Use Magika to determine if a file is corrupted or not #4
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "magika"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Before, we were using
fleepto filter files based on file signatures, however, this has caused many issues. As such, this PR replacesfleepwith Magika.Performance overhead seems to be negligible. Sure it may use a bit more CPU and stuff but not by a lot.
This opens many options to potentially allow more files to be uploaded by guests.
magikaas a dependency 5042af1883fleepb43eeca98a@ -119,0 +118,4 @@file_buffer = io.BytesIO(f.read())file_buffer.seek(0)magika_file = Magika().identify_stream(file_buffer)print(magika_file.output)remove print in prod
Looks good. I would suggest adding a fallback to fleep, but if Magika uses little CPU, it's not worth the effort. I'm curious to know if there are any legitimate reasons for uploading files whose content doesn't match the extension, because this case is currently blocked.
I only reviewed the server code. Someone else should check client JS before merging.
@edward wrote in #4 (comment):
Someone could upload malicious files “disguised” as PNGs.
@ -119,0 +119,4 @@file_buffer.seek(0)magika_file = Magika().identify_stream(file_buffer)print(magika_file.output)if normalized_ext not in magika_file.output.extensions:add
if magika_file.oksomewhere before using the output to handle the failure case@edward wrote in #4 (comment):
All it changes is the fact that now it tells you directly via an
alert()what went wrong. It was supposed to be commited onmasterbut unfortunately I messed up and it got included in this PR 😛Everything seems to be alright all things considered, self-merging.