NodeBB / NodeBB / 27554239790

85%

master: 85%

push

github

fix(uploads): replace extension-based MIME validation with content sniffing

The validateUploadedFileMime function used mime.getType() which derives MIME type from file extension only, not file content. This allowed a file with an allowed extension (e.g. .jpg) containing non-image content to bypass the upload:post:image privilege check.

Replaced with file-type's fileTypeFromFile() which reads magic bytes from the file header to detect the actual MIME type. For files without magic bytes (text, html, etc.), falls back to extension-based detection via mime.getType().

Added file-type@22.0.1 as a dependency in install/package.json.

Assisted-by: unsloth/Qwen3.6-35B-A3B-GGUF

14105 of 19257 branches covered (73.25%)

5 of 5 new or added lines in 1 file covered. (100.0%)

29454 of 34484 relevant lines covered (85.41%)

3475.0 hits per line