Although Drupal provides default security features, I still have a doubt related to the security of uploading a file using the file entity upload API URL.
If I have set the allowed file extension and also limited the size of the file one can upload in a content type, will it be secure enough for my website as users will upload their file through the API.
The reason I felt this is that I realized that, while uploading, the endpoint first accepts and creates the file in the temporary directory, and then verifies its validity according to the extension and size. In case of uploading a file directly through the website, it first checks if the file is valid and then allows it to be uploaded to the storage. This is not true for the API endpoint.
Can't someone upload a malicious file through the API?
Even if it verifies and denies later, the malicious file would already have entered the temporary storage.
Wouldn't it compromise the security of the server?
.htaccessfile to thetmpdirectory that prevents execution of code in the directory. As long as you have not done something to prevent the creation of that file, and have not removed it, you do not have to worry.