File Guard

Checks files before upload, including their first bytes, so renamed, empty, duplicate or oversized files are caught before they start uploading.

StopsWrong file type uploaded

Installation

pnpm dlx shadcn@latest add https://bollard-ui.vercel.app/r/file-guard.json

The files land in your project. They're yours to edit.

Usage

file-guard-usage.tsx
import { FileGuard, type FileGuardHandle } from "@/components/ui/file-guard"

<FileGuard
  ref={guard}
  label="Upload documents"
  accept={[".pdf", ".png", ".jpg", ".docx"]}
  maxSize={2 * 1024 * 1024}
  maxFiles={4}
  onFilesChange={(files) => setReady(files.map((file) => file.name))}
/>

What it catches

  • Files over maxSize, or more than maxFiles
  • Types outside accept
  • A file whose content doesn't match its extension (renamed)
  • Empty files and duplicates

Props

FileGuard props
PropTypeDefault
accept

Allowed extensions, e.g. [".pdf", ".png"]. Omit to allow any type.

string[]—
maxSize

Largest allowed file in bytes.

number—
maxFiles

Most files that can be accepted at once.

number—
onFilesChange

Called with only the files that passed every check, whenever that list changes.

(files: File[]) => void—
label

Visible label for the drop zone's browse button.

string"Upload files"
hint

Text before the limits under the label.

string"Drop files here or browse"
ref

Imperative handle exposing `addFiles`.

React.Ref<FileGuardHandle>—

* required. Also accepts the native props of <div> (className, aria-*, data-*…), passed through to it.

Accessibility

  • The pick button is described by the hint; the native input is hidden from the tab order
  • Selected files are a labelled list; remove buttons name the file
  • Status is aria-live="polite"

Only what the source does. Test with your own screen reader and content before shipping.

Limitations

This is a UX guard rail. Enforce on the server: Re-validate size, type and content on the server and scan uploads; never trust the client's checks.

  • Magic-byte detection covers common formats only
  • Runs in the browser and is easy to bypass; it is not a malware scan

What it stops

Wrong file type uploaded

Also known as

file upload · dropzone · mime type · file size limit · magic bytes · react-dropzone · pdf upload · aadhaar upload

Field type

Dependencies

Pairs well with