{"record":{"id":"b4fed090ad5fe715","repo":"affaan-m/ECC","slug":"invalid-file-type","errorCode":null,"errorMessage":"Invalid file type","messagePattern":"Invalid file type","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"skills/security-review/SKILL.md","lineNumber":89,"sourceCode":"    }\n    throw error\n  }\n}\n```\n\n#### File Upload Validation\n```typescript\nfunction validateFileUpload(file: File) {\n  // Size check (5MB max)\n  const maxSize = 5 * 1024 * 1024\n  if (file.size > maxSize) {\n    throw new Error('File too large (max 5MB)')\n  }\n\n  // Type check\n  const allowedTypes = ['image/jpeg', 'image/png', 'image/gif']\n  if (!allowedTypes.includes(file.type)) {\n    throw new Error('Invalid file type')\n  }\n\n  // Extension check\n  const allowedExtensions = ['.jpg', '.jpeg', '.png', '.gif']\n  const extension = file.name.toLowerCase().match(/\\.[^.]+$/)?.[0]\n  if (!extension || !allowedExtensions.includes(extension)) {\n    throw new Error('Invalid file extension')\n  }\n\n  return true\n}\n```\n\n#### Verification Steps\n- [ ] All user inputs validated with schemas\n- [ ] File uploads restricted (size, type, extension)\n- [ ] No direct use of user input in queries\n- [ ] Whitelist validation (not blacklist)","sourceCodeStart":71,"sourceCodeEnd":107,"githubUrl":"https://github.com/affaan-m/ECC/blob/d8409a4b0813771235555e32e3d8046a73988bfa/skills/security-review/SKILL.md#L71-L107","documentation":"Second guard in the security-review skill's validateFileUpload example: the size check passed but file.type is not in the JPEG/PNG/GIF allowlist. The MIME type supplied by the client is not accepted; note this is client-provided data and must be re-verified server-side.","triggerScenarios":"Thrown at skills/security-review/SKILL.md:89 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Sniff the file's magic bytes server-side instead of trusting file.type","Restrict accepted types to the minimum the product actually needs","Return a 415 Unsupported Media Type with the allowlist in the message"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"d8409a4b0813771235555e32e3d8046a73988bfa","analyzedAt":"2026-08-26T12:15:34.022Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}