Formidable detects MIME-type according to the file extension and not by the real content

Support plan

• which support plan is this issue covered by? (e.g. Community, Sponsor, or Enterprise): Community
• is this issue currently blocking your project? (yes/no): no
• is this issue affecting a production system? (yes/no): yes

Context

• node version: 16.4.2
• module (formidable) version: 3.0.0-canary.20210428
• environment (e.g. node, browser, native, OS): Node.js
• used with (i.e. popular names of modules):
• any other relevant information: Formidable detects MIME-type according to the file extension and not by the real content. Which means that user can fake the file MIME by changing file’s extension and as a result to upload to the server not allowed file types.

BTW, multer detects file’s MIME not by the extension only.

What are you trying to achieve or the steps to reproduce?

1. Given JPG file tst.jpg
2. Rename it to tst.pdf
3. Set a break point inside of uploader.parse(req, async (err, fields, files) => {…}
4. Try to upload tst.pdf

uploader.parse(req, async (err, fields, files) => {
	if (err) {
		reject(err);
	} else {…}
});

What was the result you got?

mimetype = application/pdf

What result did you expect?

mimetype = image/jpeg Since this file is actually JPG file but with a from extension.

[Bessonov]

I’m happy user of mmmagic. It was chosen ~6 years ago for execution inside aws lambda because of speed. But for formidable I would suggest to make it plugin-able. I mean not a specific plugin, but just a parameter like:

const form = formidable({
  getMimeType(file: Buffer): string {
    // custom logic
  }
})

Or plugin which allows custom logic.

[GrosSacASac]

https://github.com/vader-sama/typective similar to magic-bytes but works with streams

Also remember that a valid number does not prove anything at the end, I remember it was possible to make valid jpeg files that were also valid php files, which was one way to hack a server that looked like it did everything correct.