fix(security): VULN-009 magic-byte MIME validation + UTC date fix

- uploadEvidenceFile: validate file type via file-type magic bytes, reject
  client-supplied MIME, derive extension from detected type, upload ArrayBuffer
- getEscalationThreshold: use setUTCHours instead of setHours so date-only ISO
  strings (always UTC midnight) compare consistently in any timezone
- Tests: mock file-type, update upload expectation to ArrayBuffer

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01CPf5Rc8QPx6V8KLEEgfKEQ

lib/notifications/capa-escalation.ts

@@ -8,9 +8,9 @@ export type EscalationThreshold = 'warning_3d' | 'due_today' | 'overdue_3d' | 'o
 
 export function getEscalationThreshold(dueDateIso: string): EscalationThreshold | null {
   const today = new Date()
-  today.setHours(0, 0, 0, 0)
+  today.setUTCHours(0, 0, 0, 0)
   const due = new Date(dueDateIso)
-  due.setHours(0, 0, 0, 0)
+  // date-only ISO strings are parsed as UTC midnight — keep due in UTC too
   const diffDays = Math.round((due.getTime() - today.getTime()) / 86_400_000)
 
   if (diffDays === 3) return 'warning_3d'

lib/supabase/storage.ts

@@ -1,34 +1,52 @@
 import type { SupabaseClient } from '@supabase/supabase-js'
+import { fileTypeFromBuffer } from 'file-type'
 
 export type EvidenceStage = 'report' | 'response' | 'investigation' | 'capa' | 'verification'
 
+const ALLOWED_MIME_TYPES = new Set([
+  'image/jpeg', 'image/png', 'image/gif', 'image/webp', 'image/heic', 'image/avif',
+  'video/mp4', 'video/quicktime', 'video/webm', 'video/x-msvideo',
+  'application/pdf',
+  'application/msword',
+  'application/vnd.openxmlformats-officedocument.wordprocessingml.document',
+  'application/vnd.ms-excel',
+  'application/vnd.openxmlformats-officedocument.spreadsheetml.sheet',
+])
+
 export async function uploadEvidenceFile(
   supabase: SupabaseClient,
   file: File,
   incidentId: string,
   stage: EvidenceStage,
 ): Promise<{ path: string; publicUrl: string; hash: string }> {
-  // Fix 3: Safe auth.getUser() destructuring
   const { data, error: authError } = await supabase.auth.getUser()
   if (authError || !data?.user) throw new Error('Not authenticated')
   const user = data.user
 
-  // Fix 2: Server-side size limit before processing
+  // Server-side size limit before processing
   const isVideo = file.type.startsWith('video/')
   const maxBytes = isVideo ? 200 * 1024 * 1024 : 10 * 1024 * 1024
   if (file.size > maxBytes) {
     throw new Error(`File too large: max ${isVideo ? '200MB' : '10MB'} for this file type`)
   }
 
-  const ext = file.name.split('.').pop() ?? 'bin'
+  // Magic-byte validation — do not trust client-supplied MIME type
+  const buffer = await file.arrayBuffer()
+  const detected = await fileTypeFromBuffer(buffer)
+  const detectedMime = detected?.mime ?? null
+  if (!detectedMime || !ALLOWED_MIME_TYPES.has(detectedMime)) {
+    throw new Error(`File type not allowed: ${detectedMime ?? 'unknown'}`)
+  }
+
+  const ext = detected?.ext ?? file.name.split('.').pop() ?? 'bin'
   const filename = `${Date.now()}-${Math.random().toString(36).slice(2)}.${ext}`
   const path = `${user.id}/${incidentId}/${stage}/${filename}`
 
-  const hash = await computeHash(file)
+  const hash = await computeHashFromBuffer(buffer)
 
   const { data: uploadData, error } = await supabase.storage
     .from('evidence')
-    .upload(path, file, { contentType: file.type, upsert: false })
+    .upload(path, buffer, { contentType: detectedMime, upsert: false })
 
   if (error) throw new Error(error.message)
 
@@ -48,8 +66,7 @@ export async function getEvidenceUrl(supabase: SupabaseClient, path: string): Pr
   return data.signedUrl
 }
 
-async function computeHash(file: File): Promise<string> {
+async function computeHashFromBuffer(buffer: ArrayBuffer): Promise<string> {
-  const buffer = await file.arrayBuffer()
   const hashBuffer = await crypto.subtle.digest('SHA-256', buffer)
   return Array.from(new Uint8Array(hashBuffer))
     .map(b => b.toString(16).padStart(2, '0'))

