Added ability for server to test what file is uploaded to the server and reject it if need be

.gitignore

@@ -2,3 +2,7 @@
 *.bak
 node_modules
 npm-debug.log
+
+**/webpages
+**.idea
+**uploads

jstagram/config.js

@@ -12,6 +12,9 @@ module.exports.mysql = {
   // socketPath: '/tmp/mysql.sock', // uncomment this when testing with local non-networked mysql
 };
 
+// accepted file types of saving images
+module.exports.supported_file_types = ["png", "jpeg", "webm", "gif", "apng"];
+
 // constants for directories
 module.exports.webpages = path.join(__dirname, '/webpages/');
 module.exports.localimg = module.exports.webpages + 'img/';

jstagram/model-inmemory.js

@@ -114,10 +114,12 @@ module.exports.deletePicture = async (id) => {
 };
 
 
-module.exports.uploadPicture = async (reqFile, title) => {
+module.exports.uploadPicture = async (reqFile, title, fileExt) => {
   // move the file where we want it
-  const fileExt = reqFile.mimetype.split('/')[1] || 'png';
+  //const fileExt = reqFile.mimetype.split('/')[1] || 'png';
+  //console.log(fileExt);
   const newFilename = reqFile.filename + '.' + fileExt;
+  console.log(newFilename);
 
   try {
     await renameAsync(reqFile.path, config.localimg + newFilename);

jstagram/server.js

@@ -6,6 +6,11 @@
 
 const express = require('express');
 const multer = require('multer');
+const readChunk = require("read-chunk");
+const fileType = require("file-type");
+const { promisify } = require('util');
+const fs = require('fs');
+const unlinkAsync = promisify(fs.unlink);
 
 const db = require('./model-inmemory');
 const config = require('./config');
@@ -35,7 +40,7 @@ app.use('/', (req, res, next) => { console.log(new Date(), req.method, req.url);
 //   DELETE /api/pictures/x - returns http status code only
 
 app.get('/api/pictures', sendPictures);
-app.post('/api/pictures', uploader.single('picfile'), uploadPicture);
+app.post('/api/pictures', uploader.single('picfile'), pictureBackend);
 app.delete('/api/pictures/:id', deletePicture);
 
 
@@ -84,9 +89,10 @@ async function deletePicture(req, res) {
   }
 }
 
-async function uploadPicture(req, res) {
+async function uploadPicture(req, res, fileExt) {
   try {
-    const retval = await db.uploadPicture(req.file, req.body.title);
+    const retval = await db.uploadPicture(req.file, req.body.title, fileExt);
+    console.log(retval);
     if (req.accepts('html')) {
       // browser should go to the listing of pictures
       res.redirect(303, '/#' + retval.id);
@@ -99,6 +105,54 @@ async function uploadPicture(req, res) {
   }
 }
 
+async function checkIfPicture(req, res){
+  const buffer = readChunk.sync(res.req.file.path, 0, fileType.minimumBytes);
+  const file_type = fileType(buffer);
+    try{
+    return [config.supported_file_types.includes(file_type.ext), file_type.ext];
+  }
+  catch (TypError){
+    return [false, ""];
+  }
+
+}
+
+async function pictureBackend(req, res){
+  if (res.req.file === undefined){
+    res.status(415).send({error: "File required"});
+    return
+  }
+
+  if (res.req.body.title === undefined){
+    res.status(400).send({error: "Title required"});
+    return
+  }
+
+  if (res.req.file.mimetype === undefined){
+    res.status(415).send({error: "Unsupported mimetype"});
+    return
+  }
+  else if (res.req.file.mimetype.split("/")[0] !== "image"){
+    if (res.req.file.mimetype !== "application/octet-stream"){
+      res.status(415).send({error: `'${res.req.file.mimetype.split("/")[1]}' is a unsupported mimetype`});
+      return
+    }
+    console.log(`${res.req.file.mimetype} but ignoring`)
+  }
+
+  const is_picture = await checkIfPicture(req, res);
+  console.log(`Picture test: ${is_picture}`);
+
+  if (is_picture[0]){
+    await uploadPicture(req, res, is_picture[1])
+  }
+  else{
+    await unlinkAsync(res.req.file.path);
+    res.status(415).send({error: "Unsupported media type"});
+    return
+  }
+}
+
 function error(res, msg) {
   res.sendStatus(500);
   console.error(msg);

package.json

@@ -27,6 +27,8 @@
   "dependencies": {
     "express": "^4.16.2",
     "multer": "^1.3.0",
-    "mysql2": "^1.5.1"
+    "mysql2": "^1.5.1",
+    "file-type": "^10.6.0",
+    "read-chunk": "^3.0.0"
   }
 }