Do not rely exclusively on sanity checks of file contents to ensure that the file is of
the expected type and size. It may be possible for an attacker to hide code in some file
segments that will still be executed by the server. For example, GIF images may contain
a free-form comments field.