com/modules/upload/filetype.go

// Copyright 2019 The Gitea Authors. All rights reserved.
// Use of this source code is governed by a MIT-style
// license that can be found in the LICENSE file.

package upload

import (
	"fmt"
	"net/http"
	"strings"

	"code.gitea.io/gitea/modules/log"
)

// ErrFileTypeForbidden not allowed file type error
type ErrFileTypeForbidden struct {
	Type string
}

// IsErrFileTypeForbidden checks if an error is a ErrFileTypeForbidden.
func IsErrFileTypeForbidden(err error) bool {
	_, ok := err.(ErrFileTypeForbidden)
	return ok
}

func (err ErrFileTypeForbidden) Error() string {
	return fmt.Sprintf("File type is not allowed: %s", err.Type)
}

// VerifyAllowedContentType validates a file is allowed to be uploaded.
func VerifyAllowedContentType(buf []byte, allowedTypes []string) error {
	fileType := http.DetectContentType(buf)

	for _, t := range allowedTypes {
		t := strings.Trim(t, " ")

		if t == "*/*" || t == fileType ||
			// Allow directives after type, like 'text/plain; charset=utf-8'
			strings.HasPrefix(fileType, t+";") {
			return nil
		}
	}

	log.Info("Attachment with type %s blocked from upload", fileType)
	return ErrFileTypeForbidden{Type: fileType}
}