package-lock.json

@@ -11,6 +11,7 @@
         "@anthropic-ai/sdk": "^0.111.0",
         "@supabase/ssr": "^0.12.0",
         "@supabase/supabase-js": "^2.110.2",
+        "file-type": "^22.0.1",
         "idb": "^8.0.3",
         "next": "^15.5.20",
         "openai": "^6.46.0",
@@ -379,6 +380,16 @@
         "node": ">=6.9.0"
       }
     },
+    "node_modules/@borewit/text-codec": {
+      "version": "0.2.2",
+      "resolved": "https://registry.npmjs.org/@borewit/text-codec/-/text-codec-0.2.2.tgz",
+      "integrity": "sha512-DDaRehssg1aNrH4+2hnj1B7vnUGEjU6OIlyRdkMd0aUdIUvKXrJfXsy8LVtXAy7DRvYVluWbMspsRhz2lcW0mQ==",
+      "license": "MIT",
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/sponsors/Borewit"
+      }
+    },
     "node_modules/@bramus/specificity": {
       "version": "2.4.2",
       "resolved": "https://registry.npmjs.org/@bramus/specificity/-/specificity-2.4.2.tgz",
@@ -2850,6 +2861,29 @@
         }
       }
     },
+    "node_modules/@tokenizer/inflate": {
+      "version": "0.4.1",
+      "resolved": "https://registry.npmjs.org/@tokenizer/inflate/-/inflate-0.4.1.tgz",
+      "integrity": "sha512-2mAv+8pkG6GIZiF1kNg1jAjh27IDxEPKwdGul3snfztFerfPGI1LjDezZp3i7BElXompqEtPmoPx6c2wgtWsOA==",
+      "license": "MIT",
+      "dependencies": {
+        "debug": "^4.4.3",
+        "token-types": "^6.1.1"
+      },
+      "engines": {
+        "node": ">=18"
+      },
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/sponsors/Borewit"
+      }
+    },
+    "node_modules/@tokenizer/token": {
+      "version": "0.3.0",
+      "resolved": "https://registry.npmjs.org/@tokenizer/token/-/token-0.3.0.tgz",
+      "integrity": "sha512-OvjF+z51L3ov0OyAU0duzsYuvO01PH7x4t6DJx+guahgTnBHkhJdG7soQeTSFLWN3efnHyibZ4Z8l2EuWwJN3A==",
+      "license": "MIT"
+    },
     "node_modules/@tybys/wasm-util": {
       "version": "0.10.3",
       "resolved": "https://registry.npmjs.org/@tybys/wasm-util/-/wasm-util-0.10.3.tgz",
@@ -4434,7 +4468,6 @@
       "version": "4.4.3",
       "resolved": "https://registry.npmjs.org/debug/-/debug-4.4.3.tgz",
       "integrity": "sha512-RGwwWnwQvkVfavKVt22FGLw+xYSdzARwm0ru6DhTVA3umU5hZc28V3kO4stgYryrTlLpuvgI9GiijltAjNbcqA==",
-      "dev": true,
       "license": "MIT",
       "dependencies": {
         "ms": "^2.1.3"
@@ -5399,6 +5432,24 @@
         "node": ">=16.0.0"
       }
     },
+    "node_modules/file-type": {
+      "version": "22.0.1",
+      "resolved": "https://registry.npmjs.org/file-type/-/file-type-22.0.1.tgz",
+      "integrity": "sha512-ww5Mhre0EE+jmBvOXTmXAbEMuZE7uX4a3+oRCQFNj8w++g3ev913N6tXQz0XTXbueQ5TWQfm6BdaViEHHn8bhA==",
+      "license": "MIT",
+      "dependencies": {
+        "@tokenizer/inflate": "^0.4.1",
+        "strtok3": "^10.3.5",
+        "token-types": "^6.1.2",
+        "uint8array-extras": "^1.5.0"
+      },
+      "engines": {
+        "node": ">=22"
+      },
+      "funding": {
+        "url": "https://github.com/sindresorhus/file-type?sponsor=1"
+      }
+    },
     "node_modules/fill-range": {
       "version": "7.1.1",
       "resolved": "https://registry.npmjs.org/fill-range/-/fill-range-7.1.1.tgz",
@@ -5827,6 +5878,26 @@
       "integrity": "sha512-LtwtVyVYO5BqRvcsKuB2iUMnHwPVByPCXFXOpuU96IZPPoPN6xjOGxZQ74pgSVVLQWtUOYgyeL4GE98BY5D3wg==",
       "license": "ISC"
     },
+    "node_modules/ieee754": {
+      "version": "1.2.1",
+      "resolved": "https://registry.npmjs.org/ieee754/-/ieee754-1.2.1.tgz",
+      "integrity": "sha512-dcyqhDvX1C46lXZcVqCpK+FtMRQVdIMN6/Df5js2zouUsqG7I6sFxitIC+7KYK29KdXOLHdu9zL4sFnoVQnqaA==",
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/feross"
+        },
+        {
+          "type": "patreon",
+          "url": "https://www.patreon.com/feross"
+        },
+        {
+          "type": "consulting",
+          "url": "https://feross.org/support"
+        }
+      ],
+      "license": "BSD-3-Clause"
+    },
     "node_modules/ignore": {
       "version": "5.3.2",
       "resolved": "https://registry.npmjs.org/ignore/-/ignore-5.3.2.tgz",
@@ -6998,7 +7069,6 @@
       "version": "2.1.3",
       "resolved": "https://registry.npmjs.org/ms/-/ms-2.1.3.tgz",
       "integrity": "sha512-6FlzubTLZG3J2a/NVCAleEhjzq5oxgHyaCU9yYXvcLsvoVaHJq/s5xXI6/XXP6tz7R9xAOtHnSO/tXtF3WRTlA==",
-      "dev": true,
       "license": "MIT"
     },
     "node_modules/nanoid": {
@@ -8453,6 +8523,22 @@
         "url": "https://github.com/sponsors/sindresorhus"
       }
     },
+    "node_modules/strtok3": {
+      "version": "10.3.5",
+      "resolved": "https://registry.npmjs.org/strtok3/-/strtok3-10.3.5.tgz",
+      "integrity": "sha512-ki4hZQfh5rX0QDLLkOCj+h+CVNkqmp/CMf8v8kZpkNVK6jGQooMytqzLZYUVYIZcFZ6yDB70EfD8POcFXiF5oA==",
+      "license": "MIT",
+      "dependencies": {
+        "@tokenizer/token": "^0.3.0"
+      },
+      "engines": {
+        "node": ">=18"
+      },
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/sponsors/Borewit"
+      }
+    },
     "node_modules/styled-jsx": {
       "version": "5.1.6",
       "resolved": "https://registry.npmjs.org/styled-jsx/-/styled-jsx-5.1.6.tgz",
@@ -8638,6 +8724,24 @@
         "node": ">=8.0"
       }
     },
+    "node_modules/token-types": {
+      "version": "6.1.2",
+      "resolved": "https://registry.npmjs.org/token-types/-/token-types-6.1.2.tgz",
+      "integrity": "sha512-dRXchy+C0IgK8WPC6xvCHFRIWYUbqqdEIKPaKo/AcTUNzwLTK6AH7RjdLWsEZcAN/TBdtfUw3PYEgPr5VPr6ww==",
+      "license": "MIT",
+      "dependencies": {
+        "@borewit/text-codec": "^0.2.1",
+        "@tokenizer/token": "^0.3.0",
+        "ieee754": "^1.2.1"
+      },
+      "engines": {
+        "node": ">=14.16"
+      },
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/sponsors/Borewit"
+      }
+    },
     "node_modules/tough-cookie": {
       "version": "6.0.2",
       "resolved": "https://registry.npmjs.org/tough-cookie/-/tough-cookie-6.0.2.tgz",
@@ -8863,6 +8967,18 @@
         "typescript": ">=4.8.4 <6.1.0"
       }
     },
+    "node_modules/uint8array-extras": {
+      "version": "1.5.0",
+      "resolved": "https://registry.npmjs.org/uint8array-extras/-/uint8array-extras-1.5.0.tgz",
+      "integrity": "sha512-rvKSBiC5zqCCiDZ9kAOszZcDvdAHwwIKJG33Ykj43OKcWsnmcBRL09YTU4nOeHZ8Y2a7l1MgTd08SBe9A8Qj6A==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=18"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
     "node_modules/unbox-primitive": {
       "version": "1.1.0",
       "resolved": "https://registry.npmjs.org/unbox-primitive/-/unbox-primitive-1.1.0.tgz",

