File uploads enforce MIME type and size limits server-side

File uploads validated only by extension are trivially bypassed: rename shell.php to shell.jpg and upload. Without MIME type inspection via magic bytes and enforced server-side size limits, attackers can store and potentially execute malicious payloads on your server, or exhaust storage with multi-gigabyte uploads that bypass client-only size caps. CWE-434 (Unrestricted Upload of File with Dangerous Type) and OWASP A03 cover this directly.

Validate MIME type via file magic bytes, not just Content-Type header or file extension. Enforce size before reading the full buffer. In app/api/listings/upload/route.ts:

const ALLOWED_TYPES: Record<string, number[]> = {
  'image/jpeg': [0xFF, 0xD8, 0xFF],
  'image/png':  [0x89, 0x50, 0x4E, 0x47],
  'image/webp': [0x52, 0x49, 0x46, 0x46]
}
const MAX_BYTES = 5 * 1024 * 1024 // 5 MB

if (file.size > MAX_BYTES) {
  return Response.json({ error: 'File exceeds 5 MB limit' }, { status: 400 })
}

const buf = new Uint8Array(await file.arrayBuffer())
const sig = ALLOWED_TYPES[file.type]
if (!sig || !sig.every((b, i) => buf[i] === b)) {
  return Response.json({ error: 'Unsupported or mismatched file type' }, { status: 400 })
}

Store uploaded files outside the web root (or in a dedicated object storage bucket) and never serve them with execute permissions.