Fix Memory Exhaustion and DoS for PDF uploads (#1549)

backend/controllers/notesSummaryController.js

@@ -1,5 +1,6 @@
 const axios = require("axios");
 const crypto = require("crypto");
+const fs = require("fs");
 const { generateWithFallback } = require("../utils/geminiHelper");
 const {
   inspectPdfBuffer,
@@ -103,14 +104,16 @@
  * @example
  */
 const summarizeNotes = async (req, res) => {
+  let uploadedFilePath = null;
   try {
     let buffer;
     let fileName;
     let sourceType;
     let sourceUrl = null;
 
     if (req.file) {
-      buffer = req.file.buffer;
+      uploadedFilePath = req.file.path;
+      buffer = await fs.promises.readFile(uploadedFilePath);
       fileName = req.file.originalname;
       sourceType = "upload";
     } else {
@@ -238,6 +241,10 @@
     }
 
     res.status(500).json({ success: false, message: "Failed to summarize notes." });
+  } finally {
+    if (uploadedFilePath) {
+      fs.promises.unlink(uploadedFilePath).catch(err => console.error("Failed to delete temp notes PDF:", err));
+    }
   }
 };
 
@@ -257,7 +264,7 @@
         message: validation.error.issues.map((issue) => issue.message),
       });
     }
 
     const {
       fileName,
       sourceType,

backend/controllers/resumeController.js

@@ -1,5 +1,6 @@
 const axios = require('axios');
 const FormData = require('form-data');
+const fs = require('fs');
 const { generateWithFallback } = require('../utils/geminiHelper');
 
 /**
@@ -100,11 +101,15 @@
  * }
  */
 const analyzeResume = async (req, res) => {
+    let uploadedFilePath = null;
     try {
         if (!req.file) {
             return res.status(400).json({ message: "No resume file uploaded" });
         }
 
+        uploadedFilePath = req.file.path;
+        const fileBuffer = await fs.promises.readFile(uploadedFilePath);
+
         const targetRole = req.body.targetRole || "General Professional";
 
         // 2. Prompt Engineering
@@ -133,7 +138,7 @@
                 prompt,
                 {
                     inlineData: {
-                        data: req.file.buffer.toString("base64"),
+                        data: fileBuffer.toString("base64"),
                         mimeType: "application/pdf"
                     }
                 }
@@ -161,6 +166,10 @@
     } catch (error) {
         console.error("Resume Analysis Error:", error);
         res.status(500).json({ message: "Failed to analyze resume" });
+    } finally {
+        if (uploadedFilePath) {
+            fs.promises.unlink(uploadedFilePath).catch(err => console.error("Failed to delete temp resume PDF:", err));
+        }
     }
 }
 

backend/middlewares/uploadMiddleware.js

@@ -1,7 +1,7 @@
 const multer = require("multer");
 const fs = require("fs");
 const path = require("path");
-const { fileTypeFromBuffer } = require("file-type");
+const { fileTypeFromBuffer, fileTypeFromFile } = require("file-type");
 
 const MAX_FILE_SIZE = 5 * 1024 * 1024;
 
@@ -120,7 +120,12 @@ const validateResumeMagicBytes = async (req, res, next) => {
   }
 
   try {
-    const fileType = await fileTypeFromBuffer(req.file.buffer);
+    let fileType;
+    if (req.file.buffer) {
+      fileType = await fileTypeFromBuffer(req.file.buffer);
+    } else if (req.file.path) {
+      fileType = await fileTypeFromFile(req.file.path);
+    }
 
     const allowedMimeTypes = new Set([
       'application/pdf',
@@ -153,9 +158,12 @@ const upload = multer({
   limits: { fileSize: MAX_FILE_SIZE },
 });
 
-// Upload instance for resumes (memory storage)
+// Upload instance for resumes (disk storage)
 const uploadResume = multer({
-  storage: multer.memoryStorage(),
+  storage: multer.diskStorage({
+    destination: (req, file, cb) => cb(null, "uploads/"),
+    filename: (req, file, cb) => cb(null, `${Date.now()}-${sanitizeBase(file.originalname)}.pdf`)
+  }),
   fileFilter: resumeFileFilter,
   limits: { fileSize: MAX_FILE_SIZE },
 });
@@ -164,7 +172,10 @@ const uploadResume = multer({
 const NOTES_MAX_FILE_SIZE = 15 * 1024 * 1024;
 
 const uploadNotes = multer({
-  storage: multer.memoryStorage(),
+  storage: multer.diskStorage({
+    destination: (req, file, cb) => cb(null, "uploads/"),
+    filename: (req, file, cb) => cb(null, `${Date.now()}-${sanitizeBase(file.originalname)}.pdf`)
+  }),
   fileFilter: resumeFileFilter, // PDF-only, same filter as resumes
   limits: { fileSize: NOTES_MAX_FILE_SIZE },
 });