Sichere Bild-Upload-API mit Node.js, Express und Multer

node -v
npm -v

mkdir image-upload-api
cd image-upload-api
npm init -y

npm install express@4.22.2 multer@2.3.0
npm install express-rate-limit@8 clamscan@2.4.0 cors@2.8.5 helmet@8 morgan@1.12.1
# Note: the 'crypto' module is built-in to Node.js

const express = require('express')
const multer = require('multer')
const path = require('path')
const crypto = require('crypto') // Built-in Node.js module
const fs = require('fs')
const { rateLimit } = require('express-rate-limit')
const NodeClam = require('clamscan')
const cors = require('cors')
const helmet = require('helmet')
const morgan = require('morgan')

const app = express()
const PORT = process.env.PORT || 3000

// --- Security Middleware ---
app.use(helmet()) // Apply security headers
app.use(cors({ origin: 'https://app.example.com' })) // Replace with your frontend origin.
app.use(morgan('dev')) // HTTP request logger (use 'combined' in production)

// Create secure upload directory outside web root if it doesn't exist
// IMPORTANT: Ensure this path is NOT directly accessible via your web server configuration
const uploadDir = path.join(__dirname, '../secure-uploads/')
if (!fs.existsSync(uploadDir)) {
  // Create directory with restricted permissions (owner rwx, group rx, others ---)
  fs.mkdirSync(uploadDir, { recursive: true, mode: 0o750 })
}

// --- Multer Configuration (will be defined below) ---
// --- Rate Limiting (will be defined below) ---
// --- Virus Scanning (will be defined below) ---
// --- API Endpoints (will be defined below) ---
// --- Error Handling (will be defined below) ---

// Configure secure file storage
const storage = multer.diskStorage({
  destination: (req, file, cb) => {
    // Store files in the secure directory created earlier
    cb(null, uploadDir)
  },
  filename: (req, file, cb) => {
    // Generate a secure random filename using crypto to prevent collisions and guessing
    crypto.randomBytes(16, (err, buf) => {
      if (err) {
        return cb(err)
      }
      const uniqueSuffix = buf.toString('hex')
      // Preserve the original file extension, converting it to lowercase
      const extension = path.extname(file.originalname).toLowerCase()
      cb(null, uniqueSuffix + extension)
    })
  },
})

// Define allowed file types (MIME types and extensions)
const allowedMimeTypes = ['image/jpeg', 'image/png', 'image/gif']
const allowedExtensions = /\.(jpg|jpeg|png|gif)$/i // Case-insensitive check

const fileFilter = (req, file, cb) => {
  // Validate MIME type
  const mimeTypeValid = allowedMimeTypes.includes(file.mimetype)
  // Validate file extension
  const extValid = allowedExtensions.test(path.extname(file.originalname).toLowerCase())

  if (mimeTypeValid && extValid) {
    // Accept the file
    cb(null, true)
  } else {
    // Reject the file with a specific error message
    cb(new Error('Invalid file type. Only JPEG, PNG, and GIF images are allowed.'), false)
  }
}

// Configure multer with security settings
const upload = multer({
  storage: storage,
  limits: {
    fileSize: 5 * 1024 * 1024, // 5MB limit per file (adjust as needed)
    files: 1,
    fields: 0,
  },
  fileFilter: fileFilter,
})

// Create a rate limiter for upload endpoints
const uploadLimiter = rateLimit({
  windowMs: 15 * 60 * 1000, // 15 minutes
  max: 10, // Limit each IP to 10 uploads per windowMs (adjust as needed)
  message: {
    error: 'Too many upload attempts from this IP, please try again after 15 minutes.',
  },
  standardHeaders: true, // Return rate limit info in the `RateLimit-*` headers
  legacyHeaders: false, // Disable the `X-RateLimit-*` headers
})

// Initialize ClamAV scanner (adjust paths/sockets if necessary)
let clamscanInstance
const initializeClamScan = async () => {
  try {
    clamscanInstance = await new NodeClam().init({
      removeInfected: true, // Automatically remove infected files
      quarantineInfected: false, // Don't quarantine, just remove
      scanLog: null, // Set to a file path for logging
      debugMode: false,
      clamscan: {
        path: '/usr/bin/clamscan', // Adjust for your system
        db: null,
        scanRecursively: false,
      },
      clamdscan: {
        socket: '/var/run/clamav/clamd.ctl', // Common socket path, adjust if needed
        host: '127.0.0.1',
        port: 3310,
        timeout: 60000,
        localFallback: true, // Use clamscan if clamdscan fails
        path: '/usr/bin/clamdscan', // Adjust for your system
        bypassTest: false,
      },
      preference: 'clamdscan', // Prefer clamdscan if available
    })
    console.log('ClamAV scanner initialized successfully.')
  } catch (err) {
    clamscanInstance = null
    throw new Error('Unable to initialize the virus scanner', { cause: err })
  }
}

