流星安全CollectionFS

Question

I have a question. I declare a collection on both side, client and server like this:

Images = new FS.Collection("images", {
  stores: [imageStoreMongo],
  filter: {
  maxSize: 1048576, //in bytes
  allow: {
    contentTypes: ['image/*'],
    extensions: ['png', 'jpg', 'jpeg', 'gif', 'svg']
  },
  onInvalid: function (message) {
    if (Meteor.isClient) {
      alert("Only png, jpg, gif or svg");
    } else {
     console.log(message);
  }
 }
}
});

The question is: does the client would be able to pass by the size file and type restriction or not? It's a bit confusing since the code is shared by client and server.

The additional question would be more CollectionFS specific about if I change the mine type and the extension of a malware to make look like an image?

Answer 1

I haven't used CollectionFS, but a general security principle is to never trust the client. Validation on the client helps with usability, but you'll always want to validate on the server as well.

As for uploading malware with an image extension, that's more of a question for Security.SE:

• Can web applications do anything to prevent client-side malware

• Analyzing images to detect embedded scripts (TL;DR - process the image to prevent any exploits)

• Executing scripts in image files