ASVS 5.0 V14.2.8 is a Level 3 requirement. Sensitive information must be removed from the metadata of files users submit, unless the user has consented to storing it.
Why it matters
A photo can carry GPS coordinates, device model and time. A document can carry author names, revision history and file paths. If your site republishes the file, you may publish a home address that the uploader never typed anywhere.
How to implement it
Re encode images, which drops most metadata, or run a dedicated tool.
from PIL import Image
def strip_image(src, dst):
with Image.open(src) as im:
data = list(im.getdata())
clean = Image.new(im.mode, im.size)
clean.putdata(data)
clean.save(dst) # no EXIF is copied
exiftool -all= -overwrite_original upload.jpg
For office documents and PDFs, use a sanitizing step in your processing pipeline and keep the original only if policy allows. Strip before the file is stored or published, and keep the original private.
How to test it
Upload a test image that has GPS EXIF data. Download the stored or published copy and inspect it with exiftool. Location, camera and author fields must be absent.
Common mistakes
- Stripping only JPEG and forgetting PNG, HEIC, PDF and DOCX.
- Cleaning the thumbnail but publishing the original.
- Doing the cleanup in the browser, where it can be skipped.
Quick check
When may the metadata be kept?
When the user knowingly agrees, for example a photography site where location is a feature they choose to share.
