affaan-m/ECC · error

Invalid file extension

Error message

Invalid file extension

What it means

Third guard in validateFileUpload: the file name has no extension, or its extension is outside the .jpg/.jpeg/.png/.gif allowlist. Combined with the size and MIME checks this completes the whitelist validation triad; the filename is the invalid input.

Source

Thrown at skills/security-review/SKILL.md:96

```typescript
function validateFileUpload(file: File) {
  // Size check (5MB max)
  const maxSize = 5 * 1024 * 1024
  if (file.size > maxSize) {
    throw new Error('File too large (max 5MB)')
  }

  // Type check
  const allowedTypes = ['image/jpeg', 'image/png', 'image/gif']
  if (!allowedTypes.includes(file.type)) {
    throw new Error('Invalid file type')
  }

  // Extension check
  const allowedExtensions = ['.jpg', '.jpeg', '.png', '.gif']
  const extension = file.name.toLowerCase().match(/\.[^.]+$/)?.[0]
  if (!extension || !allowedExtensions.includes(extension)) {
    throw new Error('Invalid file extension')
  }

  return true
}
```

#### Verification Steps
- [ ] All user inputs validated with schemas
- [ ] File uploads restricted (size, type, extension)
- [ ] No direct use of user input in queries
- [ ] Whitelist validation (not blacklist)
- [ ] Error messages don't leak sensitive info

### 3. SQL Injection Prevention

#### FAIL: NEVER Concatenate SQL
```typescript
// DANGEROUS - SQL Injection vulnerability

View on GitHub (pinned to d8409a4b08)

Solutions

1. Validate extension together with MIME type and magic bytes
2. Normalize case before matching extensions
3. Reject files with double extensions or embedded null bytes

When it happens

Trigger: Thrown at skills/security-review/SKILL.md:96 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of affaan-m/ECC@d8409a4b08 (2026-08-26). Data as JSON: /api/errors/4a2bca76a08bec19. Report an issue: GitHub.