06/01 App enhanced

2026-06-01 20:34:21 -04:00
parent ea79ae5fdb
commit 5bdeb7b13a
5 changed files with 114 additions and 38 deletions
@@ -261,9 +261,15 @@ def ocr_receipt():
    if size > 10 * 1024 * 1024:
        return jsonify({'error': 'File too large (max 10MB)'}), 400

-    mime_map = {'.jpg': 'image/jpeg', '.jpeg': 'image/jpeg',
-                '.png': 'image/png', '.gif': 'image/gif', '.webp': 'image/webp'}
-    mime_type = mime_map.get(ext, 'image/jpeg')
+    # Validate actual file content via magic bytes
+    from app.routes.settings import _check_magic
+    header = f.read(12)
+    f.seek(0)
+    magic_ext, magic_mime = _check_magic(header)
+    if magic_ext is None or magic_ext not in ('jpg', 'jpeg', 'png', 'gif', 'webp'):
+        return jsonify({'error': 'File content does not match an allowed image type'}), 400
+
+    mime_type = magic_mime
    image_bytes = f.read()

    result = extract_from_bytes(image_bytes, mime_type)