رفع الملفات وحدود الحجم: multer من غير ثغرات

import express from "express";
import multer from "multer";

const app = express();

// ❌ من غير أي حدود، وباسم الملف اللي المستخدم بعته
const upload = multer({
  storage: multer.diskStorage({
    destination: "uploads",
    filename: (req, file, cb) => cb(null, file.originalname),
  }),
});

app.post("/avatar", upload.single("avatar"), (req, res) => {
  res.json({ saved: req.file.path, size: req.file.size, type: req.file.mimetype });
});

app.listen(3000, () => console.log("http://localhost:3000"));

$ node server.js
http://localhost:3000

→ POST /avatar
  (form: avatar=../server.js)
← 200 OK
{
  "saved": "uploads/server.js",
  "size": 28,
  "type": "image/png"
}

import express from "express";
import multer from "multer";
import crypto from "node:crypto";
import path from "node:path";
import fs from "node:fs";

const app = express();
fs.mkdirSync("storage/uploads", { recursive: true });

const upload = multer({
  storage: multer.diskStorage({
    destination: "storage/uploads", // برة أي folder عام
    filename: (req, file, cb) => cb(null, crypto.randomUUID()),
  }),
  limits: {
    fileSize: 1024 * 1024, // 1MB
    files: 1,
    fields: 5,
  },
  fileFilter: (req, file, cb) => {
    const ok = ["image/png", "image/jpeg"].includes(file.mimetype);
    cb(ok ? null : Object.assign(new Error("نوع مش مسموح"), { status: 415 }), ok);
  },
});

app.post("/avatar", upload.single("avatar"), (req, res) => {
  if (!req.file) return res.status(400).json({ error: "مفيش ملف" });
  res.status(201).json({ id: req.file.filename, size: req.file.size });
});

app.use((err, req, res, next) => {
  if (err instanceof multer.MulterError) {
    const status = err.code === "LIMIT_FILE_SIZE" ? 413 : 400;
    return res.status(status).json({ error: err.code });
  }
  res.status(err.status ?? 500).json({ error: err.message });
});

app.listen(3000, () => console.log("http://localhost:3000"));

$ node server.js
http://localhost:3000

→ POST /avatar
  (form: avatar=me.png)
← 201 Created
{
  "id": "4d780bba-ae7f-45f1-a425-bf83d8f9319c",
  "size": 208
}

→ POST /avatar
  (form: avatar=cv.pdf)
← 415 Unsupported Media Type
{
  "error": "نوع مش مسموح"
}

→ POST /avatar
  (form: avatar=big.png)
← 413 Payload Too Large
{
  "error": "LIMIT_FILE_SIZE"
}

→ POST /avatar
  (form: name)
← 400 Bad Request
{
  "error": "مفيش ملف"
}

import express from "express";
import multer from "multer";
import crypto from "node:crypto";
import fs from "node:fs/promises";
import path from "node:path";

const app = express();
const DIR = "storage/avatars";
await fs.mkdir(DIR, { recursive: true });


const upload = multer({
  storage: multer.memoryStorage(),
  limits: { fileSize: 200 * 1024, files: 1 },
});

function sniff(buf) {
  if (buf.subarray(0, 4).equals(Buffer.from([0x89, 0x50, 0x4e, 0x47]))) return "png";
  if (buf.subarray(0, 3).equals(Buffer.from([0xff, 0xd8, 0xff]))) return "jpg";
  return null;
}

app.post("/avatar", upload.single("avatar"), async (req, res) => {
  if (!req.file) return res.status(400).json({ error: "مفيش ملف" });
  const type = sniff(req.file.buffer);
  if (!type) return res.status(415).json({ error: "لازم PNG أو JPEG" });
  const name = `${crypto.randomUUID()}.${type}`;
  await fs.writeFile(path.join(DIR, name), req.file.buffer);
  res.status(201).json({ url: `/avatars/${name}`, size: req.file.size, type });
});

app.use((err, req, res, next) => {
  if (err instanceof multer.MulterError) {
    return res.status(err.code === "LIMIT_FILE_SIZE" ? 413 : 400).json({ error: err.code });
  }
  res.status(500).json({ error: "حصلت مشكلة" });
});

app.listen(3000, () => console.log("http://localhost:3000"));

$ node server.js
http://localhost:3000

→ POST /avatar
  (form: avatar=me.png)
← 201 Created
{
  "url": "/avatars/e275318a-2f28-4b47-acdd-7b604491e50c.png",
  "size": 208,
  "type": "png"
}

→ POST /avatar
  (form: avatar=cat.png)
← 415 Unsupported Media Type
{
  "error": "لازم PNG أو JPEG"
}

→ POST /avatar
  (form: avatar=big.png)
← 413 Payload Too Large
{
  "error": "LIMIT_FILE_SIZE"
}

→ POST /avatar
  (form: name)
← 400 Bad Request
{
  "error": "مفيش ملف"
}