llama

llama

LiveView file uploads, ImageMagick and security

Allow_upload/3 allows you to list file type specifiers you’ll accept as uploads, but I can’t find information whether this list is checked against the file header or the file name. For example, will a malicious file that is just named “innocent_file.jpg” be accepted?

I’m thinking of using ImageMagick, but I’m concerned about giving uploads to it without proper filtering and I’m wondering if I’ll have to do the filtering myself. If I have to do it myself, are there any good libraries for it?

First 2 of 2 Posts Switch mode

kokolegorille

kokolegorille

It is checking against file extensions… but You have tools to detect the real file type.

llama

llama

In general, using a proper library or system command would probably be better, but since my use case is very limited (check if an image is an image), I chose to create a couple of functions to check the file signatures. I’m posting them here in case they are of use to someone and obviously if someone sees an issue with them, criticism is always welcome.

def file_signature_matches?(:png, file_path) do
  read_bytes(file_path, 8) == "89504E470D0A1A0A"
end

defp read_bytes(file_path, num) do
  file_path
  |> File.stream!([], num)
  |> Enum.take(1)
  |> List.first()
  |> Base.encode16()
end

The Enum.take/2 and List.first/1 are a bit wonky looking, but I couldn’t figure out a better way to get stuff out of the stream.

— All posts loaded —

Where Next?

Trending in Questions Top

jonnycharles
I’m in search of an Elixir library that offers PDF generation capabilities similar to Ruby’s Prawn. While there have been discussions abo...
New
spammy
I’m looking to build a personal workflow to quickly deploy web applications written in elixir/phoenix, for local consumption (ie not on t...
New
silverdr
Using Phoenix.LiveView.TagEngine as an EEx.Engine is deprecated! To compile HEEx, use Phoenix.LiveView.TagEngine.compile/2 instead. Sta...
New
saveman71
Hello ! We want new/edit form pages to POST/PUT to their own URL rather than the resources REST defaults (post /things, put /things/:id)...
New
dli
Before I dive in myself, did anyone successfully sprinkle Hologram into their existing LiveView app? Looking for hints regarding: Addi...
New
bottlenecked
Hi all, I wanted to ask how the community is dealing with post-release steps. Today we have Ecto migrations, which make sure that the db...
New
michallepicki
I am using Oban and occasionally, shortly after a deployment, a handful of jobs can fail because of dependency on other parts of the syst...
New

Other Trending Topics Top

JesseHerrick
Hey, I’m Jesse and I’m the main contributor behind Dexter, a full-featured, lightning-fast Elixir LSP optimized for large codebases. It s...
New
jimsynz
Beam Bots (or just BB for short) is a framework for building fault-tolerant robotics applications in Elixir using familiar OTP patterns. ...
New
Damirados
Hello everyone. After busy few months I am happy to announce v0.1.0 of Emerge & Solve. They are GUI (Emerge) and State management (S...
New
ausimian
Emily is an Elixir library that runs Nx computations on Apple’s MLX. Install it as the default Nx backend and Nx, defn, Axon, Nx.Serving,...
New
type1fool
I just stumbled on a newly redesigned elixir-lang.org. :tada: It looks like @Software_Mansion did the work, and I think it is generally a...
New
akoutmos
@hugobarauna and I (Alex Koutmos) have been hard at work on writing a book on Nerves that takes you from simply blinking LEDs to building...
New

We're in Beta

About us Mission Statement