feat: implement secure image upload pipeline and backend XSS guard (Stage 2 Task A)

Directory.Packages.props

@@ -5,6 +5,7 @@
   <ItemGroup>
     <PackageVersion Include="FluentResults" Version="4.0.0" />
     <PackageVersion Include="HtmlSanitizer" Version="9.0.892" />
+    <PackageVersion Include="Markdig" Version="0.38.0" />
     <PackageVersion Include="Mapster" Version="10.0.7" />
     <PackageVersion Include="Mapster.DependencyInjection" Version="10.0.7" />
     <PackageVersion Include="MediatR" Version="12.1.1" />

src/NexusReader.Infrastructure/NexusReader.Infrastructure.csproj

@@ -29,6 +29,7 @@
     <PackageReference Include="Polly" />
     <PackageReference Include="Polly.Extensions.Http" />
     <PackageReference Include="HtmlSanitizer" />
+    <PackageReference Include="Markdig" />
     <PackageReference Include="Qdrant.Client" />
     <PackageReference Include="Stripe.net" />
     <PackageReference Include="VersOne.Epub" />

src/NexusReader.Infrastructure/Services/HtmlSanitizerService.cs

@@ -2,6 +2,7 @@ using Ganss.Xss;
 using Microsoft.Extensions.Options;
 using NexusReader.Application.Abstractions.Services;
 using NexusReader.Infrastructure.Configuration;
+using Markdig;
 
 namespace NexusReader.Infrastructure.Services;
 
@@ -11,10 +12,12 @@ namespace NexusReader.Infrastructure.Services;
 public class HtmlSanitizerService : ISanitizerService
 {
     private readonly HtmlSanitizer _sanitizer;
+    private readonly MarkdownPipeline _pipeline;
 
     public HtmlSanitizerService(IOptions<HtmlSanitizerSettings>? options = null)
     {
         _sanitizer = new HtmlSanitizer();
+        _pipeline = new MarkdownPipelineBuilder().UseAdvancedExtensions().Build();
         
         if (options?.Value != null)
         {
@@ -65,6 +68,9 @@ public class HtmlSanitizerService : ISanitizerService
             return input;
         }
 
-        return _sanitizer.Sanitize(input);
+        // Translate raw Markdown input to HTML strictly before running HtmlSanitizer
+        var html = Markdown.ToHtml(input, _pipeline);
+
+        return _sanitizer.Sanitize(html).Trim();
     }
 }

src/NexusReader.Infrastructure/Services/LocalStorageService.cs

@@ -24,7 +24,7 @@ public class LocalStorageService : IStorageService
 
     public async Task<string> UploadFileAsync(Stream fileStream, string fileName, string contentType)
     {
-        var mediaFolder = Path.Combine(_environment.WebRootPath, "uploads", "media");
+        var mediaFolder = Path.Combine(_environment.WebRootPath, "uploads");
         var resolvedMediaFolder = Path.GetFullPath(mediaFolder);
         var folderWithSeparator = resolvedMediaFolder.EndsWith(Path.DirectorySeparatorChar)
             ? resolvedMediaFolder
@@ -53,6 +53,6 @@ public class LocalStorageService : IStorageService
         }
 
         // Return the public web-relative URL
-        return $"/uploads/media/{uniqueFileName}";
+        return $"/uploads/{uniqueFileName}";
     }
 }

src/NexusReader.UI.Shared/Components/MarkdownEditor.razor

@@ -82,12 +82,18 @@
     }
 
     [JSInvokable]
-    public async Task<string> UploadImageFromJs(string filename, string contentType, byte[] fileBytes)
+    public async Task<string> UploadImageFromJs(string filename, string contentType, IJSStreamReference streamRef)
     {
         try
         {
+            const long maxFileSize = 5 * 1024 * 1024; // 5MB limit
+            using var stream = await streamRef.OpenReadStreamAsync(maxFileSize, _cts.Token);
+            using var memoryStream = new MemoryStream();
+            await stream.CopyToAsync(memoryStream, _cts.Token);
+            var fileBytes = memoryStream.ToArray();
+
             using var content = new MultipartFormDataContent();
-            var fileContent = new ByteArrayContent(fileBytes);
+            using var fileContent = new ByteArrayContent(fileBytes);
             fileContent.Headers.ContentType = new System.Net.Http.Headers.MediaTypeHeaderValue(contentType);
             content.Add(fileContent, "file", filename);
 
