LykanShield protection layer

File Injection Filter

Block executable and disguised server-side filenames at the upload boundary.

Read integration guide View source on GitHub →

Overview

Filename policy before storage

LykanShield normalizes path separators, strips directory components and trailing special characters, then evaluates the final extension against a configurable denylist. It also catches disguised names such as payload.php.html.

Request lifecycle

How it works

  1. 01

    Normalize name

    Path components and trailing dots or whitespace are removed safely.

  2. 02

    Evaluate extension

    The lowercase extension is checked against the configured forbidden list.

  3. 03

    Reject disguise

    Double-extension HTML and HTM patterns are detected and blocked.

Implementation

Technical details

  • Default denylist includes PHP, Perl, CGI, ASP and common executable script types.
  • Handles Windows and Unix path separators before basename extraction.
  • Detects three-letter executable extensions hidden before .html or .htm.
  • Reports blocked filenames as FILE_INJECT without persisting them.

Filename policy

<?php
lykan_config::$config['filter_active']['file_inject'] = true;
lykan_config::$config['forbidden_file_ext'] = [
    'php', 'php3', 'php5', 'pl',
    'cgi', 'asp', 'exe', 'cmd', 'bat'
];
lykan::run(__DIR__);