llama

llama

LiveView file uploads, ImageMagick and security

Allow_upload/3 allows you to list file type specifiers you’ll accept as uploads, but I can’t find information whether this list is checked against the file header or the file name. For example, will a malicious file that is just named “innocent_file.jpg” be accepted?

I’m thinking of using ImageMagick, but I’m concerned about giving uploads to it without proper filtering and I’m wondering if I’ll have to do the filtering myself. If I have to do it myself, are there any good libraries for it?

Marked As Solved

kokolegorille

kokolegorille

It is checking against file extensions… but You have tools to detect the real file type.

Last Post!

llama

llama

In general, using a proper library or system command would probably be better, but since my use case is very limited (check if an image is an image), I chose to create a couple of functions to check the file signatures. I’m posting them here in case they are of use to someone and obviously if someone sees an issue with them, criticism is always welcome.

def file_signature_matches?(:png, file_path) do
  read_bytes(file_path, 8) == "89504E470D0A1A0A"
end

defp read_bytes(file_path, num) do
  file_path
  |> File.stream!([], num)
  |> Enum.take(1)
  |> List.first()
  |> Base.encode16()
end

The Enum.take/2 and List.first/1 are a bit wonky looking, but I couldn’t figure out a better way to get stuff out of the stream.

Where Next?

Popular in Questions Top

vegabook
I’m brand new to Phoenix and I have stripped one of the demo applications to the bone. I just want to get an svg up on the screen. Here i...
New
lanycrost
Hi everyone! I need implement if…else if…else condition from my elixir code, and anymore of this control flow structures not work proper...
New
mcarvalho
What is the difference between System.get_env and Application.get_env? For example, what are best practices to use one versus another.
New
alice
Hey, Just curious what are the main benefits of Elixir compared to Clojure? When is Elixir more useful than Clojure and vice versa? Th...
New
fayddelight
I tried installing elixir 1.11.2 erlang 23.3.4 via asdf in my zsh shell. Enabled the versions locally and globally. When I list them ...
New
Harrisonl
We have an ECS cluster with 4 services, where each task joins a single cluster, via discovery ECS discovery service. Currently when I de...
New
senggen
Erlang/OTP 25 [erts-13.2.2] [source] [64-bit] [smp:8:8] [ds:8:8:10] [async-threads:1] 15:22:35.803 [error] gen_event {lager_file_backend...
New

Other popular topics Top

New
hariharasudhan94
I would like to know what is the best IDE for elixir development?
New
JakeBecker
TL;DR: I’ve just released an implementation of Microsoft’s IDE-independent Language Server Protocol for Elixir. It adds language support ...
1144 54921 245
New
aadeshere1
I have a another noob question about loop. Since elixir is immutable, while loop is not directly possible. total = 10 while total != 0 ...
New
bsollish-terakeet
Credo is smart enough to check for (something like) this: assert length(the_list) == 0 with this response: Checking if an enum is empt...
New
Patoshizzle
After calling mix ecto.create I get this error: 17:00:32.162 [error] GenServer #PID<0.412.0> terminating ** (Postgrex.Error) FATAL...
New

We're in Beta

About us Mission Statement