Validate EPUB Uploads

Task

Reject files that are not suitable for Readly before storing them.

At minimum validate:

• file presence
• .epub filename extension
• expected EPUB MIME type when supplied
• maximum file size

Do not rely on the browser’s accept attribute as security validation.

Example:

const MAX_EPUB_BYTES = 25 * 1024 * 1024;

const nameIsEpub = file.name.toLowerCase().endsWith(".epub");
const typeIsAllowed =
  !file.type || file.type === "application/epub+zip";

if (!nameIsEpub || !typeIsAllowed || file.size > MAX_EPUB_BYTES) {
  return Response.json(
    { error: "Invalid EPUB upload" },
    { status: 400 },
  );
}

Keep the size limit appropriate for the deployment environment.

For stronger content validation, inspect the ZIP/EPUB structure before accepting the file.

Test

Try:

• a valid EPUB
• a .pdf
• a renamed non-EPUB file
• a file larger than the configured limit

Invalid files should never reach object storage.

Checkpoint

Upload validation happens before storage and is enforced by the server.