ZhuLinsen/daily_stock_analysis · error · ValueError

文件内容与声明的类型 image/webp 不匹配，可能被篡改

Error message

文件内容与声明的类型 image/webp 不匹配，可能被篡改

What it means

Error "文件内容与声明的类型 image/webp 不匹配，可能被篡改" thrown in ZhuLinsen/daily_stock_analysis.

Source

Thrown at src/services/image_stock_extractor.py:84

# Magic bytes for server-side MIME validation (client Content-Type can be forged)
_IMAGE_SIGNATURES = {
    "image/jpeg": [b"\xff\xd8\xff"],
    "image/png": [b"\x89PNG\r\n\x1a\n"],
    "image/gif": [b"GIF87a", b"GIF89a"],
    "image/webp": [b"RIFF"],  # bytes[8:12] must be WEBP, checked separately
}


def _verify_image_magic_bytes(image_bytes: bytes, mime_type: str) -> None:
    """Verify actual file content matches declared MIME type (rejects forged Content-Type)."""
    if len(image_bytes) < 12:
        raise ValueError("图片文件过小或损坏")
    if mime_type not in _IMAGE_SIGNATURES:
        raise ValueError(f"无法验证类型: {mime_type}")
    if mime_type == "image/webp":
        if image_bytes[:4] != b"RIFF" or image_bytes[8:12] != b"WEBP":
            raise ValueError("文件内容与声明的类型 image/webp 不匹配，可能被篡改")
        return
    for sig in _IMAGE_SIGNATURES[mime_type]:
        if image_bytes.startswith(sig):
            return
    raise ValueError(f"文件内容与声明的类型 {mime_type} 不匹配，可能被篡改")


def _normalize_code(raw: str) -> Optional[str]:
    """Normalize and validate a single stock code. A-shares & HK: 5-6 digits; US: 1-5 letters."""
    s = raw.strip().upper()
    if not s:
        return None
    # A-shares & HK: 5-6 digit codes (600519, 00700, 09988)
    if s.isdigit() and len(s) in (5, 6):
        return s
    # US stocks: 1-5 letters, optionally with . (e.g. BRK.B)
    if re.match(r"^[A-Z]{1,5}(\.[A-Z])?$", s):
        return s

View on GitHub (pinned to 5159bd72e8)

Solutions

1. Upload a genuine WebP file; the file content does not match the declared image/webp type.
2. Re-export or convert the image to WebP instead of just renaming the extension.
3. Check that no proxy or client rewrote the file bytes in transit.

When it happens

Trigger: Thrown at src/services/image_stock_extractor.py:84 when the library encounters an invalid state.

Common situations: Raised when file bytes do not match the declared image/webp type; occurs when a non-webp file is uploaded with a webp content-type, indicating tampering or a mislabelled file.

AI-assisted analysis of ZhuLinsen/daily_stock_analysis@5159bd72e8 (2026-08-15). Data as JSON: /api/errors/ceff65be78568b39. Report an issue: GitHub.