Subida Segura de Archivos en Node.js y Next.js: Defensas, Ejemplos de Código y Checklist de Auditoría [2026]

// Lado del cliente (Next.js Client Component — conveniencia, no seguridad)
"use client";

export function UploadForm() {
  const ALLOWED_TYPES = [
    "image/jpeg",
    "image/png",
    "image/webp",
    "application/pdf",
    "text/csv",
  ];

  function handleFileSelect(e: React.ChangeEvent<HTMLInputElement>) {
    const file = e.target.files?.[0];
    if (file && !ALLOWED_TYPES.includes(file.type)) {
      alert("Invalid file type");
      e.target.value = "";
    }
  }

  return (
    <input
      type="file"
      accept=".jpg,.jpeg,.png,.webp,.pdf,.csv"
      onChange={handleFileSelect}
    />
  );
}

// app/api/upload/route.ts
import { NextRequest, NextResponse } from "next/server";

const ALLOWED_TYPES = new Set([
  "image/jpeg",
  "image/png",
  "image/webp",
  "application/pdf",
  "text/csv",
]);

const MAX_FILE_SIZE = 10 * 1024 * 1024; // 10 MB

export async function POST(request: NextRequest) {
  const formData = await request.formData();
  const file = formData.get("file") as File | null;

  if (!file) {
    return NextResponse.json({ error: "No file provided" }, { status: 400 });
  }

  // Puerta 1: Validación de Content-Type en el servidor
  if (!ALLOWED_TYPES.has(file.type)) {
    return NextResponse.json(
      { error: `File type '${file.type}' is not allowed` },
      { status: 400 },
    );
  }

  // Puerta 2: Validación del tamaño de archivo
  if (file.size > MAX_FILE_SIZE) {
    const maxMb = MAX_FILE_SIZE / (1024 * 1024);
    return NextResponse.json(
      { error: `File exceeds maximum size of ${maxMb} MB` },
      { status: 413 },
    );
  }

  // Continuar con el procesamiento...
  const buffer = Buffer.from(await file.arrayBuffer());
  // ...
}

const ALLOWED_EXTENSIONS = new Set([
  ".jpg", ".jpeg",
  ".png",
  ".webp",
  ".pdf",
  ".csv",
]);

function validateExtension(filename: string): boolean {
  // Obtener la extensión, en minúsculas, y manejar múltiples puntos de forma segura
  const dotIndex = filename.lastIndexOf(".");
  if (dotIndex === -1) return false;
  const ext = filename.slice(dotIndex).toLowerCase();
  return ALLOWED_EXTENSIONS.has(ext);
}

function sanitizeFilename(filename: string): string {
  // Eliminar separadores de ruta y referencias al directorio padre
  return filename
    .replace(/[/\\]/g, "")      // Eliminar / y \
    .replace(/\.\./g, "")       // Eliminar ..
    .replace(/\0/g, "")         // Eliminar bytes nulos
    .trim();
}

// lib/magic-bytes.ts
const MAGIC_BYTES: Record<string, Uint8Array[]> = {
  "image/jpeg": [new Uint8Array([0xFF, 0xD8, 0xFF])],
  "image/png": [new Uint8Array([0x89, 0x50, 0x4E, 0x47])],
  "image/webp": [new Uint8Array([0x52, 0x49, 0x46, 0x46])], // Cabecera "RIFF"
  "application/pdf": [new Uint8Array([0x25, 0x50, 0x44, 0x46])], // "%PDF"
};

export function validateMagicBytes(
  buffer: Buffer,
  mimeType: string,
): boolean {
  const expectedSignatures = MAGIC_BYTES[mimeType];
  if (!expectedSignatures) return false;

  return expectedSignatures.some((sig) => {
    if (buffer.length < sig.length) return false;
    return sig.every((byte, i) => buffer[i] === byte);
  });
}

// Dentro de la ruta de API
if (!validateMagicBytes(buffer, file.type)) {
  return NextResponse.json(
    { error: "File content does not match claimed type" },
    { status: 400 },
  );
}

// Validación de PDF más estricta: verificar el trailer del PDF
function validatePdfContent(buffer: Buffer): boolean {
  return (
    buffer.slice(0, 4).toString() === "%PDF" &&
    buffer.slice(-7).toString().trim() === "%%EOF"
  );
}

// lib/reencode-image.ts
import sharp from "sharp";

export async function reencodeImage(
  buffer: Buffer,
  format: "jpeg" | "png" | "webp",
): Promise<Buffer> {
  return sharp(buffer)
    .ensureAlpha()              // Normalizar el canal alfa
    .toFormat(format, {
      quality: 85,              // Re-codificar con calidad fija (elimina EXIF)
      mozjpeg: true,            // Mejor compresión
    })
    .toBuffer();
}

