AddFileTypeValidator doesn't work correctly

[NirZamirGuardz]

Is there an existing issue for this?

• I have searched the existing issues

Current behavior

We had this in production for a while, and it worked well until a few hours ago
.addFileTypeValidator({ fileType: /jpeg|png/, })

We are getting the following error:
"Validation failed (current file type is image/png, expected type is /jpeg|png/)"

Then we tried setting the meme type explicitly with a string instead of a regex
.addFileTypeValidator({ fileType: 'image/png', })
And got the following error:
"Validation failed (current file type is image/png, expected type is image/png)"

And at last, we tried the same as in the example in the docs
new ParseFilePipeBuilder() .addFileTypeValidator({ fileType: 'png', })
"Validation failed (current file type is image/png, expected type is png)"

Minimum reproduction code

empty

Steps to reproduce

1. npm ci
2. npm run start: dev / starting command
   We haven't done anything special, and we noticed it when several tests failed and blocked the pipe.

Expected behavior

To work correctly as it worked in the past
In the past, the following worked
.addFileTypeValidator({ fileType: /jpeg|png/, })

Package

• I don't know. Or some 3rd-party package
• @nestjs/common
• @nestjs/core
• @nestjs/microservices
• @nestjs/platform-express
• @nestjs/platform-fastify
• @nestjs/platform-socket.io
• @nestjs/platform-ws
• @nestjs/testing
• @nestjs/websockets
• Other (see below)

Other package

No response

NestJS version

10.4.16

Packages versions

[System Information]
OS Version : macOS 24.3.0
NodeJS Version : v22.14.0
NPM Version : 10.9.2

[Nest CLI]
Nest CLI Version : 10.4.9

[Nest Platform Information]
platform-express version : 10.4.16
elasticsearch version : 10.0.2
schematics version : 10.2.3
passport version : 10.0.3
schedule version : 4.1.2
terminus version : 10.3.0
swagger version : 7.4.2
testing version : 10.4.16
bullmq version : 10.2.3
common version : 10.4.16
config version : 3.3.0
axios version : 3.1.3
core version : 10.4.16
jwt version : 10.2.0
cli version : 10.4.9

Node.js version

v22.14.0

In which operating systems have you tested?

• macOS
• Windows
• Linux

Other

No response

[tizianozonta]

I think the problem is related to this issue #14881
@Chathula may be possible?

[Chathula]

I think the problem is related to this issue #14881
@Chathula may be possible?

I think yes. I will check the implementation and i will cover these cases in test as well.

[tizianozonta]

I think the problem is related to this issue #14881
@Chathula may be possible?

I think yes. I will check the implementation and i will cover these cases in test as well.

thank you very much!

[mariusrubei]

@Chathula I think an unintended breaking change was added when you made isValid as async.

I used to do custom validators using FileTypeValidator

import { FileTypeValidator } from '@nestjs/common';

...
const validator = new FileTypeValidator({ fileType: expectedMimeType });
if(!validator.isValid(file))
....

Now since the method is async, it will break a lot of custom validators.

[Chathula]

@Chathula I think an unintended breaking change was added when you made isValid as async.

I used to do custom validators using FileTypeValidator

import { FileTypeValidator } from '@nestjs/common';

...
const validator = new FileTypeValidator({ fileType: expectedMimeType });
if(!validator.isValid(file))
....

Now since the method is async, it will break a lot of custom validators.

I will consider this as well

[francescosalvi]

Just wondering, how come this (kinda serious) breaking change wasn't intercepted by CI/tests ?
I was upgrading due to npm audit reporting the following, not thinking much of 1/2 patch revision changes, thank god the project had integration tests covering FileTypeValidator usage cases...

 @nestjs/common
   ├─ ID: 1103892
   ├─ Issue: nest allows a remote attacker to execute arbitrary code via the Content-Type header
   ├─ URL: https://github.com/advisories/GHSA-cj7v-w2c7-cp7c
   ├─ Severity: moderate
   ├─ Vulnerable Versions: <11.0.16
   │ 
   ├─ Tree Versions
   │  └─ 11.0.15

[phlogisticfugu]

we just updated as well - and are getting similar issues where a previously working file upload is now failing.

suspect that it may be because the file-type package is now being used, but when the import of it fails (silently) - the validation returns false
https://github.com/nestjs/nest/blob/master/packages/common/pipes/file/file-type.validator.ts#L52-L64

propose: adding file-type as a dependency

or
being more noisy about a failed import

[Chathula]

One of the dependencies in the file-type package has an issue detecting a PNG file buffer and throws an error. I have already created tickets on that.

strtok3: Borewit/strtok3#1224
file-type: sindresorhus/file-type#745

[Chathula]

@Chathula I think an unintended breaking change was added when you made isValid as async.
I used to do custom validators using FileTypeValidator

import { FileTypeValidator } from '@nestjs/common';

...
const validator = new FileTypeValidator({ fileType: expectedMimeType });
if(!validator.isValid(file))
....

Now since the method is async, it will break a lot of custom validators.

I will consider this as well

Making this function synchronous will not be easy as we are using the file-type package with dynamic import through eval.

Then we have to use a package like this, or we have to implement our own helper to detect the file type based on the buffer. I used this package earlier https://github.com/nir11/file-type-checker. But @kamilmysliwiec mentioned that it doesn't have enough popularity to use it.

[Chathula]

For now, you can use below skipMagicNumbersValidation parameter to skip the magic numbers validation. This will use old validation(which is vulnerble according to the Github advisory). This has been added as we can't detect text-based formats(files like txt, json etc) through magic numbers. So we have to detect the MIME type the way we used to.

const fileTypeValidator = new FileTypeValidator({
    fileType: 'image/jpeg',
    skipMagicNumbersValidation: true,
});

[phlogisticfugu]

mmmm thats unfortunate that PNG's dont work - its one of our primary use-cases (to allow image uploads, but not malicious files)

we'd be willing to use file-type-checker https://snyk.io/advisor/npm-package/file-type-checker if it will result in a better file check

[Borewit]

Making this function synchronous will not be easy as we are using the file-type package with dynamic import through eval.

I assume you try to load the file-type, which is an ESM module, in a TypeScript CommonJS project. Then you run into the issue, the TypeScript compiler converts the dynamic import, which you need to load the ESM module, to require. Does not make much sense, but that is what the compiler does.

Better to use load-esm to load the ESM module, rather then eval.

More detailed explenation: https://stackoverflow.com/a/79265806/28701779

One of the dependencies in the file-type package has an issue detecting a PNG file buffer and throws an error. I have already created tickets on that.

PNG detection certainly works in file-type, but you need to provide a bigger sample (not the first 8 bytes). For the best results, better to provide the actual file.