{"record":{"id":"c5d26e8aa4045a3d","repo":"FlowiseAI/Flowise","slug":"invalid-mime-type-mime-type-is-required-and-must","errorCode":null,"errorMessage":"Invalid MIME type: MIME type is required and must be a string","messagePattern":"Invalid MIME type: MIME type is required and must be a string","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"packages/components/src/validator.ts","lineNumber":146,"sourceCode":"    return ext\n}\n\n/**\n * Validates that file extension matches the declared MIME type\n *\n * This function addresses CVE-2025-61687 by preventing MIME type spoofing attacks.\n * It ensures that the file extension matches the declared MIME type, preventing\n * attackers from uploading malicious files (e.g., .js file with text/plain MIME type).\n *\n * @param {string} filename The original filename\n * @param {string} mimetype The declared MIME type\n * @returns {void} Throws an error if validation fails\n */\nexport const validateMimeTypeAndExtensionMatch = (filename: string, mimetype: string): void => {\n    validateFilename(filename)\n\n    if (!mimetype || typeof mimetype !== 'string') {\n        throw new Error('Invalid MIME type: MIME type is required and must be a string')\n    }\n\n    const normalizedExt = extractFileExtension(filename)\n\n    if (!normalizedExt) {\n        // Files without extensions are rejected for security\n        throw new Error('File type not allowed: files must have a valid file extension')\n    }\n\n    // Get the expected extension from mapMimeTypeToExt (returns extension without dot)\n    const expectedExt = mapMimeTypeToExt(mimetype)\n\n    if (!expectedExt) {\n        // If mapMimeTypeToExt doesn't recognize the MIME type, it's not supported\n        throw new Error(`MIME type \"${mimetype}\" is not supported or does not have a valid file extension mapping`)\n    }\n\n    // Ensure the file extension matches the expected extension for the MIME type","sourceCodeStart":128,"sourceCodeEnd":164,"githubUrl":"https://github.com/FlowiseAI/Flowise/blob/abe4a8601a058047b350c260676826e21dd14101/packages/components/src/validator.ts#L128-L164","documentation":"Thrown by validateMimeTypeAndExtensionMatch when the mimetype argument is falsy or not a string. This is a caller-contract violation: the function requires a declared MIME type to compare against the file extension, and an empty/undefined MIME defeats the spoofing check (CVE-2025-61687).","triggerScenarios":"The upload middleware didn't populate file.mimetype (malformed multipart, missing Content-Type header); caller passed req.file.mimetype which is undefined; programmatic call omitted the mimetype argument.","commonSituations":"Multipart part without a Content-Type field; a custom upload handler that doesn't set mimetype; refactoring that renamed the field; test fixtures that omit mimetype.","solutions":["Ensure the upload middleware (multer) is configured to detect mimetype and that req.file.mimetype is populated.","Validate mimetype presence at the handler boundary and return 400 when missing.","Pass req.file.mimetype explicitly to validateMimeTypeAndExtensionMatch."],"exampleFix":"// before\nvalidateMimeTypeAndExtensionMatch(filename, mimetype)\n\n// after — guard at handler\nif (!req.file?.mimetype) {\n  return res.status(400).json({ error: 'File MIME type could not be determined' })\n}\nvalidateMimeTypeAndExtensionMatch(req.file.originalname, req.file.mimetype)","handlingStrategy":"type-guard","validationCode":"function isNonEmptyMimeType(v: unknown): v is string {\n  return typeof v === 'string' && v.trim().length > 0 && v.includes('/')\n}","typeGuard":"function isValidMimeType(v: unknown): v is string {\n  return typeof v === 'string' && /^\\w+\\/[\\w.+-]+$/i.test(v.trim())\n}","tryCatchPattern":"if (!isValidMimeType(mimetype)) {\n  throw new Error('Invalid MIME type: MIME type is required and must be a string')\n}","preventionTips":["Ensure multer detects mimetype (default behaviour) and req.file.mimetype is populated.","Validate MIME format (type/subtype) at the handler boundary.","Reject uploads with missing Content-Type on the file part."],"tags":["validation","file-upload","mime","type-guard","security"],"backgroundTag":null,"analyzedSha":"abe4a8601a058047b350c260676826e21dd14101","analyzedAt":"2026-08-12T16:04:40.823Z","schemaVersion":2},"datasetVersion":"2026-08-12T18:17:37.767Z"}