0

I'm implementing image upload via browser form and I'm working with AWS and NodeJS. The process is that user selects a file, provides additional info and it all is send to backend using multipart/form-data.

This works great so payload goes thru API Gateway ---> Lambda and this lambda uploads to S3 bucket. I'm using busboy to deal with multipart data and end up with nice JSON object containing all the data send from frontend, something like:

{
    userName: "Homer Simpson",
    file: base64endcoded_string,
}

Then I grab this base64endcoded_string and upload to S3 so file sits in there and I'm able to open it, download etc.

Now, obviously I don't trust any input from frontend and I wonder what is the best way to ensure that file being send is not malicious. In this case I need to allow upload only images, say png,jpg/jpeg up to 2mb in size.

Busboy gives me the MIME type, encoding and other details but not sure if this is reliable enough or I should use something like mmmagick or else. How secure and reliable would these solutions be? Any pointers would be much appreciated.

spirytus
  • 10,726
  • 14
  • 61
  • 75

1 Answers1

0

OWASP has a section on this with some ideas, anyways i found out that the best method to secure a image upload is to convert it, period, if you can convert it it's an image and you are sure that any attached info (code, hidden data, etc) is removed with the conversion process, if you can't it's not an image.

Another advantage is that you can strip exif info, add some data (watermarks for example), etc

David Carracedo Martínez
  • 9
  • 3