feat(server): detect content-type server-side

server/src/immich/api-v1/asset/asset.controller.ts

@@ -10,6 +10,7 @@ import {
   HttpStatus,
   Param,
   ParseFilePipe,
+  ParseFilePipeBuilder,
   Post,
   Put,
   Query,
@@ -89,7 +90,13 @@ export class AssetController {
   })
   async uploadFile(
     @AuthUser() authUser: AuthUserDto,
-    @UploadedFiles(new ParseFilePipe({ validators: [new FileNotEmptyValidator(['assetData'])] })) files: UploadFiles,
+    @UploadedFiles(
+      new ParseFilePipeBuilder()
+        .addValidator(new FileExtensionValidator())
+        .addValidator(new FileNotEmptyValidator(['assetData']))
+        .build(),
+    )
+    files: UploadFiles,
     @Body(new ValidationPipe()) dto: CreateAssetDto,
     @Response({ passthrough: true }) res: Res,
   ): Promise<AssetFileUploadResponseDto> {

server/src/immich/api-v1/validation/file-extension-validator.ts

@@ -0,0 +1,21 @@
+import { FileValidator, Injectable } from '@nestjs/common';
+
+@Injectable()
+export default class FileExtensionValidator extends FileValidator {
+  constructor(public allowedExtensions: string[]) {
+    super({});
+  }
+
+  isValid(files?: any): boolean {
+    for (const file of files) {
+      if (!this.allowedExtensions.includes(file.extension)) {
+        return false;
+      }
+    }
+    return true;
+  }
+
+  buildErrorMessage(): string {
+    return `File has invalid extension, must be one of: ${this.allowedExtensions.join(', ')}`;
+  }
+}