Merge pull request #226 from vjuliaife/fix/vehicle-upload-file-signature-validation

fix(upload): verify file signatures and reject image bombs for vehicle uploads

Author: Obiajulu-gif

__tests__/lib/security/kyc-file-validation.test.ts

@@ -1,21 +1,58 @@
 import { describe, it, expect } from "vitest"
-import { validateKycFile, KYC_MAX_FILE_SIZE } from "@/lib/security/kyc-file-validation"
-
-function jpegHeader(): Buffer {
-  return Buffer.from([0xff, 0xd8, 0xff, 0xe0, 0x00, 0x10, 0x4a, 0x46, 0x49, 0x46])
+import {
+  validateKycFile,
+  KYC_MAX_FILE_SIZE,
+  MAX_IMAGE_DIMENSION_PX,
+  MAX_IMAGE_PIXELS,
+} from "@/lib/security/kyc-file-validation"
+
+function jpegHeader(width = 100, height = 100): Buffer {
+  const soi = Buffer.from([0xff, 0xd8])
+  const app0 = Buffer.from([
+    0xff, 0xe0, 0x00, 0x10, 0x4a, 0x46, 0x49, 0x46, 0x00, 0x01, 0x01, 0x00, 0x00, 0x01, 0x00, 0x01, 0x00, 0x00,
+  ])
+  const sof0 = Buffer.alloc(19)
+  sof0[0] = 0xff
+  sof0[1] = 0xc0
+  sof0.writeUInt16BE(17, 2)
+  sof0[4] = 8
+  sof0.writeUInt16BE(height, 5)
+  sof0.writeUInt16BE(width, 7)
+  sof0[9] = 3
+  const eoi = Buffer.from([0xff, 0xd9])
+  return Buffer.concat([soi, app0, sof0, eoi])
 }
 
-function pngHeader(): Buffer {
-  return Buffer.from([0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a, 0x00, 0x00, 0x00, 0x0d, 0x49, 0x48, 0x44, 0x52])
+function pngHeader(width = 100, height = 100): Buffer {
+  const sig = Buffer.from([0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a])
+  const length = Buffer.alloc(4)
+  length.writeUInt32BE(13, 0)
+  const chunkType = Buffer.from("IHDR")
+  const data = Buffer.alloc(13)
+  data.writeUInt32BE(width, 0)
+  data.writeUInt32BE(height, 4)
+  data[8] = 8
+  data[9] = 6
+  const crc = Buffer.alloc(4)
+  return Buffer.concat([sig, length, chunkType, data, crc])
 }
 
-function webpHeader(): Buffer {
-  const buf = Buffer.alloc(20)
-  buf.write("RIFF", 0)
-  buf.writeUInt32LE(100, 4)
-  buf.write("WEBP", 8)
-  buf.write("VP8 ", 12)
-  return buf
+function webpHeader(width = 100, height = 100): Buffer {
+  const payload = Buffer.alloc(10)
+  payload[3] = 0x9d
+  payload[4] = 0x01
+  payload[5] = 0x2a
+  payload.writeUInt16LE(width & 0x3fff, 6)
+  payload.writeUInt16LE(height & 0x3fff, 8)
+  const chunkHeader = Buffer.alloc(8)
+  chunkHeader.write("VP8 ", 0)
+  chunkHeader.writeUInt32LE(payload.length, 4)
+  const webpChunk = Buffer.concat([chunkHeader, payload])
+  const riffHeader = Buffer.alloc(12)
+  riffHeader.write("RIFF", 0)
+  riffHeader.writeUInt32LE(4 + webpChunk.length, 4)
+  riffHeader.write("WEBP", 8)
+  return Buffer.concat([riffHeader, webpChunk])
 }
 
 function pdfHeader(): Buffer {
@@ -114,6 +151,41 @@ describe("validateKycFile", () => {
     })
   })
 
+  describe("image dimension bounds", () => {
+    it("rejects a truncated JPEG with no decodable dimensions", () => {
+      const buffer = Buffer.from([0xff, 0xd8, 0xff])
+      const result = validateKycFile(buffer, "image/jpeg", "truncated.jpg")
+      expect(result.valid).toBe(false)
+      expect(result.errors.some((e) => e.includes("Unable to determine image dimensions"))).toBe(true)
+    })
+
+    it("rejects an image wider than the maximum allowed dimension", () => {
+      const buffer = jpegHeader(MAX_IMAGE_DIMENSION_PX + 1, 100)
+      const result = validateKycFile(buffer, "image/jpeg", "wide.jpg")
+      expect(result.valid).toBe(false)
+      expect(result.errors.some((e) => e.includes("exceed the maximum allowed"))).toBe(true)
+    })
+
+    it("rejects a decompression-bomb image whose pixel count exceeds the cap even though each side is within bounds", () => {
+      const side = Math.floor(Math.sqrt(MAX_IMAGE_PIXELS)) + 1000
+      const buffer = pngHeader(side, side)
+      const result = validateKycFile(buffer, "image/png", "bomb.png")
+      expect(result.valid).toBe(false)
+      expect(result.errors.some((e) => e.includes("exceed the maximum allowed"))).toBe(true)
+    })
+
+    it("accepts a WebP image within bounds", () => {
+      const buffer = webpHeader(200, 150)
+      const result = validateKycFile(buffer, "image/webp", "photo.webp")
+      expect(result.valid).toBe(true)
+    })
+
+    it("does not require image dimensions for PDF files", () => {
+      const result = validateKycFile(pdfHeader(), "application/pdf", "document.pdf")
+      expect(result.valid).toBe(true)
+    })
+  })
+
   describe("checksum", () => {
     it("returns consistent checksum for same content", () => {
       const buffer = pngHeader()

lib/security/kyc-file-validation.ts

@@ -11,6 +11,14 @@ export const KYC_ALLOWED_MIME_TYPES = new Set([
 
 export const KYC_ALLOWED_EXTENSIONS = new Set([".jpg", ".jpeg", ".png", ".webp", ".pdf"])
 
