affaan-m/ECC · error

Invalid file type

Error message

Invalid file type

What it means

Second guard in the security-review skill's validateFileUpload example: the size check passed but file.type is not in the JPEG/PNG/GIF allowlist. The MIME type supplied by the client is not accepted; note this is client-provided data and must be re-verified server-side.

Source

Thrown at skills/security-review/SKILL.md:89

    }
    throw error
  }
}
```

#### File Upload Validation
```typescript
function validateFileUpload(file: File) {
  // Size check (5MB max)
  const maxSize = 5 * 1024 * 1024
  if (file.size > maxSize) {
    throw new Error('File too large (max 5MB)')
  }

  // Type check
  const allowedTypes = ['image/jpeg', 'image/png', 'image/gif']
  if (!allowedTypes.includes(file.type)) {
    throw new Error('Invalid file type')
  }

  // Extension check
  const allowedExtensions = ['.jpg', '.jpeg', '.png', '.gif']
  const extension = file.name.toLowerCase().match(/\.[^.]+$/)?.[0]
  if (!extension || !allowedExtensions.includes(extension)) {
    throw new Error('Invalid file extension')
  }

  return true
}
```

#### Verification Steps
- [ ] All user inputs validated with schemas
- [ ] File uploads restricted (size, type, extension)
- [ ] No direct use of user input in queries
- [ ] Whitelist validation (not blacklist)

View on GitHub (pinned to d8409a4b08)

Solutions

1. Sniff the file's magic bytes server-side instead of trusting file.type
2. Restrict accepted types to the minimum the product actually needs
3. Return a 415 Unsupported Media Type with the allowlist in the message

When it happens

Trigger: Thrown at skills/security-review/SKILL.md:89 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of affaan-m/ECC@d8409a4b08 (2026-08-26). Data as JSON: /api/errors/b4fed090ad5fe715. Report an issue: GitHub.