bermudalambandClaude Opus 5
35b242a66f
The upload bounded size and count and nothing else: POST /api/admin/items would take a PDF, a zip or an executable and store it as an item image, under an extension copied from whatever the caller named their file. Those files are served by express.static from the application's own origin, so a stored .html came back as text/html and a .svg as image/svg+xml — both able to run script as the site. Three types are accepted: JPEG, PNG and WebP. SVG is excluded deliberately even though it is an image, because it executes script when navigated to directly, which is the exposure #103 describes; a photograph of a one-of-a-kind item is never a vector drawing, so nothing real is lost. GIF is excluded as simply not wanted for product stills. Validation happens twice, because once is not enough. The declared content type is checked in multer's fileFilter, before a byte is written — that catches picking a PDF by accident, which is most of what goes wrong. But file.mimetype is whatever the caller wrote in the multipart headers, so the bytes are checked too: each stored file's leading bytes must match the format it claimed. That is what stops evil.html renamed to photo.jpg and declared image/jpeg, which an allowlist on the declared type alone waves straight through. The byte check cannot live in fileFilter — that runs before multer has read the stream, so there is nothing to look at yet. It runs after the write instead, and a failure removes every file from the request rather than only the offending one: accepting the good half of a refused upload would leave files on the volume that nothing references. Handles are closed before anything is unlinked, because an open handle makes the unlink fail on Windows. The stored name now takes its extension from the validated type rather than from path.extname(file.originalname), so the name on disk cannot disagree with what the file is. The random UUID is unchanged — that was already right, and its comment explains why. The picker offers exactly those three types rather than image/*, so a choice the API will refuse is not on the menu in the first place. That is a convenience, not a control: the operating system's All files option remains, drag-and-drop ignores accept, and anything calling the API directly never sees it. The server is the control. Nine integration tests, and they are the first in this project to upload real file content — which is why none of this was noticed. They cover a genuine PNG accepted, a PDF refused, SVG refused, HTML wearing image/jpeg refused, nothing left on the volume after a refusal, a mixed request discarding its valid file too, and no item created when the upload fails. Plus 21 unit tests on the pure signature checks, including a RIFF container that is not WebP. Verified: 162 unit, 178 integration, 94 end-to-end on a fresh container. Backend lint holds at 4 warnings — it caught the now-unused path import, which is exactly what it is for. Refs #95 Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
91 lines
3.5 KiB
TypeScript
91 lines
3.5 KiB
TypeScript
/**
|
|
* What the inventory upload will accept, and how to tell whether a file is
|
|
* actually what it says it is.
|
|
*
|
|
* Kept apart from the route so the rules are pure and can be tested directly.
|
|
* A mistake here is not a cosmetic one: uploads are served by express.static
|
|
* from the application's own origin, so a file that gets through and is later
|
|
* navigated to runs as same-origin content. See #95 and #103.
|
|
*/
|
|
|
|
/**
|
|
* Deliberately three types, not `image/*`.
|
|
*
|
|
* SVG is excluded even though it is an image: it can carry script that executes
|
|
* when the file is navigated to directly, which is precisely the exposure #103
|
|
* describes. A photograph of a one-of-a-kind item is never a vector drawing, so
|
|
* nothing real is lost.
|
|
*
|
|
* GIF is excluded as simply not wanted for product stills rather than for any
|
|
* security reason. Adding it later means adding its signature below too.
|
|
*
|
|
* The frontend's `accept` attribute lists these same three so the file picker
|
|
* offers exactly what the server will take. The list unavoidably exists in two
|
|
* runtimes; if it changes here, change it there.
|
|
*/
|
|
export const ALLOWED_IMAGE_TYPES: readonly string[] = ['image/jpeg', 'image/png', 'image/webp'];
|
|
|
|
/**
|
|
* How many bytes of a file are needed to check any signature below. WebP is the
|
|
* longest reach: it needs byte 8 onwards.
|
|
*/
|
|
export const SIGNATURE_BYTES = 12;
|
|
|
|
const EXTENSION_FOR_TYPE: Readonly<Record<string, string>> = {
|
|
'image/jpeg': '.jpg',
|
|
'image/png': '.png',
|
|
'image/webp': '.webp'
|
|
};
|
|
|
|
export function isAllowedImageType(mimetype: string): boolean {
|
|
return ALLOWED_IMAGE_TYPES.includes(mimetype);
|
|
}
|
|
|
|
/**
|
|
* The extension a stored file should carry, derived from its validated type.
|
|
*
|
|
* Returns null for anything unrecognised so a caller has to handle it, rather
|
|
* than defaulting to an empty string and writing a file with no extension at
|
|
* all. The stored name comes from this instead of from the submitted filename,
|
|
* so the name on disk cannot disagree with what the file is.
|
|
*/
|
|
export function extensionFor(mimetype: string): string | null {
|
|
return EXTENSION_FOR_TYPE[mimetype] ?? null;
|
|
}
|
|
|
|
function startsWithBytes(head: Buffer, offset: number, expected: readonly number[]): boolean {
|
|
if (head.length < offset + expected.length) {
|
|
return false;
|
|
}
|
|
return expected.every((byte, index) => head[offset + index] === byte);
|
|
}
|
|
|
|
const ASCII_RIFF = [0x52, 0x49, 0x46, 0x46];
|
|
const ASCII_WEBP = [0x57, 0x45, 0x42, 0x50];
|
|
|
|
/**
|
|
* Whether a file's leading bytes agree with the content type it was declared as.
|
|
*
|
|
* `file.mimetype` comes from the client's multipart headers and is whatever the
|
|
* caller chose to write there, so the allowlist alone stops honest mistakes and
|
|
* nothing else. This is what stops `evil.html` renamed to `photo.jpg` and sent
|
|
* as `image/jpeg`.
|
|
*
|
|
* Fails closed on a short read and on any type not in the allowlist, so a
|
|
* truncated file or an unexpected type is refused rather than assumed fine.
|
|
*/
|
|
export function signatureMatches(mimetype: string, head: Buffer): boolean {
|
|
switch (mimetype) {
|
|
case 'image/jpeg':
|
|
return startsWithBytes(head, 0, [0xff, 0xd8, 0xff]);
|
|
case 'image/png':
|
|
return startsWithBytes(head, 0, [0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a]);
|
|
// A RIFF container is not necessarily a WebP — a .wav opens the same way —
|
|
// so both the container marker and the format marker are checked.
|
|
case 'image/webp':
|
|
return startsWithBytes(head, 0, ASCII_RIFF) && startsWithBytes(head, 8, ASCII_WEBP);
|
|
default:
|
|
return false;
|
|
}
|
|
}
|