+// Bounds shared by every caller (KYC documents and vehicle images) that decode
+// approved image formats. These limits guard against decompression-bomb style
+// inputs where a tiny file declares an enormous pixel grid.
+export const MAX_IMAGE_DIMENSION_PX = 12000
+export const MAX_IMAGE_PIXELS = 50_000_000
+
+const IMAGE_MIME_TYPES = new Set(["image/jpeg", "image/png", "image/webp"])
+
 const SIGNATURES: { mime: string; extension: string[]; bytes: Buffer; offset: number }[] = [
   {
     mime: "image/jpeg",
@@ -68,6 +76,95 @@ function detectExtension(buffer: Buffer): string | null {
   return null
 }
 
+type ImageDimensions = { width: number; height: number }
+
+function getJpegDimensions(buffer: Buffer): ImageDimensions | null {
+  if (buffer.length < 4 || buffer[0] !== 0xff || buffer[1] !== 0xd8) return null
+
+  let offset = 2
+  while (offset + 4 <= buffer.length) {
+    if (buffer[offset] !== 0xff) return null
+    const marker = buffer[offset + 1]
+
+    // Markers without a length-prefixed payload.
+    if (marker === 0x01 || (marker >= 0xd0 && marker <= 0xd9)) {
+      offset += 2
+      continue
+    }
+
+    const length = buffer.readUInt16BE(offset + 2)
+    const isSOF =
+      (marker >= 0xc0 && marker <= 0xc3) ||
+      (marker >= 0xc5 && marker <= 0xc7) ||
+      (marker >= 0xc9 && marker <= 0xcb) ||
+      (marker >= 0xcd && marker <= 0xcf)
+
+    if (isSOF) {
+      if (offset + 9 > buffer.length) return null
+      const height = buffer.readUInt16BE(offset + 5)
+      const width = buffer.readUInt16BE(offset + 7)
+      if (!width || !height) return null
+      return { width, height }
+    }
+
+    if (marker === 0xda || length < 2) return null
+    offset += 2 + length
+  }
+  return null
+}
+
+function getPngDimensions(buffer: Buffer): ImageDimensions | null {
+  if (buffer.length < 24) return null
+  const width = buffer.readUInt32BE(16)
+  const height = buffer.readUInt32BE(20)
+  if (!width || !height) return null
+  return { width, height }
+}
+
+function getWebpDimensions(buffer: Buffer): ImageDimensions | null {
+  if (buffer.length < 20) return null
+  const chunkFourCC = buffer.subarray(12, 16).toString("ascii")
+
+  if (chunkFourCC === "VP8 ") {
+    if (buffer.length < 30) return null
+    if (!(buffer[23] === 0x9d && buffer[24] === 0x01 && buffer[25] === 0x2a)) return null
+    const width = buffer.readUInt16LE(26) & 0x3fff
+    const height = buffer.readUInt16LE(28) & 0x3fff
+    if (!width || !height) return null
+    return { width, height }
+  }
+
+  if (chunkFourCC === "VP8L") {
+    if (buffer.length < 25 || buffer[20] !== 0x2f) return null
+    const bits = buffer.readUInt32LE(21)
+    const width = (bits & 0x3fff) + 1
+    const height = ((bits >> 14) & 0x3fff) + 1
+    return { width, height }
+  }
+
+  if (chunkFourCC === "VP8X") {
+    if (buffer.length < 30) return null
+    const width = (buffer[24] | (buffer[25] << 8) | (buffer[26] << 16)) + 1
+    const height = (buffer[27] | (buffer[28] << 8) | (buffer[29] << 16)) + 1
+    return { width, height }
+  }
+
+  return null
+}
+
+function getImageDimensions(buffer: Buffer, mimeType: string): ImageDimensions | null {
+  switch (mimeType) {
+    case "image/jpeg":
+      return getJpegDimensions(buffer)
+    case "image/png":
+      return getPngDimensions(buffer)
+    case "image/webp":
+      return getWebpDimensions(buffer)
+    default:
+      return null
+  }
+}
+
 export type FileValidationResult = {
   valid: boolean
   errors: string[]
@@ -120,6 +217,21 @@ export function validateKycFile(
     )
   }
 
+  if (detectedMimeType && IMAGE_MIME_TYPES.has(detectedMimeType)) {
+    const dimensions = getImageDimensions(buffer, detectedMimeType)
+    if (!dimensions) {
+      errors.push("Unable to determine image dimensions. File may be malformed, truncated, or corrupted.")
+    } else if (
+      dimensions.width > MAX_IMAGE_DIMENSION_PX ||
+      dimensions.height > MAX_IMAGE_DIMENSION_PX ||
+      dimensions.width * dimensions.height > MAX_IMAGE_PIXELS
+    ) {
+      errors.push(
+        `Image dimensions ${dimensions.width}x${dimensions.height} exceed the maximum allowed ${MAX_IMAGE_DIMENSION_PX}px per side or ${MAX_IMAGE_PIXELS} total pixels.`,
+      )
+    }
+  }
+
   return {
     valid: errors.length === 0,
     errors,