1
\$\begingroup\$

I'm new to the filesystem from Laravel, but I need an upload script that allows users to upload images to my server. However, i'm concerned about securety, so I thought why not ask for advice, because there aren't much reverences about that big topic of securety.

Basicly, this is how I check the user upload and how I upload the file:

My request Class:

 return [
        'profile_picture' => 'image',
    ];

My check if the image is actually an image and not some bad maleware:

function checkIfImageIsAllowed($file) {
$allowedMimes = [
    'image/jpeg',
    'image/jpg',
    'image/png'
];

$allowedExtensions = [
    'jpg',
    'JPG',
    'jpeg',
    'png'
];
$allowedMaxSize = 2000000;
if(!in_array($file->getClientOriginalExtension(), $allowedExtensions) || !in_array($file->getMimeType(), $allowedMimes) || $file->getSize() > $allowedMaxSize) {
    return false;
}
return true;
}

And than I upload the file:

$path = $request->file('profile_picture')->store('UserUpload/Images');

This is how I display the Image:

    $images = \App\Image::where('uuid', $uuid)->firstOrFail();
    $path = $images->path;
    $image = Storage::get($path);
    $response = Response::make($image, 200);
    $response->header("Content-Type", $images->memeType);

    return $response;

What are your thoughts about this? Do you think this is secure enough? Or do you have some improvement for this?

\$\endgroup\$
  • \$\begingroup\$ image/jpg mime type doesn't exist. Both extensions use image/jpeg. Also you should have lower cases only in extensions array and check it with !in_array(strtolower($file->getMimeType()), $allowedMimes). \$\endgroup\$ – Tpojka Oct 14 '18 at 10:38
2
\$\begingroup\$

The code can be made simpler by using some built-in Laravel validation rules:

  • Validation of MIME types and extension can already be done in Laravel.

    With the rule image as you have for profile_picture, you're already validating if the uploaded file is of the mimetype jpeg, png, bmp, gif, or svg (docs here). If you'd like to specify the mimetype however, you can use the mimes rule.

  • To validate the max size of the image, you can use the max rule.

  • You can also validate the dimensions of the image if needed (docs here).


On the matter of security, I suppose you mean with the uploading of the images. The snippets of code you provided do seem enough (have not perused it), but I would advise using the built-in validation provided by Laravel to provide the best of convenience and security.

\$\endgroup\$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.