NodeBB / NodeBB / 27554239790 / 1

85%

master: 85%

push

github

fix(uploads): replace extension-based MIME validation with content sniffing

The validateUploadedFileMime function used mime.getType() which derives MIME type from file extension only, not file content. This allowed a file with an allowed extension (e.g. .jpg) containing non-image content to bypass the upload:post:image privilege check.

Replaced with file-type's fileTypeFromFile() which reads magic bytes from the file header to detect the actual MIME type. For files without magic bytes (text, html, etc.), falls back to extension-based detection via mime.getType().

Added file-type@22.0.1 as a dependency in install/package.json.

Assisted-by: unsloth/Qwen3.6-35B-A3B-GGUF

13136 of 18211 branches covered (72.13%)

27750 of 32697 relevant lines covered (84.87%)

730.95 hits per line