Merge pull request #141 from prgrms-aibe-devcourse/feat/auth

feat: 악의적 파일 업로드 방지 구현

Author: lSNOTNULL

build.gradle

@@ -75,6 +75,9 @@ dependencies {
     // WebClient
     implementation 'com.fasterxml.jackson.core:jackson-databind'
 
+    // https://mvnrepository.com/artifact/org.apache.tika/tika-core
+    implementation 'org.apache.tika:tika-core:3.2.0' // 파일 형식 감지
+
     runtimeOnly 'io.micrometer:micrometer-registry-prometheus'
 }
 

src/main/java/store/lastdance/service/common/FileValidationService.java

@@ -0,0 +1,8 @@
+package store.lastdance.service.common;
+
+import org.springframework.web.multipart.MultipartFile;
+
+public interface FileValidationService {
+    public void validateImageFile(MultipartFile file);
+
+}

src/main/java/store/lastdance/service/common/FileValidationServiceImpl.java

@@ -0,0 +1,43 @@
+package store.lastdance.service.common;
+
+import lombok.extern.slf4j.Slf4j;
+import org.apache.tika.Tika;
+import org.springframework.stereotype.Service;
+import store.lastdance.exception.CustomException;
+import store.lastdance.exception.ErrorCode;
+
+import java.io.IOException;
+import java.io.InputStream;
+import java.util.List;
+
+@Service
+@Slf4j
+public class FileValidationServiceImpl implements FileValidationService{
+        private static final Tika tika = new Tika();
+        private static final List<String> ALLOWED_FILE_TYPES = List.of(
+                "image/jpeg",
+                "image/png",
+                "image/jpg",
+                "image/gif",
+                "image/webp"
+        );
+    @Override
+    public void validateImageFile(org.springframework.web.multipart.MultipartFile file) {
+        if(file == null || file.isEmpty()) {
+            return;
+        }
+
+        try (InputStream inputStream = file.getInputStream()) {
+            String mimeType = tika.detect(inputStream);
+            log.info("Detected MIME type: {} for file: {}", mimeType, file.getOriginalFilename());
+
+            if(!ALLOWED_FILE_TYPES.contains(mimeType)) {
+                log.warn("Attempt to upload an invalid file type. Detected: {}, Filename: {}", mimeType, file.getOriginalFilename());
+                throw new CustomException(ErrorCode.INVALID_FILE_TYPE);
+            }
+        } catch (IOException e) {
+            log.error("File validation failed for file: {}", file.getOriginalFilename(), e);
+            throw new CustomException(ErrorCode.FILE_UPLOAD_FAILED);
+        }
+    }
+}

src/main/java/store/lastdance/service/image/ImageServiceImpl.java

@@ -14,6 +14,7 @@
 import store.lastdance.exception.CustomException;
 import store.lastdance.exception.ErrorCode;
 import store.lastdance.repository.common.ImageFileRepository;
+import store.lastdance.service.common.FileValidationService;
 
 import java.time.Duration;
 import java.util.UUID;
@@ -26,6 +27,7 @@ public class ImageServiceImpl implements ImageService {
     private final ImageFileRepository imageFileRepository;
     private final S3Operations s3Operations;
     private final S3Presigner s3Presigner;
+    private final FileValidationService fileValidationService;
 
     @Value("${spring.cloud.aws.s3.bucket}")
     private String bucketName;
@@ -117,21 +119,23 @@ private void validateImageFile(MultipartFile file, int maxSize) {
             throw new CustomException(ErrorCode.FILE_SIZE_EXCEEDED);
         }
 
-        String contentType = file.getContentType();
-        if (contentType == null || !contentType.startsWith("image/")) {
-            throw new CustomException(ErrorCode.INVALID_FILE_TYPE);
-        }
-
-        String filename = file.getOriginalFilename();
-        if (filename == null || !isAllowedExtensions(filename)) {
-            throw new CustomException(ErrorCode.INVALID_FILE_EXTENSION);
-        }
-    }
-
-    private boolean isAllowedExtensions(String filename) {
-        String extension = getFileExtension(filename).toLowerCase();
-        return extension.equals(".jpg") || extension.equals(".jpeg") ||
-                extension.equals(".png") || extension.equals(".gif");
+        fileValidationService.validateImageFile(file);
+
+//        String contentType = file.getContentType();
+//        if (contentType == null || !contentType.startsWith("image/")) {
+//            throw new CustomException(ErrorCode.INVALID_FILE_TYPE);
+//        }
+//
+//        String filename = file.getOriginalFilename();
+//        if (filename == null || !isAllowedExtensions(filename)) {
+//            throw new CustomException(ErrorCode.INVALID_FILE_EXTENSION);
+//        }
+//    }
+//
+//    private boolean isAllowedExtensions(String filename) {
+//        String extension = getFileExtension(filename).toLowerCase();
+//        return extension.equals(".jpg") || extension.equals(".jpeg") ||
+//                extension.equals(".png") || extension.equals(".gif");
     }
 
 }