Add optional MIME type validation for uploaded files using libmagic
- Dominant language
- No language data
- Stars
- 188
- Forks
- 7
- PR merge metrics
- No merged PRs in 30d
Description
## Summary
Add an optional feature to validate uploaded file MIME types using `libmagic` (python-magic), rather than relying solely on client-supplied `Content-Type` headers.
## Motivation
Currently, Django's `MultiPartParser` accepts the `Content-Type` header provided by the client without validation (see `django/http/multipartparser.py`, lines 275-278). While this is documented behavior and developers are responsible for sanitizing user input, many developers are unaware of this and trust `UploadedFile.content_type` for file type validation.
This can lead to security issues when:
- Developers use `content_type` to restrict uploads (e.g., "only accept images")
- Applications serve uploaded files with the original `Content-Type`
- File processing pipelines make decisions based on `content_type`
## Proposal
Add an optional `libmagic`-based MIME type detection to `UploadedFile`:
```python
# Option 1: New method
uploaded_file.detected_content_type # Returns libmagic-detected MIME type
# Option 2: Setting to enable validation
# settings.py
FILE_UPLOAD_VALIDATE_CONTENT_TYPE = True # Validates Content-Type matches actual file
```
## Considerations
- **Dependency**: `python-magic` would be an optional dependency
- **Performance**: Magic byte detection adds overhead; should be opt-in
- **Backwards compatibility**: Existing behavior unchanged by default
## Prior Art
- Flask/Werkzeug: Developers commonly use `python-magic` manually
- Rails: Active Storage has built-in content type detection
- Laravel: Has MIME type validation rules
## Context
This suggestion came from a discussion with the Django Security Team regarding Content-Type handling in file uploads.
Contributor guide
No contributing guide indexed for this repository
Research direction
Start by reading django/http/multipartparser.py around lines 275-278 to understand the current reliance on client-supplied Content-Type values. Compare the proposed UploadedFile method with the opt-in setting, then define the API, optional python-magic dependency, validation behavior, performance expectations, and tests needed before implementation.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- django, python
- Domain
- backend, security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 28/100