latest

backend/app/Services/FileUploadValidator.php

@@ -0,0 +1,40 @@
+<?php
+
+namespace App\Services;
+
+use Illuminate\Http\UploadedFile;
+use Illuminate\Support\Str;
+
+/**
+ * Scaffolded ahead of any actual upload feature (e.g. avatars) so hardening
+ * isn't an afterthought bolted on later. Not wired to a route yet.
+ */
+class FileUploadValidator
+{
+    private const ALLOWED_MIME_TYPES = [
+        'image/jpeg',
+        'image/png',
+        'image/webp',
+    ];
+
+    private const MAX_BYTES = 5 * 1024 * 1024; // 5MB
+
+    public function validate(UploadedFile $file): bool
+    {
+        if ($file->getSize() > self::MAX_BYTES) {
+            return false;
+        }
+
+        // Sniff actual content type rather than trusting the client-supplied
+        // extension or Content-Type header.
+        return in_array($file->getMimeType(), self::ALLOWED_MIME_TYPES, true);
+    }
+
+    /**
+     * A randomized filename that never trusts the client-supplied name.
+     */
+    public function randomizedFilename(UploadedFile $file): string
+    {
+        return Str::uuid().'.'.$file->extension();
+    }
+}