Skip to content

[BUG] Add MIME type validation for file uploads using magic numbers (#330)#364

Open
BhakktiGautam wants to merge 1 commit into
Durgeshwar-AI:mainfrom
BhakktiGautam:feature/mime-validation-clean
Open

[BUG] Add MIME type validation for file uploads using magic numbers (#330)#364
BhakktiGautam wants to merge 1 commit into
Durgeshwar-AI:mainfrom
BhakktiGautam:feature/mime-validation-clean

Conversation

@BhakktiGautam

Copy link
Copy Markdown

📌 Closes Issue

Closes #330

🐛 Problem

Current validation only checks file extensions. Malicious files renamed as .pdf can bypass validation.

✅ Solution

Implement magic number (MIME type sniffing) validation that reads file headers.

📁 Files Changed

File Change
backend/utils/mime_validator.py New
backend/utils/decorators.py Updated
backend/requirements.txt Updated
backend/blueprints/pdf.py Added decorator
backend/blueprints/image.py Added decorator
backend/blueprints/removebg.py Added decorator
backend/blueprints/pdf_to_docx.py Added decorator
backend/blueprints/docx_to_pdf.py Added decorator

✅ Rule Compliance

  • No data storage
  • No external APIs
  • Pure file manipulation

Request

  • Please add GSSoC label
  • Please add bug, security, level:beginner labels

Ready for review! 🚀

@vercel

vercel Bot commented Jun 16, 2026

Copy link
Copy Markdown

@BhakktiGautam is attempting to deploy a commit to the Durgeshwar's projects Team on Vercel.

A member of the Team first needs to authorize it.

@BhakktiGautam BhakktiGautam changed the title feat: add PDF embedded images extractor [BUG] Add MIME type validation for file uploads using magic numbers (#330) Jun 16, 2026
@BhakktiGautam

Copy link
Copy Markdown
Author

@Durgeshwar-AI

PRs #337, #339, #349 and #364 are ready to merge! 🚀

✅ All conflicts resolved
✅ Project rules followed
✅ GSSoC labels needed

Please review and merge when you get a chance. Thanks! 🙏

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[BUG] File extension validation can be bypassed with renamed malicious files

1 participant