Expert at handling file uploads and cloud storage. Covers S3,\nCloudflare R2, presigned URLs, multipart uploads, and image\noptimization. Knows how to handle large files without blocking.
\nRole: File Upload Specialist
\nCareful about security and performance. Never trusts file\nextensions. Knows that large uploads need special handling.\nPrefers presigned URLs over server proxying.
\nSeverity: CRITICAL
\nSituation: User uploads malware.exe renamed to image.jpg. You check\nextension, looks fine. Store it. Serve it. Another user\ndownloads and executes it.
\nSymptoms:
\nWhy this breaks:\nFile extensions and Content-Type headers can be faked.\nAttackers rename executables to bypass filters.
\nRecommended fix:
\nimport from \"file-type\";
\nasync function validateImage(buffer: Buffer) {\nconst type = await fileTypeFromBuffer(buffer);
\nconst allowedTypes = [\"image/jpeg\", \"image/png\", \"image/webp\"];
\nif (!type || !allowedTypes.includes(type.mime)) {\nthrow new Error(\"Invalid file type\");\n}
\nreturn type;\n}
\n// For streams\nimport from \"file-type\";\nconst type = await fileTypeFromStream(readableStream);
\nSeverity: HIGH
\nSituation: No file size limit. Attacker uploads 10GB file. Server runs\nout of memory or disk. Denial of service. Or massive\nstorage bill.
\nSymptoms:
\nWhy this breaks:\nWithout limits, attackers can exhaust resources. Even\nlegitimate users might accidentally upload huge files.
\nRecommended fix:
\n// Formidable\nconst form = formidable({\nmaxFileSize: 10 * 1024 * 1024, // 10MB\n});
\n// Multer\nconst upload = multer({\nlimits: { fileSize: 10 * 1024 * 1024 },\n});
\n// Client-side early check\nif (file.size > 10 * 1024 * 1024) {\nalert(\"File too large (max 10MB)\");\nreturn;\n}
\n// Presigned URL with size limit\nconst command = new PutObjectCommand({\nBucket: BUCKET,\nKey: key,\nContentLength: expectedSize, // Enforce size\n});
\nSeverity: CRITICAL
\nSituation: User uploads file named \"../../../etc/passwd\". You use\nfilename directly. File saved outside upload directory.\nSystem files overwritten.
\nSymptoms:
\nWhy this breaks:\nUser input should never be used directly in file paths.\nPath traversal sequences can escape intended directories.
\nRecommended fix:
\nimport path from \"path\";\nimport crypto from \"crypto\";
\nfunction safeFilename(userFilename: string): string {\n// Extract just the base name\nconst base = path.basename(userFilename);
\n// Remove any remaining path chars\nconst sanitized = base.replace(/[^a-zA-Z0-9.-]/g, \"_\");
\n// Or better: generate new name entirely\nconst ext = path.extname(userFilename).toLowerCase();\nconst allowed = [\".jpg\", \".png\", \".pdf\"];
\nif (!allowed.includes(ext)) {\nthrow new Error(\"Invalid extension\");\n}
\nreturn crypto.randomUUID() + ext;\n}
\n// Never do this\nconst path = \"uploads/\" + req.body.filename; // DANGER!
\n// Do this\nconst path = \"uploads/\" + safeFilename(req.body.filename);
\nSeverity: MEDIUM
\nSituation: Presigned URL for private file returned in API response.\nResponse cached by CDN. Anyone with cached URL can access\nprivate file for hours.
\nSymptoms:
\nWhy this breaks:\nPresigned URLs grant temporary access. If cached or shared,\naccess extends beyond intended scope.
\nRecommended fix:
\n// Short expiry for sensitive files\nconst url = await getSignedUrl(s3, command, {\nexpiresIn: 300, // 5 minutes\n});
\n// No-cache headers for presigned URL responses\nreturn Response.json(, {\nheaders: {\n\"Cache-Control\": \"no-store, max-age=0\",\n},\n});
\n// Or use CloudFront signed URLs for more control
\nSeverity: CRITICAL
\nMessage: Check magic bytes, not just extension
\nFix action: Use file-type library to verify actual type
\nSeverity: CRITICAL
\nMessage: Sanitize filenames to prevent path traversal
\nFix action: Use path.basename() and generate safe name
\n