Hermes/refboard-ayon
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 1 Wiki Activity

fix(upload): store sniffed MIME instead of generic CDN content-type
Publish container image / build-and-push (push) Canceled after 0s
Details

Browse Source
This commit is contained in:
Niklas
2026-09-05 13:02:50 +02:00
parent 3e3013045c
commit 4cda9c8c0a
1 changed files with 21 additions and 18 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/routes/upload.js
+21 -18
View File
@@ -326,15 +326,18 @@ function downloadImage(imageUrl, maxRedirects = 5) {
}); });
response.on('end', () => { response.on('end', () => {
const buffer = Buffer.concat(chunks);
let resolvedType = contentType;
if (typeIsGeneric) { if (typeIsGeneric) {
const sniffed = sniffMime(Buffer.concat(chunks)); // Replace the generic CDN type with what the bytes actually are,
if (!sniffed) { // so the correct MIME gets stored and served.
resolvedType = sniffMimeExact(buffer);
if (!resolvedType) {
return reject(new Error('Unsupported content type: binary/octet-stream (unknown magic bytes)')); return reject(new Error('Unsupported content type: binary/octet-stream (unknown magic bytes)'));
} }
} }
const buffer = Buffer.concat(chunks);
const filename = parsed.pathname.split('/').pop() || 'image'; const filename = parsed.pathname.split('/').pop() || 'image';
resolve({ buffer, mimeType: contentType, filename }); resolve({ buffer, mimeType: resolvedType, filename });
}); });
response.on('error', reject); response.on('error', reject);
@@ -435,22 +438,22 @@ router.use((err, req, res, next) => {
// Sniff the real MIME type from magic bytes (for CDNs that serve everything // Sniff the real MIME type from magic bytes (for CDNs that serve everything
// as binary/octet-stream). Returns true when the buffer looks like an // as binary/octet-stream). Returns the exact MIME or null.
// allowed image/video/pdf type. function sniffMimeExact(buf) {
function sniffMime(buf) { if (!buf || buf.length < 12) return null;
if (!buf || buf.length < 12) return false;
const hex = buf.slice(0, 12).toString('hex'); const hex = buf.slice(0, 12).toString('hex');
const ascii = buf.slice(0, 12).toString('latin1'); const ascii = buf.slice(0, 12).toString('latin1');
if (hex.startsWith('89504e47')) return true; // PNG if (hex.startsWith('89504e47')) return 'image/png';
if (hex.startsWith('ffd8ff')) return true; // JPEG if (hex.startsWith('ffd8ff')) return 'image/jpeg';
if (ascii.startsWith('GIF87a') || ascii.startsWith('GIF89a')) return true; // GIF if (ascii.startsWith('GIF87a') || ascii.startsWith('GIF89a')) return 'image/gif';
if (ascii.startsWith('RIFF') && buf.slice(8, 12).toString('latin1') === 'WEBP') return true; // WebP if (ascii.startsWith('RIFF') && buf.slice(8, 12).toString('latin1') === 'WEBP') return 'image/webp';
if (ascii.startsWith('%PDF')) return true; // PDF if (ascii.startsWith('%PDF')) return 'application/pdf';
if (ascii.startsWith('ftyp')) return true; // MP4/QuickTime (ftyp at 0 for some, 4 for others) if (buf.slice(4, 8).toString('latin1') === 'ftyp') {
if (buf.slice(4, 8).toString('latin1') === 'ftyp') return true; const brand = buf.slice(8, 12).toString('latin1');
if (hex.startsWith('1a45dfa3')) return true; // WebM/Matroska return brand.startsWith('qt') ? 'video/quicktime' : 'video/mp4';
if (ascii.startsWith('OggS')) return false; // ogg not allowed }
return false; if (hex.startsWith('1a45dfa3')) return 'video/webm';
return null;
} }
module.exports = router; module.exports = router;