Skip to main content

Configure File Content Validation in DocuShare 8.1

Updated

Applies to: Xerox DocuShare 8.1 

Overview

File Content Validation is a defense-in-depth upload security feature. DocuShare checks the binary signature, or magic bytes, at the beginning of an uploaded file and compares it with the file extension being claimed. For example, an executable renamed with a .pdf extension is rejected.

Validation is enabled by default and applies to these upload channels:

  • Web UI
  • MCP API
  • DSAPI
  • ConnectKey
  • File Watchers

The original file is not stored when validation fails. DocuShare records the user, channel, declared extension, and detected signature in the audit log.

File Content Validation is an additional security layer and does not replace anti-malware scanning.

Configure validation

  1. Sign in to DocuShare with an administrator account.
  2. Open Admin > Server Configuration > MIME Types.
  3. Locate File Content Validation.
  4. Review the validation setting for each upload channel.
  5. Leave validation enabled unless there is a documented operational reason to exempt a channel.
  6. Click Save.

Changes apply to the selected channels after the page is saved.

Manage allowed file types

The allowed-types whitelist is managed on the same MIME Types page. Extensions in the whitelist are subject to magic-byte validation. Extensions that are not in the whitelist are rejected outright.

When adding a format, confirm that DocuShare has a corresponding magic-byte rule. Adding an extension without a corresponding validation rule can allow the format to be accepted without content validation.

Troubleshooting rejected uploads

If a file is rejected:

  1. Confirm that the file extension matches the actual file format.
  2. Confirm that the extension is present in the MIME Types whitelist.
  3. Check the audit log for the channel, declared extension, and detected signature.
  4. If the file is generated by a legacy integration, confirm that the integration produces a valid file rather than a synthetic or renamed file.

Do not disable validation as a first response. Disabling it reopens the selected upload channel to extension-spoofing attacks.