[Security] No file size or MIME type validation on document upload endpoint

[github-actions]

Description

The POST /documents/analyze endpoint accepts file uploads but does not enforce a maximum file size or validate that uploaded files match their declared content type. This can be exploited to:

• Upload arbitrarily large files, exhausting server memory or disk space.
• Upload malicious files disguised as PDFs or images.

Location

backend/routers/documents.py:

file_bytes = await upload.read()  # no size check before reading entire file

Recommendation

1. Enforce a maximum file size (e.g., 10 MB) before reading the full content:

MAX_FILE_SIZE_BYTES = 10 * 1024 * 1024  # 10 MB
file_bytes = await upload.read(MAX_FILE_SIZE_BYTES + 1)
if len(file_bytes) > MAX_FILE_SIZE_BYTES:
    raise HTTPException(status_code=413, detail="File too large. Maximum size is 10 MB.")

2. Validate the MIME type against an allowlist:

ALLOWED_TYPES = {"application/pdf", "image/jpeg", "image/png"}
if upload.content_type not in ALLOWED_TYPES:
    raise HTTPException(status_code=415, detail=f"Unsupported file type: {upload.content_type}")

Severity

High