I'm building an ecommerce chat widget where users can upload product photos. I want to accept only genuine JPEG, PNG, and WebP files—not files that merely claim to be images through the request's Content-Type header.
My current plan is to reject obviously invalid or oversized uploads first, then inspect the file contents with python-magic while the file is still in memory. If the detected MIME type is an allowed image type, I may also remove EXIF metadata before storing the file in Cloudflare R2.
Is this a sensible validation pipeline, or should I add other protections? I'd like to prevent malicious or inappropriate files from being stored, even though they won't be executed directly from object storage.
4 Answers
Be careful with files that are valid images but also contain additional malicious data, sometimes called polyglot files. MIME detection may identify the outer format without proving the file is safe. For stronger isolation, decode the image with a maintained image library and re-encode it into a fresh file, though the decoder itself must be kept patched and processing should be sandboxed where possible.
Limit both the compressed file size and the decoded pixel dimensions. A tiny highly compressed image can expand into an enormous bitmap and exhaust memory or CPU. Store uploads privately or on a separate origin, serve them with a fixed image Content-Type and X-Content-Type-Options: nosniff, and never rely on the client-provided type when serving them.
Checking the request header is useful as a quick filter, but it isn’t trustworthy by itself. Inspecting the file signature with python-magic is a better second check. Also enforce a maximum upload size before doing deeper processing, since there’s no reason to inspect an oversized product photo.
That’s the plan. After the size check and content inspection, I’m also considering stripping EXIF metadata before storing the image.
Treat every upload as untrusted. Validate the extension, declared type, and detected signature, but don’t assume those checks make arbitrary bytes safe. Keep the storage and image-processing components isolated, use strict size and dimension limits, remove unnecessary metadata, and consider generating a new derivative image rather than serving the original upload.
So checking the initial bytes with python-magic wouldn’t necessarily detect every polyglot case?