feat: check for real mimetype using file-type

For now, if file-type returns undefined, we take the value from the browser. In the future this should be removed to ensure people can't bypass the real mime checking using a special file that can't be recognized by file-type.

1 files changed, 19 insertions, 17 deletions

diff --git a/src/api/routes/uploads/uploadPOST.js b/src/api/routes/uploads/uploadPOST.js
index bba7989..8e26079 100644
--- a/src/api/routes/uploads/uploadPOST.js
+++ b/src/api/routes/uploads/uploadPOST.js
@@ -1,6 +1,7 @@
 const path = require('path');
 const jetpack = require('fs-jetpack');
 const multer = require('multer');
+
 const Util = require('../../utils/Util');
 const Route = require('../../structures/Route');
 const multerStorage = require('../../utils/multerStorage');
@@ -10,6 +11,22 @@ const chunkedUploadsTimeout = 1800000;
 const chunksDir = path.join(__dirname, '../../../../', process.env.UPLOAD_FOLDER, 'chunks');
 const uploadDir = path.join(__dirname, '../../../../', process.env.UPLOAD_FOLDER);
 
+
+const cleanUpChunks = async (uuid, onTimeout) => {
+	// Remove tmp file
+	await jetpack.removeAsync(path.join(chunksData[uuid].root, chunksData[uuid].filename))
+		.catch(error => {
+			if (error.code !== 'ENOENT') console.error(error);
+		});
+
+	// Remove UUID dir
+	await jetpack.removeAsync(chunksData[uuid].root);
+
+	// Delete cached chunks data
+	if (!onTimeout) chunksData[uuid].clearTimeout();
+	delete chunksData[uuid];
+};
+
 class ChunksData {
 	constructor(uuid, root) {
 		this.uuid = uuid;
@@ -134,7 +151,7 @@ const uploadFile = async (req, res) => {
 	// If the uploaded file is a chunk then just say that it was a success
 	const uuid = req.body.uuid;
 	if (chunksData[uuid] !== undefined) {
-		req.files.forEach(file => {
+		req.files.forEach(() => {
 			chunksData[uuid].chunks++;
 		});
 		res.json({ success: true });
@@ -149,7 +166,7 @@ const uploadFile = async (req, res) => {
 	return infoMap[0];
 };
 
-const finishChunks = async (req, res) => {
+const finishChunks = async req => {
 	const check = file => typeof file.uuid !== 'string' ||
     !chunksData[file.uuid] ||
     chunksData[file.uuid].chunks < 2;
@@ -228,21 +245,6 @@ const finishChunks = async (req, res) => {
 	}
 };
 
-const cleanUpChunks = async (uuid, onTimeout) => {
-	// Remove tmp file
-	await jetpack.removeAsync(path.join(chunksData[uuid].root, chunksData[uuid].filename))
-		.catch(error => {
-			if (error.code !== 'ENOENT') console.error(error);
-		});
-
-	// Remove UUID dir
-	await jetpack.removeAsync(chunksData[uuid].root);
-
-	// Delete cached chunks data
-	if (!onTimeout) chunksData[uuid].clearTimeout();
-	delete chunksData[uuid];
-};
-
 class uploadPOST extends Route {
 	constructor() {
 		super('/upload', 'post', {