validate report attachment by file mime type

src/actions/report.ts

@@ -9,6 +9,7 @@ import crypto from 'node:crypto';
 import path from 'node:path';
 import { sendWebhook, WebhookAction } from '@util/webhook.ts';
 import { allowedImageTypes, allowedVideoTypes } from '@util/media.ts';
+import mime from 'mime/lite';
 
 export const report = {
   submitReport: defineAction({
@@ -26,14 +27,6 @@ export const report = {
         .nullable()
     }),
     handler: async (input) => {
-      const fileSize = input.files?.reduce((prev, curr) => prev + curr.size, 0);
-      if (fileSize && fileSize > MAX_UPLOAD_BYTES) {
-        throw new ActionError({
-          code: 'BAD_REQUEST',
-          message: 'Die Anhänge sind zu groß'
-        });
-      }
-
       const report = await db.getReportByUrlHash({ urlHash: input.urlHash });
       if (!report) {
         throw new ActionError({
@@ -54,13 +47,33 @@ export const report = {
         }
       }
 
-      if (!UPLOAD_PATH) {
+      if (input.files && !UPLOAD_PATH) {
         throw new ActionError({
           code: 'FORBIDDEN',
           message: 'Es dürfen keine Anhänge hochgeladen werden'
         });
       }
 
+      let totalFilesSize = 0;
+      for (const file of (input.files ?? [])) {
+        const realType = mime.getType(file.name);
+        if (realType != file.type) {
+          throw new ActionError({
+            code: 'NOT_ACCEPTABLE',
+            message: `Falscher Dateityp für '${file.name}': ${realType}`
+          });
+        }
+
+        totalFilesSize += file.size;
+      }
+
+      if (totalFilesSize > MAX_UPLOAD_BYTES) {
+        throw new ActionError({
+          code: 'BAD_REQUEST',
+          message: 'Die Anhänge sind zu groß'
+        });
+      }
+
       const filePaths = [] as string[];
       try {
         await db.transaction(async (tx) => {