The identified form handler should at a minimum:



1. Whitelist permitted file types and block all others. This should be
conducted on the MIME type of the file rather than its extension.

2. As the file is uploaded, and prior to being handled (written to the
disk) by the server, the filename should be stripped of all control,
special, or Unicode characters.

3. Ensure that the upload is conducted via the HTTP `POST` method rather
than `GET` or `PUT`.

4. Ensure that the file is written to a directory that does not hold
any execute permission and that all files within that directory inherit
the same permissions.

5. Scan (if possible) with an up-to-date virus scanner before being
stored.

6. Ensure that the application handles files as per the host operating
system. For example, the length of the file name is appropriate, there
is adequate space to store the file, protection against overwriting
other files etc.