fix(chapter-25): validate uploads by file signature

↗ view on GitHub · Amal · 2026-05-24 · b358c585

Chapter: 25 - Upload trust boundary.

Plain-English map:
Check uploaded files by their magic bytes, not only by their filename or
extension.

Why it matters:
A file can be renamed to look harmless. The backend should inspect the actual
file signature before accepting it as a supported document type.

Principle:
Trust content, not labels.

Precedent borrowed:
Upstream PR #78 and standard upload-validation practice.

Upstream base: willchen96/mike@d39f580.
Original local commit: c6dd2ec.
Repository amal66/mike
Author Amal <mamalanand3@gmail.com>
Authored
Parents 761f6129
Stats 4 files changed , +149 , -2
Part of Upload validation by file signature

Capture this commit into my fork

Download a Markdown prompt that tells Claude how to port this exact commit into your working tree. Run it via claude -p < capture-commit-b358c585.md from inside the repo you want the change in.

⬇ Download capture-commit-b358c585.md