upload-safety 0.2.0 → 0.2.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +4 -1
- package/package.json +2 -2
package/README.md
CHANGED
|
@@ -6,6 +6,7 @@
|
|
|
6
6
|
[](package.json)
|
|
7
7
|
[](package.json)
|
|
8
8
|
[](src/index.ts)
|
|
9
|
+
[](https://upload-safety.simonhalimonov.com)
|
|
9
10
|
|
|
10
11
|
Server-side upload checks for Node that read the file, not just its name. An upload passes only when its extension, its declared MIME type and its bytes agree, and when it carries nothing that runs on its own: no macros, embedded objects, DDE fields, PDF scripts or CSV formulas. Photos, including iPhone HEIC, lose their GPS position and other metadata on the way through.
|
|
11
12
|
|
|
@@ -46,6 +47,8 @@ Every check fails closed: a part it cannot read is a refusal, not a pass.
|
|
|
46
47
|
- **Fast enough to run inline.** Synchronous; 647 real documents up to 20 MB each took at most 65 ms on a laptop.
|
|
47
48
|
- **Tested against crafted files.** 235 tests build malformed ZIPs, compound files and PDFs byte by byte, next to real Office and PDF files.
|
|
48
49
|
|
|
50
|
+
Full documentation, with a page per format: **[upload-safety.simonhalimonov.com](https://upload-safety.simonhalimonov.com)**.
|
|
51
|
+
|
|
49
52
|
## Install
|
|
50
53
|
|
|
51
54
|
```sh
|
|
@@ -170,7 +173,7 @@ The library checks the bytes it is handed. The rest of the upload path is up to
|
|
|
170
173
|
- **Limit the request body before reading it.** `maxBytes` is checked after the whole file is in memory, so cap the body in your server or proxy first.
|
|
171
174
|
- **Serve stored files as downloads.** Send `Content-Disposition: attachment` and `X-Content-Type-Options: nosniff`, and use the canonical `result.mimeType`, not the one the client declared. Serving uploads from a separate origin keeps a file that slips through away from your cookies.
|
|
172
175
|
- **Limit image dimensions before resizing.** A small JPEG or PNG can declare a huge size. These checks do not decode images, so cap width and height in whatever makes thumbnails (sharp's `limitInputPixels`, ImageMagick's `policy.xml`).
|
|
173
|
-
- **Expect metadata in documents.** Only
|
|
176
|
+
- **Expect metadata in documents.** Only photos are stripped. Author names in Office and PDF files, and EXIF in images inside documents, are kept.
|
|
174
177
|
- **Run a virus scanner if you need one.** These checks refuse active content; they do not recognise malware in data.
|
|
175
178
|
|
|
176
179
|
## Development
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "upload-safety",
|
|
3
|
-
"version": "0.2.
|
|
3
|
+
"version": "0.2.1",
|
|
4
4
|
"description": "Server-side upload checks for Node: extension/MIME allowlist, magic bytes, refusal of macros, embedded objects, DDE, PDF scripts, CSV formulas and encrypted files, metadata stripping for JPEG, PNG, WebP, HEIC and AVIF.",
|
|
5
5
|
"keywords": [
|
|
6
6
|
"upload",
|
|
@@ -26,7 +26,7 @@
|
|
|
26
26
|
"type": "git",
|
|
27
27
|
"url": "git+https://github.com/simulieren/upload-safety.git"
|
|
28
28
|
},
|
|
29
|
-
"homepage": "https://
|
|
29
|
+
"homepage": "https://upload-safety.simonhalimonov.com",
|
|
30
30
|
"bugs": {
|
|
31
31
|
"url": "https://github.com/simulieren/upload-safety/issues"
|
|
32
32
|
},
|