HTML MASTER CLASS /// LEARN TAGS /// BUILD STRUCTURE /// SEMANTIC WEB /// HTML MASTER CLASS /// LEARN TAGS ///

Untitled Lesson

⚡ Total XP: 0|💻 backend XP: 0

Skill Matrix

UNLOCK NODES BY LEARNING NEW TAGS.

Select an unlocked node to view details root

Pascual Vila

Frontend Instructor // Code Syllabus

Common Pitfalls & Errors

The Error //

Validating an uploaded file's type based only on its extension or client-reported MIME type

// Wrong: trivially spoofable
if (req.file.mimetype === "image/jpeg") { /* accepted */ }

// Correct: validates the ACTUAL file content
const type = await fileTypeFromBuffer(req.file.buffer);
if (type?.mime !== "image/jpeg") throw new Error("Invalid file type");

The Solution //

Both the file extension and the client-reported Content-Type/MIME type are entirely controlled by the client and can be trivially spoofed — a malicious executable renamed with a .jpg extension and a fake image MIME type would pass this check easily. Validate the file's actual binary content/signature instead.

The Error //

Using the client-supplied original filename directly when saving an uploaded file to disk

// Wrong: path traversal risk
const savePath = path.join(UPLOAD_DIR, req.file.originalname);

// Correct: server-generated, safe filename
const safeFileName = `${crypto.randomUUID()}${path.extname(req.file.originalname)}`;

The Solution //

A client-supplied filename can contain path traversal sequences or special characters, potentially letting an attacker write a file outside the intended upload directory. Always generate a new, safe filename server-side rather than trusting or directly using client input for a file system path.