VBC-939: unrestricted-file-upload

error

Category: security
Analysis: Regex (line by line)
File types: .js, .ts, .tsx, .astro
Scope: source code only, ignoring anything inside strings and comments
Tags: security ai-error

What it reports

File upload handler at line {line} may lack type/size restrictions. Without validating MIME type, file extension, and size, attackers can upload malicious executables or exhaust disk space. Add allowlist-based extension validation and a strict size limit before processing any uploaded file.

Flagged

const upload = multer({ dest: "uploads/" });

Not flagged

const upload = multer(storageConfig);

Pattern

(multer|formidable|busboy|diskStorage)\s*\(\s*\{[^}]*\}|req\.files?\s*\[\s*['"][^'"]+['"]\s*\]\s*\.(?:mv|pipe|save)\s*\(