Node.js: How do I protect against malicious image file uploads? I.e., how do I implement an image sanitizer in Node?

Question

I am creating a web app using hapi.js that allows users to upload images. I am validating the uploaded images in both the client and server to only allow .jpg/.jpeg, .png, and .gif files. However, I am new to web application security and when it comes to image sanitization I am a bit lost.

I am trying to follow these OWASP Upload Verification guidelines:

• Use image rewriting libraries to verify the image is valid and to strip away extraneous content.
• Set the extension of the stored image to be a valid image extension based on the detected content type of the image from image processing (e.g. do not just trust the header from the upload).

These are my questions:

• Can I simply run each uploaded image through a package like sharp and the rewriting process will remove any embedded code? The author of sharp has made a brief comment on security, but I still don't understand what the possible security issues are or how to handle them.
• I have read comments that say that reading bytes into a Buffer cannot execute malicious code. If I were to input a file into sharp as a Buffer object, would that remove any malicious code and eliminate the possible security issues?
• Do I need to run the uploaded images through an antivirus scan (like clamscan or node-virustotal or Web Exploit Detector)? If yes, would I need to run the images through a scan before or after I run the images through an image processor or should I do the scan with no image processing?

I would really like to understand web application security better (especially for Node apps), so any direction you can give me on these issues (or places I can go to learn more) would be very much appreciated.

Thank you!

Nosy

This isn't really what SO is for, unfortunately - it's a fair question, but any answer you get is primarily going to be someone's opinion, rather than a straight forward solution that applies to a well described problem. Just check your uploads for known image type magic numbers, rename them to the correct file extension, and then just try to read them in "as image" (using gd or something). If that works, you're pretty much already safe since you're not going to execute images on the server (because you confirmed they're images). – Ablaze

@Mike'Pomax'Kamermans I think the guidelines are looking to block more than just server-side bugs, but other forms of malice as well. See e.g. the GIFAR exploit, which is all about uploading a file containing both image and Java content, tricking a trusted site into hosting it as if it's just an image, and using that site's trusted status to get browsers to load the Java content. If you load the image and re-save it, you'll be sure the file contains nothing but image content. – Hepsibah

I was mighty confused by the very notion of any browser loading java at all, but I guess if your target audience is a corporate intranet with untrusted members or something, then... maybe? – Ablaze

@Mike'Pomax'Kamermans I found you comment is helpful. Would you mind explain 1) how to check uploads for known image type magic numbers? 2) what is gd? Thank you very much. – Hyperbaton

en.wikipedia.org/wiki/List_of_file_signatures (look up jpeg and png, for example), and gd is php.net/manual/en/book.image.php (if you need to do image work in PHP, 99.99999% of the time it's either gd or image imagick) – Ablaze

great question i want to know this as well – Roccoroch

It would be nice to have an infected image to find the code able to detect and/or sanitize it. A simple image that creates an empty folder in the temp folder – Dimple