LiveView file uploads, ImageMagick and security

It is checking against file extensions… but You have tools to detect the real file type.

In general, using a proper library or system command would probably be better, but since my use case is very limited (check if an image is an image), I chose to create a couple of functions to check the file signatures. I’m posting them here in case they are of use to someone and obviously if someone sees an issue with them, criticism is always welcome.

def file_signature_matches?(:png, file_path) do
  read_bytes(file_path, 8) == "89504E470D0A1A0A"
end

defp read_bytes(file_path, num) do
  file_path
  |> File.stream!([], num)
  |> Enum.take(1)
  |> List.first()
  |> Base.encode16()
end

The Enum.take/2 and List.first/1 are a bit wonky looking, but I couldn’t figure out a better way to get stuff out of the stream.