@nestjs/common 10.4.14 → 10.4.16

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nestjs/common",
-  "version": "10.4.14",
+  "version": "10.4.16",
   "description": "Nest - modern, fast, powerful node.js web framework (@common)",
   "author": "Kamil Mysliwiec",
   "homepage": "https://nestjs.com",
@@ -25,6 +25,7 @@
   "peerDependencies": {
     "class-transformer": "*",
     "class-validator": "*",
+    "file-type": "^20.4.1",
     "reflect-metadata": "^0.1.12 || ^0.2.0",
     "rxjs": "^7.1.0"
   },
@@ -34,6 +35,9 @@
     },
     "class-transformer": {
       "optional": true
+    },
+    "file-type": {
+      "optional": true
     }
   }
 }

package/pipes/file/file-type.validator.d.ts

@@ -2,19 +2,23 @@ import { FileValidator } from './file-validator.interface';
 import { IFile } from './interfaces';
 export type FileTypeValidatorOptions = {
     fileType: string | RegExp;
+    /**
+     * If `true`, the validator will skip the magic numbers validation.
+     * This can be useful when you can't identify some files as there are no common magic numbers available for some file types.
+     * @default false
+     */
+    skipMagicNumbersValidation?: boolean;
 };
 /**
- * Defines the built-in FileType File Validator. It validates incoming files mime-type
- * matching a string or a regular expression. Note that this validator uses a naive strategy
- * to check the mime-type and could be fooled if the client provided a file with renamed extension.
- * (for instance, renaming a 'malicious.bat' to 'malicious.jpeg'). To handle such security issues
- * with more reliability, consider checking against the file's [magic-numbers](https://en.wikipedia.org/wiki/Magic_number_%28programming%29)
+ * Defines the built-in FileTypeValidator. It validates incoming files by examining
+ * their magic numbers using the file-type package, providing more reliable file type validation
+ * than just checking the mimetype string.
  *
  * @see [File Validators](https://docs.nestjs.com/techniques/file-upload#validators)
  *
  * @publicApi
  */
 export declare class FileTypeValidator extends FileValidator<FileTypeValidatorOptions, IFile> {
-    buildErrorMessage(): string;
-    isValid(file?: IFile): boolean;
+    buildErrorMessage(file?: IFile): string;
+    isValid(file?: IFile): Promise<boolean>;
 }

package/pipes/file/file-type.validator.js

@@ -3,27 +3,40 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.FileTypeValidator = void 0;
 const file_validator_interface_1 = require("./file-validator.interface");
 /**
- * Defines the built-in FileType File Validator. It validates incoming files mime-type
- * matching a string or a regular expression. Note that this validator uses a naive strategy
- * to check the mime-type and could be fooled if the client provided a file with renamed extension.
- * (for instance, renaming a 'malicious.bat' to 'malicious.jpeg'). To handle such security issues
- * with more reliability, consider checking against the file's [magic-numbers](https://en.wikipedia.org/wiki/Magic_number_%28programming%29)
+ * Defines the built-in FileTypeValidator. It validates incoming files by examining
+ * their magic numbers using the file-type package, providing more reliable file type validation
+ * than just checking the mimetype string.
  *
  * @see [File Validators](https://docs.nestjs.com/techniques/file-upload#validators)
  *
  * @publicApi
  */
 class FileTypeValidator extends file_validator_interface_1.FileValidator {
-    buildErrorMessage() {
+    buildErrorMessage(file) {
+        if (file?.mimetype) {
+            return `Validation failed (current file type is ${file.mimetype}, expected type is ${this.validationOptions.fileType})`;
+        }
         return `Validation failed (expected type is ${this.validationOptions.fileType})`;
     }
-    isValid(file) {
+    async isValid(file) {
         if (!this.validationOptions) {
             return true;
         }
-        return (!!file &&
-            'mimetype' in file &&
-            !!file.mimetype.match(this.validationOptions.fileType));
+        const isFileValid = !!file && 'mimetype' in file;
+        if (this.validationOptions.skipMagicNumbersValidation) {
+            return (isFileValid && !!file.mimetype.match(this.validationOptions.fileType));
+        }
+        if (!isFileValid || !file.buffer) {
+            return false;
+        }
+        try {
+            const { fileTypeFromBuffer } = (await eval('import ("file-type")'));
+            const fileType = await fileTypeFromBuffer(file.buffer);
+            return (!!fileType && !!fileType.mime.match(this.validationOptions.fileType));
+        }
+        catch {
+            return false;
+        }
     }
 }
 exports.FileTypeValidator = FileTypeValidator;

package/pipes/file/interfaces/file.interface.d.ts

@@ -1,4 +1,5 @@
 export interface IFile {
     mimetype: string;
     size: number;
+    buffer?: Buffer;
 }