400, as JSON or HTML
+handler400 = "uploadshield.django.views.bad_request"
+```
+
+**Flask**: every multipart request is checked before it reaches a view.
+
+```python
+from flask import Flask
+
+from uploadshield.flask import UploadShield
+
+app = Flask(__name__)
+app.config["MAX_CONTENT_LENGTH"] = 50 * 1024 * 1024  # Werkzeug parses the body first
+UploadShield(app)
+```
+
+**FastAPI**: dependencies validate and sanitize uploads; `all_files()` covers the
+whole app.
+
+```python
+from typing import Annotated
+
+from fastapi import Depends, FastAPI, UploadFile
+
+from uploadshield.fastapi import UploadShield
+
+shield = UploadShield()
+app = FastAPI(dependencies=[Depends(shield.all_files())])
+
+
+@app.post("/avatar")
+async def avatar(
+    file: Annotated[UploadFile, Depends(shield.file("sanitized_images"))],
+): ...  # re-encoded, renamed, with the content type detected from the bytes
+```
+
+That's it: every upload is now checked against the built-in `default` policy (common
+images, PDF, Office and OpenDocument files, text and CSV, audio and video, up to
+50 MB). Your code only receives files that passed; the others are answered with 413,
+415 or 400. On an existing site, start with `"MODE": "report"` to log would-be
+refusals without blocking anything.
+
+The guides cover every option: [Django](docs/django.md), [Flask](docs/flask.md),
+[FastAPI](docs/fastapi.md).
+
+## Decide what to accept
+
+A **policy** says which files an endpoint accepts. Pick a built-in one, or derive your
+own:
+
+```python
+from uploadshield import MB, Policy, presets
+
+AVATARS = presets.SANITIZED_IMAGES.replace(name="avatars", max_size=2 * MB)
+INVOICES = Policy(
+    name="invoices",
+    allowed_types={"application/pdf", "image/png", "image/jpeg"},
+    max_size=5 * MB,
+)
+```
+
+| Built-in policy | Accepts | Size limit |
+|---|---|---|
+| `default` | everything below | 50 MB |
+| `images` | JPEG, PNG, GIF, WebP | 10 MB |
+| `sanitized_images` | the same, re-encoded and randomly renamed | 10 MB |
+| `pdf` | PDF | 25 MB |
+| `documents` | PDF, Word, Excel, PowerPoint, OpenDocument, text, CSV | 25 MB |
+| `media` | common audio and video formats | 500 MB |
+
+Use one per view (`@validate_uploads("pdf")` in Django and Flask,
+`shield.file("pdf")` in FastAPI), per URL pattern, or per form field. The
+[policy guide](docs/policies.md) covers allowed types, filename rules, tuning checks,
+virus scanners and sanitizers.
+
+## How it works
+
+![The client's upload is parsed by Django, Flask or FastAPI, which hands every file to
+uploadshield. uploadshield checks size, filename, the type proven by the bytes, the
+allow-list and the content, then sanitizes. Passing files reach your view; refused
+files never do, and the client receives a 400, 413 or 415.](docs/images/upload-flow.svg)
+
+- **Cheapest checks first.** A forbidden name is refused before any content is read;
+  expensive parsers only see files that passed the cheap checks.
+- **Your code only sees files that passed**, sanitized if the policy says so, with the
+  content type detected from the bytes.
+- **Every refusal is answered and recorded**: a stable code, a 400/413/415 response, a
+  structured log record and a signal or callback.
+
+[Concepts](docs/concepts.md) explains the model; [Architecture](docs/ARCHITECTURE.md)
+how it is built.
+
+## Documentation
+
+| Page | What you find there |
+|---|---|
+| [Concepts](docs/concepts.md) | how uploadshield works, in one read |
+| [Django](docs/django.md) · [Flask](docs/flask.md) · [FastAPI](docs/fastapi.md) | setup, every option, refusals, testing |
+| [Command line](docs/cli.md) | `scan`, `validate`, JSON output for CI |
+| [Policies](docs/policies.md) | choosing and configuring what to accept |
+| [Checks and sanitizers](docs/checks.md) | every check with all its options |
+| [Refusals](docs/refusals.md) | codes, status codes, messages, logs |
+| [Python API](docs/python-api.md) | using the engine directly, custom checks and types |
+| [All docs](docs/README.md) | the full map, and [`llms.txt`](llms.txt) for AI agents |
+
+## Security and compatibility
+
+- **Mapped to OWASP**: every recommendation of OWASP's File Upload Cheat Sheet and
+  every test case of its Unrestricted File Upload page, with its coverage and the tests
+  that prove it, is in [docs/OWASP.md](docs/OWASP.md).
+- **Supported**: Python 3.11+, Django 4.2+, Flask 2.3+, FastAPI 0.110+.
+- **No required dependencies.** Pillow, YARA, Magika and libmagic are optional extras.
+- **Typed** (`py.typed`), with about 2500 tests including property-based fuzzing.
+- **Coming from django-middleware-fileuploadvalidation 1.x?** See
+  [Migrating from 1.x](docs/migrating-from-1.x.md).
+
+Contributing: see [Development](docs/development.md). License: Apache-2.0.