Insecure File Upload: How AI Code Lets Attackers Upload Web Shells

import multer from 'multer';
import { fileTypeFromBuffer } from 'file-type';
import crypto from 'crypto';
import path from 'path';

// Store OUTSIDE webroot
const UPLOAD_DIR = '/var/uploads';  // Not in /public

// Allowlist of permitted MIME types
const ALLOWED_TYPES = new Map([
  ['image/jpeg', '.jpg'],
  ['image/png', '.png'],
  ['image/gif', '.gif'],
  ['application/pdf', '.pdf'],
]);

// Memory storage for content inspection
const upload = multer({
  storage: multer.memoryStorage(),
  limits: {
    fileSize: 5 * 1024 * 1024,  // 5MB limit
    files: 1,
  },
});

app.post('/upload', upload.single('file'), async (req, res) => {
  try {
    if (!req.file) {
      return res.status(400).json({ error: 'No file provided' });
    }

    // Validate actual content using magic bytes
    const fileType = await fileTypeFromBuffer(req.file.buffer);

    if (!fileType || !ALLOWED_TYPES.has(fileType.mime)) {
      return res.status(400).json({
        error: 'Invalid file type. Allowed: JPEG, PNG, GIF, PDF'
      });
    }

    // Generate random filename - NEVER use user input
    const randomName = crypto.randomBytes(16).toString('hex');
    const safeExt = ALLOWED_TYPES.get(fileType.mime);
    const filename = `${randomName}${safeExt}`;

    // Ensure path stays within upload directory
    const filepath = path.join(UPLOAD_DIR, filename);
    if (!filepath.startsWith(UPLOAD_DIR)) {
      return res.status(400).json({ error: 'Invalid path' });
    }

    // Write file with restrictive permissions
    await fs.writeFile(filepath, req.file.buffer, { mode: 0o644 });

    // Return ID, not direct path - serve through controller
    res.json({ fileId: randomName });

  } catch (error) {
    console.error('Upload error:', error);
    res.status(500).json({ error: 'Upload failed' });
  }
});

// Serve files through controller, not static directory
app.get('/files/:id', async (req, res) => {
  const id = req.params.id.replace(/[^a-f0-9]/gi, '');  // Sanitize
  const files = await fs.readdir(UPLOAD_DIR);
  const file = files.find(f => f.startsWith(id));

  if (!file) {
    return res.status(404).json({ error: 'File not found' });
  }

  const filepath = path.join(UPLOAD_DIR, file);
  res.sendFile(filepath);
});

import { S3Client, PutObjectCommand } from '@aws-sdk/client-s3';
import { getSignedUrl } from '@aws-sdk/s3-request-presigner';

const s3 = new S3Client({ region: process.env.AWS_REGION });

// Generate presigned URL - client uploads directly to S3
app.post('/upload-url', authenticateUser, async (req, res) => {
  const { filename, contentType } = req.body;

  // Validate content type
  const allowed = ['image/jpeg', 'image/png', 'application/pdf'];
  if (!allowed.includes(contentType)) {
    return res.status(400).json({ error: 'Invalid file type' });
  }

  // Generate safe key with user isolation
  const key = `uploads/${req.user.id}/${crypto.randomUUID()}`;

  const command = new PutObjectCommand({
    Bucket: process.env.S3_BUCKET,
    Key: key,
    ContentType: contentType,
    // Limit size
    ContentLength: 5 * 1024 * 1024,
  });

  const uploadUrl = await getSignedUrl(s3, command, { expiresIn: 300 });

  res.json({ uploadUrl, key });
});