Discourse incorrectly detecting uploaded file as an image

Arkshine · November 18, 2023, 6:26pm

I did some digging around this issue.

In short, your file is being detected as JPEG because it starts with the same signature as this type of file.
Fixing this behavior in Discourse is possible, but it requires a modification. (see at the end)

Here some technical stuff.
This issue starts here:

github.com/discourse/discourse

lib/upload_creator.rb

main


      
          @image_info =
            begin
              image = FastImage.new(@file)
              image.type # eager load to rescue errors early
              image
            rescue StandardError
              nil
            end
          is_image = FileHelper.is_supported_image?(@filename)
          is_image ||= @image_info && FileHelper.is_supported_image?("test.#{@image_info.type}")

FastImage library opens the file and determines the type and size.
As you expect, it returns a type of JPEG.

If you look at what is JPEG signature, it looks like this:

JPEG markers

More information: List of file signatures - Wikipedia
JPEG - Wikipedia

It always starts with the following marker bytes: FF D8

Looking at your file sample with a Hex editor, you will see it starts the same.

Now, if you look at how FastImage detects a JPEG, you can see here:

github.com/sdsykes/fastimage

lib/fastimage.rb

master


      
          # frozen_string_literal: true
          # coding: ASCII-8BIT
          
          # FastImage finds the size or type of an image given its uri.
          # It is careful to only fetch and parse as much of the image as is needed to determine the result.
          # It does this by using a feature of Net::HTTP that yields strings from the resource being fetched
          # as soon as the packets arrive.
          #
          # No external libraries such as ImageMagick are used here, this is a very lightweight solution to
          # finding image information.
          #
          # FastImage knows about GIF, JPEG, BMP, TIFF, ICO, CUR, PNG, HEIC/HEIF, AVIF, PSD, SVG, WEBP and JXL files.
          #
          # FastImage can also read files from the local filesystem by supplying the path instead of a uri.
          # In this case FastImage reads the file in chunks of 256 bytes until
          # it has enough. This is possibly a useful bandwidth-saving feature if the file is on a network
          # attached disk rather than truly local.
          #
          # FastImage will automatically read from any object that responds to :read - for
          # instance an IO object if that is passed instead of a URI.

This file has been truncated. show original

However, you can’t extract any image information since not all the required bytes are there.

How do we fix this issue in Discourse?
Looking at FastImage code, there is a valuable option you can pass.

github.com/sdsykes/fastimage

lib/fastimage.rb

master


      
          # frozen_string_literal: true
          # coding: ASCII-8BIT
          
          # FastImage finds the size or type of an image given its uri.
          # It is careful to only fetch and parse as much of the image as is needed to determine the result.
          # It does this by using a feature of Net::HTTP that yields strings from the resource being fetched
          # as soon as the packets arrive.
          #
          # No external libraries such as ImageMagick are used here, this is a very lightweight solution to
          # finding image information.
          #
          # FastImage knows about GIF, JPEG, BMP, TIFF, ICO, CUR, PNG, HEIC/HEIF, AVIF, PSD, SVG, WEBP and JXL files.
          #
          # FastImage can also read files from the local filesystem by supplying the path instead of a uri.
          # In this case FastImage reads the file in chunks of 256 bytes until
          # it has enough. This is possibly a useful bandwidth-saving feature if the file is on a network
          # attached disk rather than truly local.
          #
          # FastImage will automatically read from any object that responds to :read - for
          # instance an IO object if that is passed instead of a URI.

This file has been truncated. show original

By using this option, any error ( SizeNotFound, ImageFetchFailure, CannotParseImage, UnknownImageType, BadImageURI) will return no image info ; and your file won’t be detected as an image.

@image_info =
begin
   FastImage.new(@file, :raise_on_failure=>true)
rescue StandardError
   nil
end
...
is_image ||= @image_info && FileHelper.is_supported_image?("test.#{@image_info.type}")

Then, it can work now:

I can make a PR later. Using this option makes sense here.

Topic		Replies	Views
Security checks on uploads Support	35	7876	December 2, 2018
Incorrect mime-types (content-type header) for mp4 and js Bug	10	1276	January 7, 2025
Something missing in "Select images or files from your device ()"? Bug	5	1193	October 22, 2015
Faster (and smaller) uploads in Discourse with Rust, WebAssembly and MozJPEG \| Blog Blog	35	5705	May 13, 2025
Add the .svg file extension to "image files" Feature	18	1692	October 10, 2025

Discourse incorrectly detecting uploaded file as an image

Related topics