# Saneamiento de PDF en el servidor
qpdf --linearize --remove-embedded-files input.pdf output.pdf

# Instalar ClamAV en tu servidor o imagen Docker
apt-get install clamav clamav-daemon
freshclam  # Actualizar definiciones de virus

// lib/clamav.ts
import { spawn } from "child_process";

export async function scanForMalware(
  buffer: Buffer,
): Promise<{ clean: boolean; signature?: string }> {
  return new Promise((resolve, reject) => {
    const clamscan = spawn("clamscan", ["--stdin", "--no-summary"]);
    let output = "";

    clamscan.stdout.on("data", (data) => {
      output += data.toString();
    });

    clamscan.on("close", (code) => {
      // Código de salida 0 = limpio, 1 = infectado
      if (code === 0) resolve({ clean: true });
      else if (code === 1) {
        const match = output.match(/FOUND\s*$|:\s*(.+?)\s+FOUND/);
        resolve({ clean: false, signature: match?.[1] || "Unknown" });
      } else {
        reject(new Error(`clamscan exited with code ${code}`));
      }
    });

    clamscan.stdin.write(buffer);
    clamscan.stdin.end();
  });
}

// lib/storage.ts — almacenamiento compatible con S3 (MinIO, AWS S3, R2)
import { S3Client, PutObjectCommand } from "@aws-sdk/client-s3";
import crypto from "node:crypto";

const s3 = new S3Client({
  region: process.env.S3_REGION!,
  endpoint: process.env.S3_ENDPOINT, // MinIO o endpoint personalizado
  credentials: {
    accessKeyId: process.env.S3_ACCESS_KEY!,
    secretAccessKey: process.env.S3_SECRET_KEY!,
  },
});

export async function storeFile(buffer: Buffer, originalName: string) {
  // Generar un nombre de archivo aleatorio — NUNCA usar el nombre proporcionado por el usuario
  const ext = originalName.slice(originalName.lastIndexOf(".")).toLowerCase();
  const key = `${crypto.randomUUID()}${ext}`;

  await s3.send(
    new PutObjectCommand({
      Bucket: process.env.S3_BUCKET!,
      Key: key,
      Body: buffer,
      ContentType: "application/octet-stream", // Forzar descarga, nunca renderizar
      ContentDisposition: "attachment",         // Evitar que el navegador renderice
    }),
  );

  return { key };
}

import { writeFile, mkdir } from "node:fs/promises";
import path from "node:path";
import crypto from "node:crypto";

const UPLOAD_DIR = path.join(
  process.cwd(),
  "private",    // Fuera de public/ — NO lo sirve Next.js
  "uploads",
);

export async function storeFileOnDisk(buffer: Buffer) {
  const key = crypto.randomUUID();
  const dir = path.join(UPLOAD_DIR, key.slice(0, 2)); // Fragmentar por los 2 primeros caracteres
  const filepath = path.join(dir, key);

  await mkdir(dir, { recursive: true });
  await writeFile(filepath, buffer);

  return { key, filepath };
}

// app/api/files/[key]/route.ts
import { NextRequest, NextResponse } from "next/server";
import { readFile } from "node:fs/promises";
import path from "node:path";

const UPLOAD_DIR = path.join(process.cwd(), "private", "uploads");

export async function GET(
  _request: NextRequest,
  { params }: { params: Promise<{ key: string }> },
) {
  const { key } = await params;

  // Validar el formato de la clave (sin path traversal)
  if (!/^[0-9a-f-]+\.[a-z]+$/.test(key)) {
    return NextResponse.json({ error: "Invalid key" }, { status: 400 });
  }

  const filepath = path.join(UPLOAD_DIR, key.slice(0, 2), key);

  try {
    const buffer = await readFile(filepath);
    return new NextResponse(buffer, {
      headers: {
        "Content-Type": "application/octet-stream",
        "Content-Disposition": "attachment",       // Forzar descarga
        "X-Content-Type-Options": "nosniff",        // Sin MIME sniffing
        "Cache-Control": "private, max-age=31536000, immutable",
      },
    });
  } catch {
    return NextResponse.json({ error: "Not found" }, { status: 404 });
  }
}

// app/api/upload/route.ts
import { NextRequest, NextResponse } from "next/server";
import { validateMagicBytes, reencodeImage, scanForMalware, storeFile } from "@/lib";

const ALLOWED_TYPES = new Set([
  "image/jpeg", "image/png", "image/webp", "application/pdf", "text/csv",
]);
const ALLOWED_EXTENSIONS = new Set([
  ".jpg", ".jpeg", ".png", ".webp", ".pdf", ".csv",
]);
const MAX_FILE_SIZE = 10 * 1024 * 1024; // 10 MB

export async function POST(request: NextRequest) {
  const formData = await request.formData();
  const file = formData.get("file") as File | null;

  if (!file) return NextResponse.json({ error: "No file" }, { status: 400 });

