[SECURITY][FLEET UPLOADS] Verify file signatures and reject image bombs

[Obiajulu-gif]

Summary

Vehicle uploads trust the caller-provided Content-Type and do not run the KYC file signature checks. A file labeled as an image can contain another format or pathological dimensions.

Repository evidence

• app/api/upload/route.ts:71-85 checks the MIME header and byte length for both scopes.
• Only the KYC branch calls validateKycFile at app/api/upload/route.ts:89-105; the vehicle branch writes bytes directly at :180-185.

Scope

• Decode and validate approved image formats by magic bytes and bounded dimensions/pixels.
• Normalize images or reject malformed, polyglot, truncated, and decompression-bomb inputs.

Acceptance criteria

• Header-only MIME spoofing cannot pass.
• Validation limits are shared, documented, and enforced before storage.

Tests

• Use mismatched headers, polyglots, oversized dimensions, truncated files, and valid JPEG/PNG/WebP fixtures.

Non-goals

• Adding new accepted image formats.

[vjuliaife]

I have experience with JavaScript/TypeScript and file-upload security. I’ll validate vehicle images by magic bytes and bounded dimensions, reject malformed and decompression-bomb files before storage, and add tests for spoofed, polyglot, truncated, and valid images.

[grantfox-oss]

🦊 GrantFox — @vjuliaife has been assigned to this issue as part of the Third Campaign campaign!

Next steps:

1. Open a Pull Request referencing this issue (e.g., Closes #190)
2. Your PR will be reviewed by the Chainmove maintainers

Good luck! Track your progress on GrantFox.