{"record":{"id":"4a2bca76a08bec19","repo":"affaan-m/ECC","slug":"invalid-file-extension","errorCode":null,"errorMessage":"Invalid file extension","messagePattern":"Invalid file extension","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"skills/security-review/SKILL.md","lineNumber":96,"sourceCode":"```typescript\nfunction validateFileUpload(file: File) {\n  // Size check (5MB max)\n  const maxSize = 5 * 1024 * 1024\n  if (file.size > maxSize) {\n    throw new Error('File too large (max 5MB)')\n  }\n\n  // Type check\n  const allowedTypes = ['image/jpeg', 'image/png', 'image/gif']\n  if (!allowedTypes.includes(file.type)) {\n    throw new Error('Invalid file type')\n  }\n\n  // Extension check\n  const allowedExtensions = ['.jpg', '.jpeg', '.png', '.gif']\n  const extension = file.name.toLowerCase().match(/\\.[^.]+$/)?.[0]\n  if (!extension || !allowedExtensions.includes(extension)) {\n    throw new Error('Invalid file extension')\n  }\n\n  return true\n}\n```\n\n#### Verification Steps\n- [ ] All user inputs validated with schemas\n- [ ] File uploads restricted (size, type, extension)\n- [ ] No direct use of user input in queries\n- [ ] Whitelist validation (not blacklist)\n- [ ] Error messages don't leak sensitive info\n\n### 3. SQL Injection Prevention\n\n#### FAIL: NEVER Concatenate SQL\n```typescript\n// DANGEROUS - SQL Injection vulnerability","sourceCodeStart":78,"sourceCodeEnd":114,"githubUrl":"https://github.com/affaan-m/ECC/blob/d8409a4b0813771235555e32e3d8046a73988bfa/skills/security-review/SKILL.md#L78-L114","documentation":"Third guard in validateFileUpload: the file name has no extension, or its extension is outside the .jpg/.jpeg/.png/.gif allowlist. Combined with the size and MIME checks this completes the whitelist validation triad; the filename is the invalid input.","triggerScenarios":"Thrown at skills/security-review/SKILL.md:96 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Validate extension together with MIME type and magic bytes","Normalize case before matching extensions","Reject files with double extensions or embedded null bytes"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"d8409a4b0813771235555e32e3d8046a73988bfa","analyzedAt":"2026-08-26T12:15:34.022Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}