@@ -96,19 +102,19 @@
             {
                 var result = await response.Content.ReadFromJsonAsync<NexusReader.Application.DTOs.Media.UploadResultDto>(
                     NexusReader.Application.Common.AppJsonContext.Default.UploadResultDto, _cts.Token);
-                return result?.Url ?? string.Empty;
+                return result?.Url ?? "https://placehold.co/600x400?text=Upload+Failed";
             }
             else
             {
-                var errorMsg = await response.Content.ReadAsStringAsync();
+                var errorMsg = await response.Content.ReadAsStringAsync(_cts.Token);
                 Console.WriteLine($"[MarkdownEditor] Image upload failed: {response.StatusCode} - {errorMsg}");
-                return string.Empty;
+                return "https://placehold.co/600x400?text=Upload+Failed";
             }
         }
         catch (Exception ex)
         {
             Console.WriteLine($"[MarkdownEditor] Exception during image upload: {ex.Message}");
-            return string.Empty;
+            return "https://placehold.co/600x400?text=Upload+Failed";
         }
     }
 

src/NexusReader.UI.Shared/wwwroot/js/milkdownWrapper.js

@@ -50,12 +50,11 @@ export async function initEditor(elementId, dotNetHelper, initialMarkdown) {
                 [Crepe.Feature.ImageBlock]: {
                     onUpload: async (file) => {
                         try {
-                            const arrayBuffer = await file.arrayBuffer();
+                            const streamRef = DotNet.createJSStreamReference(file);
-                            const uint8Array = new Uint8Array(arrayBuffer);
+                            const url = await dotNetHelper.invokeMethodAsync('UploadImageFromJs', file.name, file.type, streamRef);
-                            const url = await dotNetHelper.invokeMethodAsync('UploadImageFromJs', file.name, file.type, uint8Array);
                             return url;
                         } catch (err) {
-                            console.error("[Milkdown] Failed to upload image from JS:", err);
+                            console.error("[Milkdown] Failed to upload image from JS (onUpload):", err);
                             throw err;
                         }
                     }
@@ -63,6 +62,36 @@ export async function initEditor(elementId, dotNetHelper, initialMarkdown) {
             }
         });
 
+        // Configure custom uploader using the uploadConfig context slice
+        crepe.editor.config((ctx) => {
+            try {
+                ctx.update('uploadConfig', (prev) => ({
+                    ...prev,
+                    uploader: async (files, schema) => {
+                        const nodes = [];
+                        for (let i = 0; i < files.length; i++) {
+                            const file = files[i];
+                            if (file.type.startsWith('image/')) {
+                                try {
+                                    const streamRef = DotNet.createJSStreamReference(file);
+                                    const uploadedUrl = await dotNetHelper.invokeMethodAsync('UploadImageFromJs', file.name, file.type, streamRef);
+                                    if (uploadedUrl) {
+                                        const node = schema.nodes.image.create({ src: uploadedUrl, alt: file.name });
+                                        nodes.push(node);
+                                    }
+                                } catch (err) {
+                                    console.error("[Milkdown] Failed to upload image in custom uploader:", err);
+                                }
+                            }
+                        }
+                        return nodes;
+                    }
+                }));
+            } catch (err) {
+                console.error("[Milkdown] Failed to configure uploadConfig uploader:", err);
+            }
+        });
+
         // Store the editor instance in the map
         editorCache.set(elementId, crepe);
 

src/NexusReader.Web/Program.cs

@@ -802,15 +802,15 @@ app.MapPost("/api/media/upload", async (
         fileBytes = memoryStream.ToArray();
     }
 
-    // Validate signature
+    // Validate signature without trusting browser content-type, enforcing extension matching
-    if (!ValidateImageSignature(fileBytes, file.ContentType))
+    if (!ImageValidator.ValidateImageSignature(fileBytes, file.FileName, out var detectedContentType))
     {
-        logger.LogWarning("File signature validation failed for file {FileName} with content type {ContentType}.", file.FileName, file.ContentType);
+        logger.LogWarning("File signature validation failed for file {FileName} with browser content type {ContentType}.", file.FileName, file.ContentType);
-        return Results.BadRequest("Invalid image signature. Legitimate JPEG, PNG, or WEBP images only.");
+        return Results.BadRequest("Invalid file signature or extension mismatch. Legitimate JPEG, PNG, WEBP, or GIF images only.");
     }
 
-    // Save using IStorageService
+    // Save using IStorageService with the verified content type
-    var fileUrl = await storageService.UploadFileAsync(fileBytes, file.FileName, file.ContentType);
+    var fileUrl = await storageService.UploadFileAsync(fileBytes, file.FileName, detectedContentType);
     return Results.Ok(new NexusReader.Application.DTOs.Media.UploadResultDto(fileUrl));
 }).DisableAntiforgery();
 
@@ -878,32 +878,56 @@ async Task TriggerBackgroundProcessingForUnindexedBooksAsync(IServiceProvider se
     }
 }
 
