Validate a base64 decoded image in laravel

Question

Im trying to get a image from a PUT request for update a user picture(using postman), and make it pass through a validation in Laravel 5.2, for making the call in postman use the following url:

http://localhost:8000/api/v1/users?_method=PUT

and send the image string in the body, using a json like this:

{
    "picture" : "data:image/png;base64,this-is-the-base64-encode-string"
}

In the controller try a lot of differents ways for decode the image and try to pass the validation:

First I tried this:

$data = request->input('picture');
$data = str_replace('data:image/png;base64,', '', $data);
$data = str_replace(' ', '+', $data);
$image = base64_decode($data);
$file = app_path() . uniqid() . '.png';
$success = file_put_contents($file, $image);

Then I tried this:

list($type, $data) = explode(';', $data);
list(, $data) = explode(',', $data);
$data = base64_decode($data);
$typeFile = explode(':', $type);
$extension = explode('/', $typeFile[1]);
$ext = $extension[1];
Storage::put(public_path() . '/prueba.' . $ext, $data);
$contents = Storage::get(base_path() . '/public/prueba.png');

Try to use the intervention image library (http://image.intervention.io/) and don't pass:

$image = Image::make($data);
$image->save(app_path() . 'test2.png');
$image = Image::make(app_path() . 'test1.png');

This is the validation in the controller:

    $data = [
        'picture' => $image,
        'first_name' => $request->input('first_name'),
        'last_name' => $request->input('last_name')
    ];

    $validator = Validator::make($data, User::rulesForUpdate());
    if ($validator->fails()) {
        return $this->respondFailedParametersValidation('Parameters failed validation for a user picture');
    }

this is the validation in the User-model:

public static function rulesForUpdate() {
    return [
        'first_name' => 'max:255',
        'last_name' => 'max:255',
        'picture' => 'image|max:5000|mimes:jpeg,png'
    ];
}

Cant pass the validation for a image created from a base64 string — Jorge Almonacid, Aug 19 '16 at 16:52

score 31 · Answer 1 · answered Sep 12 '16 at 02:59

31

If you are using Intervention anyways, then you can leverage it for a custom validation rule. I have one called "imageable". It basically makes sure that the input given will be able to be converted to an Intervention image. Base64 data image strings will pass. A string of "foo" will not.

Validator::extend('imageable', function ($attribute, $value, $params, $validator) {
    try {
        ImageManagerStatic::make($value);
        return true;
    } catch (\Exception $e) {
        return false;
    }
});

This obviously just checks that the input is able to be converted to an image. However, it should show you as a use-case how you can leverage Intervention and any of it's methods to create a custom rule.

answered Sep 12 '16 at 02:59

Mike McLin

3,627
7
41
49

I have added your code in the ```boot``` method of the ```AppServiceProvider```. But the base64 string doesn't pass the validation. Am I missing something? Where the extension is defined? – JCarlosR Apr 08 '17 at 21:31
@JCarlos I place mine in the `boot` method as well. You must have something else wrong. – Mike McLin Apr 10 '17 at 20:54
This really helped me out in my current app, thanks a million!! – jiraiya Apr 20 '17 at 23:46
Dont forget to import use Illuminate\Support\Facades\Validator; use Intervention\Image\ImageManagerStatic; – James Ikubi Aug 10 '20 at 12:42

score 23 · Accepted Answer · answered Aug 24 '16 at 12:11

23

You can extend the Validator class of Laravel.

Laravel Doc

But anyway try this

Validator::extend('is_png',function($attribute, $value, $params, $validator) {
    $image = base64_decode($value);
    $f = finfo_open();
    $result = finfo_buffer($f, $image, FILEINFO_MIME_TYPE);
    return $result == 'image/png';
});

Don't forget the rules:

$rules = array(
   'image' => 'is_png'
);

answered Aug 24 '16 at 12:11

jnieto

1,871
2
16
19

6

if the hacker put a string start with "/9j" (e.g: "/9j{{what_ever_additional_string_to_hack_here}}") in the input, it is still detect as `image/jpeg` .... so this validation is not secured – Syamsoul Azrien Jun 28 '20 at 12:18
the $result variable return "application/octet-stream" instead of "image/png" or "image/jpg" – Sachin Kumar Sep 27 '21 at 17:27
Any way to validate the dimensions of the image? – Petar Vasilev Nov 30 '22 at 16:54

score 0 · Answer 3 · answered Jun 10 '19 at 16:39

0

inside extend function add this

$res= mime_content_type($value);
if ($res == 'image/png' || $res == 'image/jpeg') {
    return $res;
}

answered Jun 10 '19 at 16:39

Hamodea Net

105
1
1
10

1

This only works if you upload a real file and not a data url or data base64 – Victor Gazotti Mar 26 '20 at 19:47
this work if you pass a base64 I tried it many times plz give it a try – Hamodea Net Oct 03 '20 at 13:29
yes this code will work – Mohamed Melouk Jan 05 '23 at 02:20

Validate a base64 decoded image in laravel

3 Answers3

Linked

Related