File type validation in Express - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ component_behavior

intermediate

What happens when uploading a .txt file with this Express file validation?

Consider this Express middleware snippet that validates uploaded file types:

const multer = require('multer');
const upload = multer({
  fileFilter: (req, file, cb) => {
    if (file.mimetype === 'image/png' || file.mimetype === 'image/jpeg') {
      cb(null, true);
    } else {
      cb(new Error('Only PNG and JPEG allowed'));
    }
  }
});

If a user uploads a file named notes.txt, what will happen?

A The upload is rejected and an error 'Only PNG and JPEG allowed' is triggered.

B The upload is accepted and file is saved.

C The upload is accepted but file is renamed to .png.

D The upload is rejected with a generic server error.

💡 Hint

Check the fileFilter function and what happens when the mimetype is not allowed.

The fileFilter checks the mimetype. Since 'text/plain' is not 'image/png' or 'image/jpeg', it calls cb(new Error(...)), which rejects the upload with that error message.

📝 Syntax

intermediate

Which option correctly validates only PDF files in Express multer?

Choose the correct fileFilter function to accept only PDF files.

A fileFilter: (req, file, cb) => { if (file.mimetype === 'application/pdf') cb(null, true); else cb(null, false); }

B fileFilter: (req, file, cb) => { if (file.mimetype === 'pdf') cb(null, true); else cb(null, false); }

C fileFilter: (req, file, cb) => { if (file.mimetype === 'application/pdf') cb(null, true); else cb(new Error('Only PDFs allowed')); }

D fileFilter: (req, file, cb) => { if (file.type === 'application/pdf') cb(null, true); else cb(null, false); }

💡 Hint

Check the exact mimetype string and how errors are handled.

Option C correctly checks for 'application/pdf' mimetype and rejects with an error if not matched. Option C silently rejects without error, C uses wrong mimetype string, D uses wrong property 'file.type'.

🔧 Debug

advanced

Why does this Express file validation always accept files regardless of type?

Look at this fileFilter function:

fileFilter: (req, file, cb) => {
  if (file.mimetype === 'image/png' || 'image/jpeg') {
    cb(null, true);
  } else {
    cb(new Error('Invalid file type'));
  }
}

Why does it accept all files, even non-images?

A Because the callback is never called.

B Because the condition always evaluates to true due to incorrect logical OR usage.

C Because the mimetype property is misspelled.

D Because the error callback is missing.

💡 Hint

Look carefully at the condition inside the if statement.

The condition file.mimetype === 'image/png' || 'image/jpeg' always returns true because 'image/jpeg' is a truthy string. The correct condition should be file.mimetype === 'image/png' || file.mimetype === 'image/jpeg'.

❓ state_output

advanced

What is the value of req.file after uploading a valid PNG file?

Given this Express route using multer:

const upload = multer({
  fileFilter: (req, file, cb) => {
    if (file.mimetype === 'image/png') cb(null, true);
    else cb(new Error('Only PNG allowed'));
  }
});

app.post('/upload', upload.single('photo'), (req, res) => {
  res.json(req.file);
});

If a user uploads a valid PNG file named pic.png, what will req.file contain?

A An object with file details including originalname, mimetype, and buffer.

B Undefined, because fileFilter does not save the file.

C An error object with message 'Only PNG allowed'.

D An empty object {}.

💡 Hint

Think about what multer does when the file passes the filter.

When the file passes the filter, multer processes it and attaches an object with file info to req.file. This includes properties like originalname, mimetype, and buffer if using memory storage.

🧠 Conceptual

expert

Which approach best prevents uploading dangerous file types in Express?

To protect your Express app from dangerous file uploads, which approach is most effective?

A Rename all files to .txt to neutralize them.

B Allow all uploads and rely on client-side validation.

C Only check the file extension in the filename string.

D Check the file mimetype and reject disallowed types in multer's fileFilter, then scan file content for malware.

💡 Hint

Think about both file type validation and security scanning.

Checking mimetype in fileFilter helps block unwanted types early. Scanning file content for malware adds security. Relying only on extensions or client-side checks is unsafe. Renaming files doesn't remove harmful content.