I try pass invalid multipart, but the Plug accepted

Phoenix Forum Questions / Help
1

Hello Guys,

I am experiencing a problem, which boils down to:

The plug accepts files of any type even if I do not update any past, and if I fix some it accepts others in the same way, I tried in some ways without success, does anyone have any idea what may be happening?

Thanks

## Plug to recive images and json
plug Plug.Parsers,
  parsers: [:urlencoded, {:multipart, length: 200_000}, :json],
  pass: [],
  json_decoder: Poison
2

How are you testing this?

3

I use a simple controller, like this:

  def upload_image(conn, %{"upload" => %Plug.Upload{} = upload}) do
    IO.inspect(upload)
    conn
    |> put_status(:ok)
    |> render("upload.json", upload: upload.filename)
  end

And in route


  scope "/api", RocketpayWeb do
    pipe_through :api

    get "/:filename", WelcomeController, :index

    post "/users", UsersController, :create
    post "/users/upload", UsersController, :upload_image
    post "/users/sign_in", UsersController, :sign_in
  end

But if i pass file with size more large to defined, i can see error, but type file error not working

4

Ben I read in the doc that the plug that validates the multipart does not validate the type via pass, the pass is only for: json.

If I got it right this is it …

the solution I thought was to create a plug that validates this only for the file upload route, the plug looks like this:

defmodule Plug.ValidateFile do
  use RocketpayWeb, :controller
  @mime_types ["image/jpg", "image/png"]
  def validate_file(conn, _opts) do
    file_type = conn.body_params["upload"].content_type

    if accepted_mime?(file_type, @mime_types) do
      conn
    else
      conn
        |> Plug.Conn.put_status(400)
        |> json(%{error_code: "400", reason_given: "Invalid file type #{file_type}"})
        |> halt()
    end

  end

  defp accepted_mime?(mime, pass) do
    mime_type = String.split(mime, "/")
    type = Enum.at(mime_type, 0)
    subtype = Enum.at(mime_type, 1)
    "#{type}/#{subtype}" in pass || "#{type}/*" in pass
  end
end