fix(security): implement file upload security enhancements

- Add path traversal protection with secureStatic middleware
- Implement proper MIME type validation for all file uploads
- Add content-based file validation (magic numbers)
- Create comprehensive fileSecurityUtils for secure file operations
- Update adminPhotos.js with enhanced validation
- Update adminSettings.js for secure logo/favicon uploads
- Addresses file upload vulnerabilities from security scan

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude <noreply@anthropic.com>

backend/src/routes/adminPhotos.js

@@ -56,18 +56,18 @@ const storage = multer.diskStorage({
   }
 });
 
+const { validateFileType } = require('../utils/fileSecurityUtils');
+
 const upload = multer({
   storage: storage,
   limits: {
     fileSize: 50 * 1024 * 1024, // 50MB limit
   },
   fileFilter: (req, file, cb) => {
-    // Accept images only
-    const allowedTypes = /jpeg|jpg|png|webp/;
-    const extname = allowedTypes.test(path.extname(file.originalname).toLowerCase());
-    const mimetype = allowedTypes.test(file.mimetype);
+    // Accept images only with proper validation
+    const allowedMimeTypes = ['image/jpeg', 'image/png', 'image/webp'];
     
-    if (mimetype && extname) {
+    if (validateFileType(file.originalname, file.mimetype, allowedMimeTypes)) {
       return cb(null, true);
     } else {
       cb(new Error('Only JPEG, PNG and WebP images are allowed'));
@@ -75,6 +75,15 @@ const upload = multer({
   }
 });
 
+const { createFileUploadValidator } = require('../utils/fileSecurityUtils');
+
+// Create content validator middleware
+const validateUploadContent = createFileUploadValidator({
+  allowedTypes: ['image/jpeg', 'image/png', 'image/webp'],
+  maxFileSize: 50 * 1024 * 1024,
+  validateContent: true
+});
+
 // Upload photos for an event
 router.post('/:eventId/upload', adminAuth, (req, res, next) => {
   upload.array('photos', 20)(req, res, (err) => {
@@ -90,7 +99,7 @@ router.post('/:eventId/upload', adminAuth, (req, res, next) => {
     }
     next();
   });
-}, async (req, res) => {
+}, validateUploadContent, async (req, res) => {
   try {
     const { eventId } = req.params;
     const { category_id } = req.body;

backend/src/routes/adminSettings.js

@@ -21,18 +21,19 @@ const storage = multer.diskStorage({
   }
 });
 
+const { validateFileType } = require('../utils/fileSecurityUtils');
+
 const upload = multer({
   storage,
   limits: { fileSize: 5 * 1024 * 1024 }, // 5MB
   fileFilter: (req, file, cb) => {
-    const allowedTypes = /jpeg|jpg|png|gif|svg/;
-    const extname = allowedTypes.test(path.extname(file.originalname).toLowerCase());
-    const mimetype = allowedTypes.test(file.mimetype);
+    // Note: SVG files are excluded from magic number validation for logos
+    const allowedMimeTypes = ['image/jpeg', 'image/png', 'image/gif', 'image/svg+xml'];
     
-    if (mimetype && extname) {
+    if (validateFileType(file.originalname, file.mimetype, allowedMimeTypes)) {
       return cb(null, true);
     } else {
-      cb(new Error('Only image files are allowed'));
+      cb(new Error('Only JPEG, PNG, GIF and SVG image files are allowed'));
     }
   }
 });
@@ -54,8 +55,18 @@ const faviconUpload = multer({
   storage: faviconStorage,
   limits: { fileSize: 1 * 1024 * 1024 }, // 1MB
   fileFilter: (req, file, cb) => {
-    const allowedTypes = ['image/png', 'image/x-icon', 'image/vnd.microsoft.icon'];
-    if (allowedTypes.includes(file.mimetype)) {
+    const allowedMimeTypes = ['image/png', 'image/x-icon', 'image/vnd.microsoft.icon'];
+    
+    // For ICO files, we can't use the standard validateFileType
+    if (file.mimetype === 'image/png') {
+      if (validateFileType(file.originalname, file.mimetype, ['image/png'])) {
+        cb(null, true);
+      } else {
+        cb(new Error('Invalid PNG file'));
+      }
+    } else if (allowedMimeTypes.includes(file.mimetype) && 
+               (file.originalname.toLowerCase().endsWith('.ico') || 
+                file.originalname.toLowerCase().endsWith('.png'))) {
       cb(null, true);
     } else {
       cb(new Error('Favicon must be PNG or ICO format'));