Unrestricted File Upload

// Node.js/Express - Secure file upload

const multer = require('multer');
const crypto = require('crypto');
const fileType = require('file-type');  // Validates file magic bytes

// SECURE: Store uploads outside web root
const UPLOAD_DIR = '/var/app/uploads'; // NOT under public/
const MAX_FILE_SIZE = 5 * 1024 * 1024; // 5MB limit

// Whitelist of allowed MIME types
const ALLOWED_IMAGE_TYPES = new Set([
  'image/jpeg',
  'image/png',
  'image/gif',
  'image/webp'
]);

const ALLOWED_DOCUMENT_TYPES = new Set([
  'application/pdf'
]);

// SECURE: Configure multer with strict limits
const storage = multer.diskStorage({
  destination: (req, file, cb) => {
    // Store outside web root
    cb(null, UPLOAD_DIR);
  },
  filename: (req, file, cb) => {
    // SECURE: Generate random filename, ignore client input
    const randomName = crypto.randomBytes(16).toString('hex');
    const ext = path.extname(file.originalname).toLowerCase();
    cb(null, `${randomName}${ext}`);
  }
});

const upload = multer({
  storage: storage,
  limits: {
    fileSize: MAX_FILE_SIZE,  // Enforce size limit
    files: 10  // Max files per request
  },
  fileFilter: (req, file, cb) => {
    // SECURE: Pre-validate MIME type (but verify magic bytes after too)
    const isImage = ALLOWED_IMAGE_TYPES.has(file.mimetype);
    const isDoc = ALLOWED_DOCUMENT_TYPES.has(file.mimetype);
    
    if (isImage || isDoc) {
      cb(null, true);
    } else {
      cb(new Error(`Invalid file type: ${file.mimetype}`));
    }
  }
});

// SECURE: Avatar upload with validation
app.post('/api/upload-avatar', upload.single('avatar'), async (req, res) => {
  try {
    if (!req.file) {
      return res.status(400).json({ error: 'No file uploaded' });
    }
    
    // SECURE: Verify magic bytes match MIME type
    const buffer = await fs.promises.readFile(req.file.path);
    const type = await fileType.fromBuffer(buffer);
    
    if (!type || !ALLOWED_IMAGE_TYPES.has(type.mime)) {
      // Delete invalid file
      await fs.promises.unlink(req.file.path);
      return res.status(400).json({ error: 'Invalid image file' });
    }
    
    // Store file metadata in database
    const fileRecord = await db.files.create({
      userId: req.user.id,
      filename: req.file.filename,
      originalName: path.basename(req.file.originalname), // Sanitized
      mimeType: type.mime,
      size: req.file.size,
      uploadedAt: new Date()
    });
    
    // SECURE: Return file ID, not direct URL
    // Files served through separate endpoint with validation
    res.json({
      message: 'Avatar uploaded',
      fileId: fileRecord.id
    });
    
  } catch (error) {
    // Clean up on error
    if (req.file) {
      await fs.promises.unlink(req.file.path).catch(() => {});
    }
    res.status(500).json({ error: 'Upload failed' });
  }
});

// SECURE: Serve uploaded files with proper headers
app.get('/api/files/:fileId', async (req, res) => {
  const fileId = parseInt(req.params.fileId);
  
  // Look up file metadata
  const fileRecord = await db.files.findOne({
    where: { id: fileId }
  });
  
  if (!fileRecord) {
    return res.status(404).json({ error: 'File not found' });
  }
  
  // Optional: Check authorization
  // if (fileRecord.userId !== req.user.id && !req.user.isAdmin) {
  //   return res.status(403).json({ error: 'Access denied' });
  // }
  
  const filePath = path.join(UPLOAD_DIR, fileRecord.filename);
  
  // SECURE: Set headers to prevent execution
  res.setHeader('X-Content-Type-Options', 'nosniff');
  res.setHeader('Content-Type', fileRecord.mimeType);
  
  // For images, can inline; for documents, force download
  if (!ALLOWED_IMAGE_TYPES.has(fileRecord.mimeType)) {
    res.setHeader('Content-Disposition', `attachment; filename="${fileRecord.originalName}"`);
  }
  
  // SECURE: Ideally serve from separate domain (e.g., static.example.com)
  // to prevent cookies from being sent
  res.sendFile(filePath);
});

// SECURE: Document upload
app.post('/api/upload-document', upload.single('document'), async (req, res) => {
  try {
    if (!req.file) {
      return res.status(400).json({ error: 'No file' });
    }
    
    // Verify it's actually a PDF
    const buffer = await fs.promises.readFile(req.file.path);
    const type = await fileType.fromBuffer(buffer);
    
    if (type?.mime !== 'application/pdf') {
      await fs.promises.unlink(req.file.path);
      return res.status(400).json({ error: 'Only PDF files allowed' });
    }
    
    const fileRecord = await db.files.create({
      userId: req.user.id,
      filename: req.file.filename,
      originalName: path.basename(req.file.originalname),
      mimeType: 'application/pdf',
      size: req.file.size,
      uploadedAt: new Date()
    });
    
    res.json({
      message: 'Document uploaded',
      fileId: fileRecord.id
    });
    
  } catch (error) {
    if (req.file) {
      await fs.promises.unlink(req.file.path).catch(() => {});
    }
    res.status(500).json({ error: 'Upload failed' });
  }
});