Laravel image upload

Question

I'm new to the filesystem from Laravel, but I need an upload script that allows users to upload images to my server. However, i'm concerned about securety, so I thought why not ask for advice, because there aren't much reverences about that big topic of securety.

Basicly, this is how I check the user upload and how I upload the file:

My request Class:

 return [
        'profile_picture' => 'image',
    ];

My check if the image is actually an image and not some bad maleware:

function checkIfImageIsAllowed($file) {
$allowedMimes = [
    'image/jpeg',
    'image/jpg',
    'image/png'
];

$allowedExtensions = [
    'jpg',
    'JPG',
    'jpeg',
    'png'
];
$allowedMaxSize = 2000000;
if(!in_array($file->getClientOriginalExtension(), $allowedExtensions) || !in_array($file->getMimeType(), $allowedMimes) || $file->getSize() > $allowedMaxSize) {
    return false;
}
return true;
}

And than I upload the file:

$path = $request->file('profile_picture')->store('UserUpload/Images');

This is how I display the Image:

    $images = \App\Image::where('uuid', $uuid)->firstOrFail();
    $path = $images->path;
    $image = Storage::get($path);
    $response = Response::make($image, 200);
    $response->header("Content-Type", $images->memeType);

    return $response;

What are your thoughts about this? Do you think this is secure enough? Or do you have some improvement for this?

Answer 1

The code can be made simpler by using some built-in Laravel validation rules:

• Validation of MIME types and extension can already be done in Laravel.

  With the rule image as you have for profile_picture, you're already validating if the uploaded file is of the mimetype jpeg, png, bmp, gif, or svg (docs here). If you'd like to specify the mimetype however, you can use the mimes rule.

• To validate the max size of the image, you can use the max rule.

• You can also validate the dimensions of the image if needed (docs here).

---

On the matter of security, I suppose you mean with the uploading of the images. The snippets of code you provided do seem enough (have not perused it), but I would advise using the built-in validation provided by Laravel to provide the best of convenience and security.