-static bool ValidateImageSignature(byte[] bytes, string contentType)
+public static class ImageValidator
 {
-    if (bytes.Length < 4) return false;
+    public static bool ValidateImageSignature(byte[] bytes, string fileName, out string detectedContentType)
-
-    // Check PNG signature: 89 50 4E 47
-    if (bytes[0] == 0x89 && bytes[1] == 0x50 && bytes[2] == 0x4E && bytes[3] == 0x47)
     {
-        return contentType.Equals("image/png", StringComparison.OrdinalIgnoreCase);
+        detectedContentType = string.Empty;
-    }
+        if (bytes.Length < 4) return false;
 
-    // Check JPEG signature: FF D8 FF
+        // Check PNG signature: 89 50 4E 47
-    if (bytes[0] == 0xFF && bytes[1] == 0xD8 && bytes[2] == 0xFF)
+        if (bytes[0] == 0x89 && bytes[1] == 0x50 && bytes[2] == 0x4E && bytes[3] == 0x47)
-    {
+        {
-        return contentType.Equals("image/jpeg", StringComparison.OrdinalIgnoreCase) ||
+            detectedContentType = "image/png";
-               contentType.Equals("image/jpg", StringComparison.OrdinalIgnoreCase);
+        }
-    }
+        // Check JPEG signature: FF D8 FF
+        else if (bytes[0] == 0xFF && bytes[1] == 0xD8 && bytes[2] == 0xFF)
+        {
+            detectedContentType = "image/jpeg";
+        }
+        // Check WEBP signature: RIFF ... WEBP
+        else if (bytes.Length >= 12 &&
+                 bytes[0] == 0x52 && bytes[1] == 0x49 && bytes[2] == 0x46 && bytes[3] == 0x46 && // RIFF
+                 bytes[8] == 0x57 && bytes[9] == 0x45 && bytes[10] == 0x42 && bytes[11] == 0x50) // WEBP
+        {
+            detectedContentType = "image/webp";
+        }
+        // Check GIF signature: GIF87a or GIF89a
+        else if (bytes.Length >= 6 &&
+                 bytes[0] == 0x47 && bytes[1] == 0x49 && bytes[2] == 0x46 && bytes[3] == 0x38 &&
+                 (bytes[4] == 0x37 || bytes[4] == 0x39) && bytes[5] == 0x61)
+        {
+            detectedContentType = "image/gif";
+        }
 
-    // Check WEBP signature: RIFF ... WEBP
+        if (string.IsNullOrEmpty(detectedContentType))
-    if (bytes.Length >= 12 &&
+        {
-        bytes[0] == 0x52 && bytes[1] == 0x49 && bytes[2] == 0x46 && bytes[3] == 0x46 && // RIFF
+            return false;
-        bytes[8] == 0x57 && bytes[9] == 0x45 && bytes[10] == 0x42 && bytes[11] == 0x50) // WEBP
+        }
-    {
-        return contentType.Equals("image/webp", StringComparison.OrdinalIgnoreCase);
-    }
 
-    return false;
+        // Verify that the file extension matches the detected content type (extension-spoofing guard)
+        var ext = Path.GetExtension(fileName).ToLowerInvariant();
+        var isMatch = detectedContentType switch
+        {
+            "image/png" => ext == ".png",
+            "image/jpeg" => ext == ".jpg" || ext == ".jpeg",
+            "image/webp" => ext == ".webp",
+            "image/gif" => ext == ".gif",
+            _ => false
+        };
+
+        return isMatch;
+    }
 }
 
 public record KnowledgeRequest(string Text, Guid? EbookId = null);

tests/NexusReader.Application.Tests/NexusReader.Application.Tests.csproj

@@ -17,5 +17,6 @@
     <ProjectReference Include="..\..\src\NexusReader.Application\NexusReader.Application.csproj" />
     <ProjectReference Include="..\..\src\NexusReader.Infrastructure\NexusReader.Infrastructure.csproj" />
     <ProjectReference Include="..\..\src\NexusReader.UI.Shared\NexusReader.UI.Shared.csproj" />
+    <ProjectReference Include="..\..\src\NexusReader.Web\NexusReader.Web.csproj" />
   </ItemGroup>
 </Project>

tests/NexusReader.Application.Tests/Services/HtmlSanitizerServiceTests.cs

@@ -51,4 +51,20 @@ public class HtmlSanitizerServiceTests
         result.Should().NotContain("alert");
         result.Should().Contain("<img src=\"x\">");
     }
+
+    [Fact]
+    public void Sanitize_WithMarkdownCodeBlockContainingAngleBrackets_DoesNotStripAngleBrackets()
+    {
+        // Arrange
+        var service = new HtmlSanitizerService();
+        var input = "Here is some code:\n\n```csharp\nif (x < y && y > z) { Console.WriteLine(\"test\"); }\n```";
+
+        // Act
+        var result = service.Sanitize(input);
+
+        // Assert
+        result.Should().Contain("&lt;");
+        result.Should().Contain("&gt;");
+        result.Should().NotContain("<script>");
+    }
 }

