{"record":{"id":"96bebc42d3d8863f","repo":"affaan-m/ECC","slug":"unsupported-file-type","errorCode":null,"errorMessage":"Unsupported file type.","messagePattern":"Unsupported file type\\.","errorType":"validation","errorClass":"ValidationError","httpStatus":null,"severity":"warning","filePath":"skills/django-security/SKILL.md","lineNumber":415,"sourceCode":"\nALLOWED_MIMES = {\n    'image/jpeg', 'image/png', 'image/gif', 'application/pdf',\n}\n\nMIME_TO_EXTENSIONS = {\n    'image/jpeg': {'.jpg', '.jpeg'},\n    'image/png': {'.png'},\n    'image/gif': {'.gif'},\n    'application/pdf': {'.pdf'},\n}\n\ndef validate_file_type(value):\n    \"\"\"Validate file type using magic bytes and cross-check extension.\"\"\"\n    mime = magic.from_buffer(value.read(2048), mime=True)\n    value.seek(0)\n\n    if mime not in ALLOWED_MIMES:\n        raise ValidationError('Unsupported file type.')\n\n    ext = os.path.splitext(value.name)[1].lower()\n    if ext not in MIME_TO_EXTENSIONS.get(mime, set()):\n        raise ValidationError('File extension does not match file content.')\n\ndef validate_file_size(value):\n    \"\"\"Validate file size (max 5MB).\"\"\"\n    if value.size > 5 * 1024 * 1024:\n        raise ValidationError('File too large. Max size is 5MB.')\n\n# models.py\nclass Document(models.Model):\n    file = models.FileField(\n        upload_to='documents/',\n        validators=[validate_file_type, validate_file_size]\n    )\n\n```","sourceCodeStart":397,"sourceCodeEnd":433,"githubUrl":"https://github.com/affaan-m/ECC/blob/01e15490f04e29cfefe3896951f43db46994d8ee/skills/django-security/SKILL.md#L397-L433","documentation":"validate_file_type() in the django-security skill reads the first 2048 bytes, gets the MIME via python-magic, and raises django ValidationError('Unsupported file type.') if the detected MIME is not in ALLOWED_MIMES (image/jpeg, image/png, image/gif, application/pdf). This is a magic-byte allowlist: the browser-supplied extension and Content-Type are irrelevant at this stage — only the detected content type matters. libmagic must be installed (libmagic / file) or the call itself will fail before this line.","triggerScenarios":"Uploading a file whose magic-byte MIME is outside the allowed set — e.g. webp, heic, svg, docx, txt, video; or a file libmagic misidentifies due to a stale magic database.","commonSituations":"Users uploading webp/heic screenshots (not in the allowlist); SVG logos; Office documents where only PDF is accepted; libmagic returning a non-standard MIME; libmagic not installed so from_buffer errors.","solutions":["Confirm the upload is one of jpeg/png/gif/pdf; convert webp/heic before upload.","Extend ALLOWED_MIMES (and add the matching extensions to MIME_TO_EXTENSIONS) if a new type is genuinely supported.","Verify libmagic is installed and its database is current.","Do not trust the browser Content-Type — this validator intentionally ignores it."],"exampleFix":"// before\nALLOWED_MIMES = {'image/jpeg', 'image/png', 'image/gif', 'application/pdf'}\n\n// after — add webp support\nALLOWED_MIMES = {'image/jpeg', 'image/png', 'image/gif', 'application/pdf', 'image/webp'}\nMIME_TO_EXTENSIONS = {\n    'image/jpeg': {'.jpg', '.jpeg'},\n    'image/png': {'.png'},\n    'image/gif': {'.gif'},\n    'application/pdf': {'.pdf'},\n    'image/webp': {'.webp'},\n}","handlingStrategy":"validation","validationCode":"import magic\n\nALLOWED_MIMES = {'image/jpeg', 'image/png', 'image/gif', 'application/pdf'}\n\ndef will_pass_mime(path: str) -> bool:\n    with open(path, \"rb\") as f:\n        mime = magic.from_buffer(f.read(2048), mime=True)\n    return mime in ALLOWED_MIMES","typeGuard":"from django.core.exceptions import ValidationError\n\ndef is_unsupported_file(exc: BaseException) -> bool:\n    return isinstance(exc, ValidationError) and \"Unsupported file type\" in str(exc)","tryCatchPattern":"from django.core.exceptions import ValidationError\n\ntry:\n    validate_file_type(uploaded)\nexcept ValidationError as e:\n    if \"Unsupported file type\" in str(e):\n        return JsonResponse({\"error\": \"Only JPEG, PNG, GIF, PDF allowed\"}, status=400)\n    raise","preventionTips":["Pre-validate MIME client-side and convert webp/heic to png.","Keep libmagic installed and its database updated.","Document the allowed MIME set to users in the upload UI.","Extend ALLOWED_MIMES and MIME_TO_EXTENSIONS together when adding a type."],"tags":["django","file-upload","security","validation","mime"],"backgroundTag":null,"analyzedSha":"01e15490f04e29cfefe3896951f43db46994d8ee","analyzedAt":"2026-08-13T00:31:08.655Z","schemaVersion":2},"datasetVersion":"2026-08-13T04:17:16.726Z"}