Images/photos in reviews are moderated or require explicit approval

Review image uploads with no file type validation, size limits, or approval gate are a CWE-434 (Unrestricted File Upload) and CWE-79 (XSS) exposure: an attacker can upload an SVG with embedded <script> tags or a polyglot file that executes when rendered inline. OWASP A04:2021 (Insecure Design) covers the absence of upload constraints at the design level. Even without malicious intent, a user uploading a 50MB RAW photo file will exhaust serverless function memory and trigger a 500 error for all concurrent visitors. Images served directly from an S3 path with no content-type header enforcement allow MIME-type confusion attacks in older browsers.

Enforce file type and size limits at the upload handler in api/reviews/submit, and require admin approval before images are displayed publicly.

// api/reviews/submit — image validation
const ALLOWED_TYPES = ['image/jpeg', 'image/png', 'image/webp']
const MAX_SIZE_BYTES = 5 * 1024 * 1024 // 5MB

for (const file of uploadedFiles) {
  if (!ALLOWED_TYPES.includes(file.type)) {
    return Response.json({ error: `File type ${file.type} not allowed` }, { status: 400 })
  }
  if (file.size > MAX_SIZE_BYTES) {
    return Response.json({ error: 'Image exceeds 5MB limit' }, { status: 400 })
  }
}

// Store with pending status — never display immediately
await db.reviewImages.create({
  data: { review_id: reviewId, file_path: uploadedPath, status: 'pending' }
})

Only query WHERE status = 'approved' when rendering images on the product page. Reject SVG and GIF entirely to eliminate the highest-risk polyglot vectors.