The FileUpload Gunner project is particularly useful in several high-stakes environments:
An SVG file can contain JavaScript. Changing the extension to .png but keeping <?xml> tags bypasses naive magic byte checks. : The project uses a two-pass validation—magic bytes plus a schema-specific parser. For SVG, it checks for <script> tags and disallows them. fileupload gunner project