On nodejs-express, I need a file upload function for my website's bulletin board so that every user can upload and download files for each other.
For security reasons, I use npm module 'mmmagic' for validating if uploaded file's mime-type is not modulated (e.g. png) -or is in whitelist which I accepted. And I'm considering using 'helmet' module for enhanced security with noSniff().
My question is, does .txt files can execute or inject malicious code by attackers, and do something they want?
I can't decide whether I should restrict files even their extension is covered with txt or not. Thanks in advance.