tests/NexusReader.Application.Tests/Services/ValidateImageSignatureTests.cs

@@ -0,0 +1,118 @@
+using FluentAssertions;
+using Xunit;
+
+namespace NexusReader.Application.Tests.Services;
+
+public class ValidateImageSignatureTests
+{
+    [Fact]
+    public void Validate_PNG_WithCorrectSignature_ReturnsTrue()
+    {
+        // Arrange
+        byte[] pngBytes = [0x89, 0x50, 0x4E, 0x47, 0x0D, 0x0A, 0x1A, 0x0A];
+        string fileName = "image.png";
+
+        // Act
+        bool isValid = ImageValidator.ValidateImageSignature(pngBytes, fileName, out string contentType);
+
+        // Assert
+        isValid.Should().BeTrue();
+        contentType.Should().Be("image/png");
+    }
+
+    [Fact]
+    public void Validate_JPEG_WithCorrectSignature_ReturnsTrue()
+    {
+        // Arrange
+        byte[] jpegBytes = [0xFF, 0xD8, 0xFF, 0xE0, 0x00, 0x10, 0x4A, 0x46];
+        string fileName = "photo.jpg";
+
+        // Act
+        bool isValid = ImageValidator.ValidateImageSignature(jpegBytes, fileName, out string contentType);
+
+        // Assert
+        isValid.Should().BeTrue();
+        contentType.Should().Be("image/jpeg");
+    }
+
+    [Fact]
+    public void Validate_WEBP_WithCorrectSignature_ReturnsTrue()
+    {
+        // Arrange
+        byte[] webpBytes = [
+            0x52, 0x49, 0x46, 0x46, // RIFF
+            0x00, 0x00, 0x00, 0x00, // length
+            0x57, 0x45, 0x42, 0x50  // WEBP
+        ];
+        string fileName = "graphic.webp";
+
+        // Act
+        bool isValid = ImageValidator.ValidateImageSignature(webpBytes, fileName, out string contentType);
+
+        // Assert
+        isValid.Should().BeTrue();
+        contentType.Should().Be("image/webp");
+    }
+
+    [Fact]
+    public void Validate_GIF_WithCorrectSignature_ReturnsTrue()
+    {
+        // Arrange
+        byte[] gifBytes = [
+            0x47, 0x49, 0x46, 0x38, 0x39, 0x61, // GIF89a
+            0x01, 0x00, 0x01, 0x00
+        ];
+        string fileName = "animation.gif";
+
+        // Act
+        bool isValid = ImageValidator.ValidateImageSignature(gifBytes, fileName, out string contentType);
+
+        // Assert
+        isValid.Should().BeTrue();
+        contentType.Should().Be("image/gif");
+    }
+
+    [Fact]
+    public void Validate_WithMismatchingExtension_ReturnsFalse()
+    {
+        // Arrange: Valid PNG bytes but JPEG extension
+        byte[] pngBytes = [0x89, 0x50, 0x4E, 0x47, 0x0D, 0x0A, 0x1A, 0x0A];
+        string fileName = "spoofed.jpg";
+
+        // Act
+        bool isValid = ImageValidator.ValidateImageSignature(pngBytes, fileName, out string contentType);
+
+        // Assert
+        isValid.Should().BeFalse();
+    }
+
+    [Fact]
+    public void Validate_WithInvalidSignature_ReturnsFalse()
+    {
+        // Arrange: Plain text bytes but PNG extension
+        byte[] txtBytes = [0x48, 0x65, 0x6C, 0x6C, 0x6F, 0x20, 0x77, 0x6F]; // "Hello wo"
+        string fileName = "not_a_png.png";
+
+        // Act
+        bool isValid = ImageValidator.ValidateImageSignature(txtBytes, fileName, out string contentType);
+
+        // Assert
+        isValid.Should().BeFalse();
+        contentType.Should().BeEmpty();
+    }
+
+    [Fact]
+    public void Validate_WithShortBytes_ReturnsFalse()
+    {
+        // Arrange
+        byte[] shortBytes = [0x89, 0x50];
+        string fileName = "short.png";
+
+        // Act
+        bool isValid = ImageValidator.ValidateImageSignature(shortBytes, fileName, out string contentType);
+
+        // Assert
+        isValid.Should().BeFalse();
+        contentType.Should().BeEmpty();
+    }
+}