✨ Check actual image content for valid mime type

backend/src/uxbox/images.clj

@@ -10,6 +10,7 @@
    [clojure.java.io :as io]
    [clojure.spec.alpha :as s]
    [datoteka.core :as fs]
+   [uxbox.common.exceptions :as ex]
    [uxbox.common.data :as d]
    [uxbox.common.spec :as us]
    [uxbox.util.storage :as ust]
@@ -108,8 +109,12 @@
        (ByteArrayInputStream. thumbnail-data)))))
 
 (defn info
-  [path]
+  [content-type path]
   (let [instance (Info. (str path))]
+    (when-not (= content-type (.getProperty instance "Mime type"))
+      (ex/raise :type :validation
+                :code :image-type-mismatch
+                :hint "Seems like you are uploading a file whose content does not match the extension."))
     {:width (.getImageWidth instance)
      :height (.getImageHeight instance)}))
 

backend/src/uxbox/services/mutations/files.clj

@@ -165,7 +165,7 @@
               :code :image-type-not-allowed
               :hint "Seems like you are uploading an invalid image."))
 
-  (let [image-opts (images/info (:tempfile content))
+  (let [image-opts (images/info (:content-type content) (:tempfile content))
         image-path (imgs/persist-image-on-fs content)
         thumb-opts imgs/thumbnail-options
         thumb-path (imgs/persist-image-thumbnail-on-fs thumb-opts image-path)]

backend/src/uxbox/services/mutations/images.clj

@@ -146,7 +146,8 @@
     (ex/raise :type :validation
               :code :image-type-not-allowed
               :hint "Seems like you are uploading an invalid image."))
-  (let [image-opts (images/info (:tempfile content))
+
+  (let [image-opts (images/info (:content-type content) (:tempfile content))
         image-path (persist-image-on-fs content)
         thumb-opts thumbnail-options
         thumb-path (persist-image-thumbnail-on-fs thumb-opts image-path)]

backend/src/uxbox/services/mutations/profile.clj

@@ -291,7 +291,8 @@
     (ex/raise :type :validation
               :code :image-type-not-allowed
               :hint "Seems like you are uploading an invalid image."))
-  (let [thumb-opts {:width 256
+  (let [image-opts (images/info (:content-type file) (:tempfile file))
+        thumb-opts {:width 256
                     :height 256
                     :quality 75
                     :format "webp"}