package.json

@@ -15,6 +15,7 @@
     "@anthropic-ai/sdk": "^0.111.0",
     "@supabase/ssr": "^0.12.0",
     "@supabase/supabase-js": "^2.110.2",
+    "file-type": "^22.0.1",
     "idb": "^8.0.3",
     "next": "^15.5.20",
     "openai": "^6.46.0",

tests/lib/supabase/storage.test.ts

@@ -1,6 +1,10 @@
 import { describe, it, expect, vi, beforeEach } from 'vitest'
 import { uploadEvidenceFile, getEvidenceUrl } from '@/lib/supabase/storage'
 
+vi.mock('file-type', () => ({
+  fileTypeFromBuffer: vi.fn().mockResolvedValue({ mime: 'image/jpeg', ext: 'jpg' }),
+}))
+
 const mockUpload = vi.fn()
 const mockCreateSignedUrl = vi.fn()
 const mockSupabase = {
@@ -26,7 +30,7 @@ describe('uploadEvidenceFile', () => {
     expect(mockSupabase.storage.from).toHaveBeenCalledWith('evidence')
     expect(mockUpload).toHaveBeenCalledWith(
       expect.stringContaining('user-123/incident-abc/report/'),
-      file,
+      expect.any(ArrayBuffer),
       expect.objectContaining({ contentType: 'image/jpeg', upsert: false })
     )
     expect(mockCreateSignedUrl).toHaveBeenCalledWith(expect.stringContaining('user-123/incident-abc/report/'), 315360000)