  // Puerta 1: Tamaño
  if (file.size > MAX_FILE_SIZE) {
    return NextResponse.json({ error: "File too large" }, { status: 413 });
  }

  // Puerta 2: Extensión
  const ext = file.name.slice(file.name.lastIndexOf(".")).toLowerCase();
  if (!ALLOWED_EXTENSIONS.has(ext)) {
    return NextResponse.json({ error: "Extension not allowed" }, { status: 400 });
  }

  // Puerta 3: Content-Type (línea base)
  if (!ALLOWED_TYPES.has(file.type)) {
    return NextResponse.json({ error: "Type not allowed" }, { status: 400 });
  }

  const buffer = Buffer.from(await file.arrayBuffer());

  // Puerta 4: Magic bytes
  if (!validateMagicBytes(buffer, file.type)) {
    return NextResponse.json(
      { error: "Content does not match claimed type" },
      { status: 400 },
    );
  }

  // Puerta 5 (para imágenes): Re-codificar para eliminar metadatos
  let finalBuffer = buffer;
  if (file.type.startsWith("image/")) {
    const format = file.type === "image/png" ? "png" : "webp";
    try {
      finalBuffer = await reencodeImage(buffer, format as "jpeg" | "png" | "webp");
    } catch {
      return NextResponse.json({ error: "Invalid image" }, { status: 400 });
    }
  }

  // Puerta 6: Escaneo de malware
  if (process.env.CLAMAV_ENABLED === "true") {
    const result = await scanForMalware(finalBuffer);
    if (!result.clean) {
      return NextResponse.json(
        { error: "File rejected — malware detected", signature: result.signature },
        { status: 422 },
      );
    }
  }

  // Puerta 7: Almacenar de forma segura
  const { key } = await storeFile(finalBuffer, file.name);

  return NextResponse.json({ url: `/api/files/${key}` }, { status: 201 });
}

// app/upload/_actions.ts
"use server";

export async function uploadFile(formData: FormData) {
  const file = formData.get("file") as File;
  // ... mismo pipeline de validación que el anterior
}

// Ejecutar libmagic como segunda opinión
import { file } from "tmp-promise";
import { exec } from "child_process";
import { promisify } from "util";
import { writeFile } from "fs/promises";

const execAsync = promisify(exec);

export async function identifyFileType(buffer: Buffer): Promise<string> {
  const { path } = await file({ postfix: ".tmp" });
  await writeFile(path, buffer);
  const { stdout } = await execAsync(`file --brief --mime-type "${path}"`);
  return stdout.trim();
}

#!/bin/bash
# test-upload-security.sh
# Probar cada vector de ataque contra tu endpoint de subida

URL="${1:-http://localhost:3000/api/upload}"

echo "=== Testing Upload Security ==="

# Test 1: Real file should succeed
echo -n "Test 1 (valid JPEG): "
curl -s -o /dev/null -w "%{http_code}" \
  -F "file=@test-data/valid.jpg" "$URL"
echo

# Test 2: Trojan — rename .exe to .jpg
echo -n "Test 2 (exe masked as jpg): "
echo "MZ" > /tmp/test.exe
curl -s -o /dev/null -w "%{http_code}" \
  -F "file=@/tmp/test.exe;type=image/jpeg" "$URL"
echo

# Test 3: Path traversal in filename
echo -n "Test 3 (path traversal): "
echo "test" > /tmp/payload.txt
curl -s -o /dev/null -w "%{http_code}" \
  -F "file=@/tmp/payload.txt;filename=../../../etc/passwd.txt" "$URL"
echo

# Test 4: SVG with XSS payload
echo -n "Test 4 (XSS in SVG): "
printf '<svg onload="alert(1)">' > /tmp/xss.svg
curl -s -o /dev/null -w "%{http_code}" \
  -F "file=@/tmp/xss.svg" "$URL"
echo

# Test 5: Huge file
echo -n "Test 5 (100MB file): "
dd if=/dev/zero bs=1M count=100 of=/tmp/huge.bin 2>/dev/null
curl -s -o /dev/null -w "%{http_code}" \
  -F "file=@/tmp/huge.bin" "$URL"
echo

# Test 6: Null byte injection
echo -n "Test 6 (null byte): "
echo "test" > /tmp/evil.txt
curl -s -o /dev/null -w "%{http_code}" \
  -F "file=@/tmp/evil.txt;filename=malicious.php%00.jpg" "$URL"
echo

# Test 7: Double extension
echo -n "Test 7 (double extension): "
echo "test" > /tmp/evil.txt
curl -s -o /dev/null -w "%{http_code}" \
  -F "file=@/tmp/evil.txt;filename=readme.txt.js.php.jpg" "$URL"
echo