janeczku / calibre-web

:books: Web app for browsing, reading and downloading eBooks stored in a Calibre database
GNU General Public License v3.0
11.99k stars 1.28k forks source link

Add python-magic for validating mimetypes #3061

Closed yunimoo closed 2 days ago

yunimoo commented 1 month ago

Potential solution for https://github.com/janeczku/calibre-web/issues/3044

This PR adds in mimetype checking to ensure that files being uploaded are not maliciously disguised.

Create a bash script:

# test.sh
#!/bin/bash
echo "Hello World!"

Rename the bash script: (Ensure that server allows epub)

mv test.sh test.epub

Upload the file to confirm that it is not possible as the mimetype is read differently.

Screen Shot 2024-05-31 at 5 52 26 PM Screen Shot 2024-05-31 at 5 58 14 PM Screen Shot 2024-05-31 at 5 53 42 PM