File upload endpoints have size and type restrictions

Unrestricted file uploads are the intersection of CWE-434 (unrestricted upload of dangerous file type) and CWE-770 (resource exhaustion). Accepting unbounded file sizes lets attackers fill your storage quota and exhaust memory parsing the upload body. Validating file type only by extension or the caller-controlled Content-Type header is trivially bypassed: renaming exploit.php to exploit.png and setting Content-Type: image/png defeats both checks. OWASP API 2023 flags this under API4 (unrestricted resource consumption) and API8 (security misconfiguration).

Harden every upload endpoint in app/api/ with three independent controls. First, limit size at the parser level. Second, validate MIME type from actual file bytes using the file-type package — Content-Type headers are attacker-controlled and cannot be trusted. Third, enforce an allowlist:

import { fileTypeFromBuffer } from 'file-type'

const MAX_SIZE = 5 * 1024 * 1024 // 5MB
const ALLOWED_TYPES = new Set(['image/jpeg', 'image/png', 'image/webp', 'application/pdf'])

const arrayBuffer = await file.arrayBuffer()
if (arrayBuffer.byteLength > MAX_SIZE) return apiError('FILE_TOO_LARGE', '...', 413)

const detected = await fileTypeFromBuffer(Buffer.from(arrayBuffer))
if (!detected || !ALLOWED_TYPES.has(detected.mime)) {
  return apiError('INVALID_FILE_TYPE', '...', 415)
}

Store the file in object storage (S3, Supabase Storage, R2) under a random UUID key — never the user-supplied filename.