Gallery.technet.microsoft.com

Limit file types & prevent any file types that may be interpreted by the web server as well as validate the file types by checking the file header. Do not save the uploaded file in the same web context as the application. Do not pass directory or file paths to the user, use index values mapped to pre-defined paths. ................
................