I' m building a REST API with Django and Django Rest Framework. I allow users to upload images and videos using different subclasses of
ModelSerializer. When a file is received, the server saves it to a temporary file on the disk (with Django
TemporaryFileUploadHandler and only after the default validation) to perform custom validation. I need to validate the resolution of images / videos and the duration of videos. If validation succeeds the file is uploaded to AWS S3. My question is, if the file contains malicious code, could validating the file directly on the server be dangerous (I’ m hosted on a EC2 instance running Amazon Linux 2)? I will now report the parts of the code that I am particularly concerned about.
To validate the resolution of an image I use Django util
width, height = get_image_dimensions(image)
To validate the resolution and the duration of a video I use
moviepy (I know there are more efficient options like
ffprobe, but I prefer that way for other reasons):
from moviepy.editor import VideoFileClip
video_file_clip = VideoFileClip(video.file.temporary_file_path())
video_duration = video_file_clip.duration
width, height = video_file_clip.size
I wrote that code in the
clean method of a model used to contains posts, before running it I validate the file extension with Django
FileExtensionValidator (I know that the file extension is not a guarantee) and the file size by accessing
file.size. Should I also validate something else at the Django level before using the above code? Thanks in advance.