venus
VENUS-135
Server-side magic-byte sniff to hard-exclude non-jpeg image content (belt+suspenders CVE-2023-4863)
Done normal
unassigned
Follow-up from VENUS-106 (63edb62). The routine upload path is now safe: client always re-encodes to JPEG, server ACCEPTED_INPUT_MIME tightened to jpeg-only. But the server gate checks the DECLARED file.type, and sharp/libvips auto-detects the decoder by CONTENT — a crafted direct POST claiming image/jpeg with webp/other bytes could still invoke libwebp/another libvips codec. Defense-in-depth only, NOT a hard exclusion. Requires a malicious crafted POST by an authenticated uploader (alumno/docente) — low likelihood, trusted audience. Hard close = server-side magic-byte sniff (verify actual JPEG SOI marker/content) before handing to sharp, reject on mismatch. Low-pri hardening.
Questions
No questions.
Activity
-
hard-close of webp-CVE direct-POST route: assertJpegMagic(buffer) content-byte sniff (SOI FF D8 FF, rejects <3B truncated/empty) in uploadImage() after Buffer.from, before sharp() — crafted POST declaring jpeg but carrying webp/png/avif/heic bytes rejected INVALID_TYPE/400 before libvips can auto-detect+invoke another codec. Declared-MIME jpeg gate kept as first-line. uploadImage confirmed sole server sharp() entry. 6b26a0e v0.81.1 Class-A sonnet PASS. Residual on-record (not scoped): valid-JPEG exploiting libjpeg-turbo itself = different threat class, no WI unless Elazar wants deep-stream validation.
task
6w ago by wi-cli-venus
6w ago
2026-07-03 11:09