Function validateAndBufferFile

backend/src/common/security/file_check.ts:20–57

(
  file: FileUpload,
)

 * those accepted anything at all as long as it was *called* a PNG — a shell
 * script renamed `evil.png` was stored and then served from this origin.
 * Returns undefined when the header matches no image this service accepts.
 */
/**
 * What a buffer actually is, by its magic bytes — the one thing a client
 * cannot lie about. Exported because chat attachments arrive by a different
 * road (base64 data URLs, not multipart) and need the same answer.
 */
export function sniff(buffer: Buffer): string | undefined {
  if (
    buffer.length >= 8 &&
    buffer.subarray(0, 8).equals(Buffer.from([0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a]))
  ) {
    return 'image/png';
  }
  if (buffer.length >= 3 && buffer[0] === 0xff && buffer[1] === 0xd8 && buffer[2] === 0xff) {
    return 'image/jpeg';
  }
  if (
    buffer.length >= 12 &&
    buffer.subarray(0, 4).toString('ascii') === 'RIFF' &&
    buffer.subarray(8, 12).toString('ascii') === 'WEBP'
  ) {
    return 'image/webp';
  }
  // GIF87a / GIF89a. Not accepted for avatars or covers, but the agent can
  // be handed one, so the sniffer has to be able to name it.
  if (buffer.length >= 6 && buffer.subarray(0, 3).toString('ascii') === 'GIF') {
    return 'image/gif';
  }
  return undefined;
}

/**
 * Validates a file upload (size, type) and returns a Buffer.
 * @param file - FileUpload object from GraphQL
 * @returns Promise<Buffer> - The file data in buffer format
 * @throws BadRequestException - If validation fails
 */
export async function validateAndBufferFile(
  file: FileUpload,
): Promise<{ buffer: Buffer; mimetype: string }> {