Upload checks for Node

Server-side upload checks for Node that read the file, not just its name.

An upload passes only when its extension, its declared MIME type and its bytes agree, and when it carries nothing that runs on its own. Built for apps that take CVs, invoices, contracts and photos from strangers and hand them to colleagues who open them in Office or Acrobat.

npm install upload-safety

import { checkUpload } from 'upload-safety';

const result = checkUpload( { filename, mimeType, bytes }, { maxBytes: 10 * 1024 * 1024 } );
if ( ! result.ok ) {
  // result.reason: 'macros', 'encrypted', 'content-mismatch', ...
}
// Store result.bytes under result.filename with result.mimeType.

Refuses active content

VBA and Excel 4.0 macros, embedded OLE objects, DDE fields, remote templates, PDF JavaScript and attachments, ODF event listeners and CSV formulas.

Strips photo metadata

GPS, camera and XMP data come off JPEG, PNG, WebP, HEIC and AVIF photos. The orientation stays, the pixels are untouched.

Zero dependencies

Only node:zlib and node:crypto. Nothing to audit but this package, and nothing that pulls in more.

Fails closed

A part it cannot read is a refusal, not a pass. Every rejection is one of seven typed reasons.