{"record":{"id":"fc7f058a32970d4f","repo":"apache/answer","slug":"unsupported-image-format-s","errorCode":null,"errorMessage":"unsupported image format: %s","messagePattern":"unsupported image format: (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"pkg/checker/file_type.go","lineNumber":101,"sourceCode":"\treturn true\n}\n\n// formatSpecificConfigCheck decodes image config using a format-specific decoder\n// based on the file extension. This avoids calling image.DecodeConfig() which\n// dispatches by magic bytes and can invoke unintended decoders (e.g., TIFF)\n// registered by transitive dependencies.\nfunc formatSpecificConfigCheck(file io.Reader, ext string, maxImageMegapixel int) error {\n\tvar config image.Config\n\tvar err error\n\tswitch ext {\n\tcase \"jpg\", \"jpeg\":\n\t\tconfig, err = jpeg.DecodeConfig(file)\n\tcase \"png\":\n\t\tconfig, err = png.DecodeConfig(file)\n\tcase \"gif\":\n\t\tconfig, err = gif.DecodeConfig(file)\n\tdefault:\n\t\treturn fmt.Errorf(\"unsupported image format: %s\", ext)\n\t}\n\tif err != nil {\n\t\treturn fmt.Errorf(\"decode image config error: %v\", err)\n\t}\n\tif imageSizeTooLarge(config, maxImageMegapixel) {\n\t\treturn fmt.Errorf(\"image size too large\")\n\t}\n\treturn nil\n}\n\n// formatSpecificImageCheck fully decodes the image using a format-specific decoder.\nfunc formatSpecificImageCheck(file io.Reader, ext string, _ int) error {\n\tvar err error\n\tswitch ext {\n\tcase \"jpg\", \"jpeg\":\n\t\t_, err = jpeg.Decode(file)\n\tcase \"png\":\n\t\t_, err = png.Decode(file)","sourceCodeStart":83,"sourceCodeEnd":119,"githubUrl":"https://github.com/apache/answer/blob/3b9f1370612e690a0b7f230f05e688930db4c6d3/pkg/checker/file_type.go#L83-L119","documentation":"formatSpecificConfigCheck decodes an image's header to enforce a max-megapixel limit, but only supports jpeg, png, and gif. If the file extension is anything else, it returns this error before attempting a decode. It is an explicit allowlist failure, not a decode error.","triggerScenarios":"Uploading an image whose extension is not jpg/jpeg/png/gif (e.g. webp, bmp, svg, tiff) while it passed the generic file-type check.","commonSituations":"Modern uploads default to WebP from screenshots/CDN-converted files; users rename non-images to .png or upload HEIC from phones; site config allows a format the checker does not implement.","solutions":["Convert the image to a supported format (JPEG/PNG) before upload, or use one of the allowed formats.","If WebP support is needed, add a case \"webp\" using golang.org/x/image/webp's DecodeConfig.","Align the allowed-upload-format config with the formats this checker supports.","Reject early in the UI by filtering the file input accept attribute to supported types."],"exampleFix":"// before\ndefault:\n    return fmt.Errorf(\"unsupported image format: %s\", ext)\n// after\nimport \"golang.org/x/image/webp\"\n\ncase \"webp\":\n    config, err = webp.DecodeConfig(file)\ndefault:\n    return fmt.Errorf(\"unsupported image format: %s\", ext)","handlingStrategy":"validation","validationCode":"var allowed = map[string]bool{\"jpg\": true, \"jpeg\": true, \"png\": true, \"gif\": true}\next := strings.ToLower(strings.TrimPrefix(filepath.Ext(filename), \".\"))\nif !allowed[ext] {\n    return fmt.Errorf(\"format %q not supported; use jpg, png or gif\", ext)\n}","typeGuard":"func isSupportedImageExt(name string) bool {\n    switch strings.ToLower(filepath.Ext(name)) {\n    case \".jpg\", \".jpeg\", \".png\", \".gif\":\n        return true\n    }\n    return false\n}","tryCatchPattern":"err := checker.CheckImage(file, maxMegapixel)\nif err != nil {\n    if strings.Contains(err.Error(), \"unsupported image format\") {\n        return http.StatusUnsupportedMediaType, \"only jpg, png and gif images are supported\"\n    }\n    return http.StatusBadRequest, err.Error()\n}","preventionTips":["Filter the upload input accept attribute to .jpg,.jpeg,.png,.gif.","Convert WebP/HEIC/BMP to JPEG or PNG client-side before upload.","If WebP is required, add a decoder case via golang.org/x/image/webp.","Keep the checker's allowlist and the upload config's format list in sync."],"tags":["image","validation","file-format"],"backgroundTag":"unsupported-file-format","analyzedSha":"3b9f1370612e690a0b7f230f05e688930db4c6d3","analyzedAt":"2026-09-05T18:18:39.533Z","contentChangedAt":"2026-09-05T18:18:39.533Z","schemaVersion":2},"datasetVersion":"2026-09-12T22:17:10.623Z"}