Bug Description
Description
The profile picture upload flow in ProfilePictureUpload.jsx sends whatever file the user selects straight to Firebase Storage. There is no check on MIME type, file extension, or file size before or during the upload, and no corresponding validation in Storage security rules.
Steps to Reproduce
- Go to Profile → Edit → Change avatar
- Select an arbitrary file (e.g. a .zip, .exe, or a 200MB image)
- Upload completes successfully and the file is stored
Expected Behavior
- Only image MIME types (image/png, image/jpeg, image/webp) are accepted
- A reasonable max file size is enforced (e.g. 5MB)
- Rejected files show a clear inline error instead of silently uploading
Actual Behavior
Any file type and size is accepted and stored, with no feedback to the user if something goes wrong downstream (e.g. broken avatar rendering).
Impact
- Storage abuse / cost inflation from oversized or unnecessary file uploads
- Potential vector for hosting arbitrary (non-image) files under the app's storage bucket
- Broken UI when non-image files are rendered as
<img> avatars
Suggested Fix
Add client-side MIME/size validation before upload starts, and mirror the same constraints in Firebase Storage security rules so the check can't be bypassed by calling the API directly.
Bug Description
Description
The profile picture upload flow in
ProfilePictureUpload.jsxsends whatever file the user selects straight to Firebase Storage. There is no check on MIME type, file extension, or file size before or during the upload, and no corresponding validation in Storage security rules.Steps to Reproduce
Expected Behavior
Actual Behavior
Any file type and size is accepted and stored, with no feedback to the user if something goes wrong downstream (e.g. broken avatar rendering).
Impact
<img>avatarsSuggested Fix
Add client-side MIME/size validation before upload starts, and mirror the same constraints in Firebase Storage security rules so the check can't be bypassed by calling the API directly.