// Middleware for virus scanning after upload, before final response
const virusScanMiddleware = async (req, res, next) => {
  if (!clamscanInstance) {
    return next(Object.assign(new Error('Scanner unavailable'), { status: 503 }))
  }
  if (!req.file) {
    // No file uploaded, proceed
    return next()
  }

  try {
    console.log(`Scanning file: ${req.file.path}`)
    const { isInfected } = await clamscanInstance.scanFile(req.file.path)

    if (isInfected === true) {
      return next(Object.assign(new Error('Upload rejected'), { status: 400 }))
    }
    if (isInfected !== false) {
      return next(Object.assign(new Error('Inconclusive scan'), { status: 503 }))
    }

    console.log(`File clean: ${req.file.path}`)
    // File is clean, proceed to the next middleware/handler
    next()
  } catch (error) {
    next(Object.assign(new Error('Virus scanning failed', { cause: error }), { status: 503 }))
  }
}

// Define the POST endpoint for image uploads
app.post(
  '/upload',
  uploadLimiter,
  (req, res, next) => {
    // Use multer's single file upload middleware
    upload.single('image')(req, res, (err) => {
      // Handle Multer-specific errors first
      if (err instanceof multer.MulterError) {
        console.warn('Multer error:', err.code)
        switch (err.code) {
          case 'LIMIT_FILE_SIZE':
            return res.status(413).json({ error: 'File too large. Maximum size is 5MB.' })
          case 'LIMIT_UNEXPECTED_FILE':
            return res
              .status(400)
              .json({ error: 'Unexpected field name. Use "image" for the file field.' })
          // Add other Multer error codes if needed (e.g., 'LIMIT_FILE_COUNT')
          default:
            return res.status(400).json({ error: 'Upload rejected.' })
        }
      } else if (err) {
        // Handle file filter errors or other unexpected errors during Multer processing
        console.error('Upload processing failed')
        // Check if it's our custom file type error
        if (err.message.startsWith('Invalid file type')) {
          return res.status(400).json({ error: err.message })
        }
        // Pass other errors to the global handler
        return next(err)
      }

      // Check if a file was actually uploaded after Multer processing
      if (!req.file) {
        return res.status(400).json({
          error:
            'No file uploaded or file rejected by filter. Please include a valid image file named "image".',
        })
      }

      // If upload is successful up to this point, proceed to the next middleware (virus scanning)
      next()
    })
  },
  virusScanMiddleware,
  (req, res) => {
    // This final handler runs only if upload succeeded and virus scan passed
    console.log(`Successfully processed file: ${req.file.filename}`)
    res.status(201).json({
      message: 'File uploaded and scanned successfully.',
      file: {
        filename: req.file.filename, // The secure, randomized filename
        originalname: req.file.originalname, // Original filename (for reference)
        size: req.file.size,
        mimetype: req.file.mimetype,
        // Optionally, construct a URL to access the file if serving locally
        // url: `/images/${req.file.filename}` // See secure serving endpoint below
      },
    })
  },
)

// Endpoint to securely serve uploaded images stored locally
app.get('/images/:filename', (req, res, next) => {
  const { filename } = req.params

  // Validate the filename format strictly (hexadecimal characters + allowed extension)
  // This prevents path traversal (e.g., trying to access ../../etc/passwd)
  if (!/^[a-f0-9]{32}\.(jpg|jpeg|png|gif)$/i.test(filename)) {
    return res.status(400).send('Invalid filename format.')
  }

  // Construct the full path securely using path.join
  const filePath = path.join(uploadDir, filename)

  // Check if the file exists *within the secure directory* and is readable
  fs.access(filePath, fs.constants.R_OK, (err) => {
    if (err) {
      // Log the error for debugging, but send a generic 404 to the client
      // Avoid revealing specific file system errors
      console.error(
        `File access error for ${filename}:`,
        err.code === 'ENOENT' ? 'Not Found' : err.code,
      )
      return res.status(404).send('File not found.')
    }

    res.attachment(filename)
    res.set('X-Content-Type-Options', 'nosniff')

