expressjs / expressjs/multer

Multer doesn't filter mimetypes correctly

Open
#1,163 6 comments 0 reactions 0 assignees View on GitHub
Dominant language
JavaScript
Stars
12.1k
Forks
1.1k
Avg merge
8d 2h
Merged PRs (30d)
21

Description

```
const express = require("express");
const PhotosRouter = express.Router();
const db = require("../models");
const multer = require("multer");

const fileStorageEngine = multer.diskStorage({
destination: (request, file, callback) => {
callback(null, "./public/images");
},
filename: (request, file, callback) => {
callback(null, Date.now() + "--" + file.originalname);
},
});

const uploadFilter = function (request, file, callback) {

const fileType = file.mimetype.split('/');

if (fileType[0] === "image") {
callback(null, true)
}else{
callback("You are trying to upload a file that is not an image. Go back and try again", false)
}
};

const upload = multer({
fileFilter: uploadFilter,
storage: fileStorageEngine
});

PhotosRouter.route("/").get((request, response) => {
db.photo
.findAll()
.then((photos) => {
console.log("GET IMAGES");
response.redirect("/");
})
.catch((error) => {
response.send(error);
});
});

PhotosRouter.route("/")
.post(upload.single("photo"), (request, response) => {
const title = request.body.title;
const mediaLocation = request.file.filename;
db.photo
.create({ title: title, mediaLocation: mediaLocation })
.then((photo) => {
console.log("POST IMAGES");
// response.send(photo);
response.redirect('/');
})
.catch((error) => {
response.send(error);
});
})

.put((request, response) => {
console.log("PUT IMAGES");
response.send("PUT IMAGES");
})
.delete((request, response) => {
console.log("DELETE IMAGES");
response.send("DELETE IMAGES");
});

PhotosRouter.route("/:id") // for removing photos
.delete((request, response) => {
const id = request.params.id;
db.photo
.destroy({ where: { id: id } })
.then((photo) => {
response.send("Deleted");
})
.catch((error) => {
response.send(error);
});
});

module.exports = PhotosRouter;
```

I've been trying to make sure that if someone uploaded say a shell script that was renamed from script.sh to script.png that the file would not upload but no matter what I've tried, multer still allows this file to be uploaded. Am I missing something?

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.