agora-inc / platform

Full code for mora.stream, the "Twitch.tv for academic researchers". The streaming platform served several thousands of concurrent viewers. This has now been acquired and absorbed by Cassyni.
https://cassyni.com/mora
4 stars 0 forks source link

Basic Security Measures #409

Open argoopjmc opened 3 years ago

argoopjmc commented 3 years ago

Can we use mime-type checks for ensuring that an actual PDF is being uploaded to our site? Just checking that .pdf is the extension is not enough , mime would tell us whether it is an actual PDF ( an actual PDF is supposed to start with certain characters , and contains some more information after that which proves it's identity).

Similarly , for our database , we should be using prepared statements to minimise SQL injection attacks.

https://stackoverflow.com/questions/27649759/using-prepared-statements-with-mysql-in-python https://www.npmjs.com/package/mime-types