    // Stream the file to the client for efficiency
    const fileStream = fs.createReadStream(filePath)
    fileStream.on('error', (streamErr) => {
      console.error('File streaming failed')
      // Pass to global error handler if streaming fails
      next(new Error('Error serving file.', { cause: streamErr }))
    })
    fileStream.pipe(res)
  })
})

npm install @aws-sdk/client-s3@^3.500.0 # Use a recent v3 SDK version

// Example using AWS S3 SDK v3
const { S3Client, PutObjectCommand } = require('@aws-sdk/client-s3')

// Configure S3 client (best practice: use IAM roles or environment variables for credentials)
const s3Client = new S3Client({
  region: process.env.AWS_REGION, // e.g., 'us-east-1'
  // Credentials will be automatically sourced from env vars, shared config, or IAM role
})

// Use Multer memory storage when uploading directly to cloud to avoid temp files
const memoryStorage = multer.memoryStorage()
const uploadToMemory = multer({
  storage: memoryStorage,
  limits: { fileSize: 5 * 1024 * 1024, files: 1, fields: 0 }, // 5MB limit
  fileFilter: fileFilter, // Reuse the same file filter
})

// Endpoint for uploading directly to S3
// This variant scans the memory buffer before sending it to a private S3 bucket.
app.post('/upload-s3', uploadLimiter, uploadToMemory.single('image'), async (req, res, next) => {
  if (!req.file) {
    return res.status(400).json({ error: 'No file uploaded or file rejected by filter.' })
  }

  try {
    if (!clamscanInstance) throw new Error('Scanner unavailable')
    const { Readable } = require('node:stream')
    const { isInfected } = await clamscanInstance.scanStream(Readable.from([req.file.buffer]))
    if (isInfected !== false) {
      return res.status(isInfected === true ? 400 : 503).json({ error: 'Upload rejected.' })
    }
  } catch (error) {
    return next(Object.assign(new Error('Virus scanning failed', { cause: error }), { status: 503 }))
  }

  // Generate a unique filename for S3
  const uniqueFilename = `${crypto.randomBytes(16).toString('hex')}${path.extname(req.file.originalname).toLowerCase()}`
  const s3Key = `uploads/${uniqueFilename}` // Store in an 'uploads/' prefix (folder)

  const params = {
    Bucket: process.env.S3_BUCKET_NAME, // Ensure this env var is set
    Key: s3Key,
    Body: req.file.buffer, // Use the buffer from memoryStorage
    ContentType: req.file.mimetype, // Set the correct content type for S3
    // Consider setting Cache-Control, ACL (or use bucket policy), etc.
    // CacheControl: 'max-age=31536000', // Example: cache for 1 year
  }

  try {
    const command = new PutObjectCommand(params)
    const data = await s3Client.send(command)
    console.log(`Successfully uploaded to S3: ${s3Key}, ETag: ${data.ETag}`)

    res.status(201).json({
      message: 'File uploaded to S3 successfully.',
      file: {
        filename: uniqueFilename,
        originalname: req.file.originalname,
        size: req.file.size,
        mimetype: req.file.mimetype,
        key: s3Key, // Authorize downloads separately; do not make the bucket public.
      },
    })
  } catch (error) {
    next(new Error('Failed to upload file to S3', { cause: error }))
  }
})

// Global error handler - must be defined LAST, after all other app.use() and routes
app.use(async (err, req, res, next) => {
  if (res.headersSent) return next(err)
  if (req.file?.path) {
    try {
      // Idempotent cleanup also covers scanners that already removed an infected file.
      await fs.promises.rm(req.file.path, { force: true })
    } catch {
      console.error('Unable to remove a rejected upload')
    }
  }

  const statusCode = err instanceof multer.MulterError
    ? (err.code === 'LIMIT_FILE_SIZE' ? 413 : 400)
    : ([400, 413, 503].includes(err.status) ? err.status : 500)
  console.error('Image upload request failed', { statusCode })
  res.status(statusCode).json({ error: 'Unable to process this file.' })
})

initializeClamScan().then(() => {
  app.listen(PORT, () => console.log(`Server running on port ${PORT}`))
}).catch(() => {
  console.error('Virus scanner initialization failed; server was not started')
  process.exitCode = 1
})

# Test successful local upload (replace 'path/to/your/image.jpg' with an actual image file)
curl -X POST -F "image=@path/to/your/image.jpg" http://localhost:3000/upload

# Test file too large (using a large file)
curl -X POST -F "image=@path/to/large_image.png" http://localhost:3000/upload

# Test invalid file type (e.g., a text file)
curl -X POST -F "image=@path/to/document.txt" http://localhost:3000/upload

# Test S3 endpoint (if configured and env vars are set)
# curl --fail-with-body -F "image=@path/to/your/image.png" http://localhost:3000/upload-s3