[Bug] signup.ts: uploadCommunityLogo is a simulated stub that converts files to data URLs with no size or type validation, sending multi-megabyte base64 strings in the signup payload

[anshul23102]

Bug Summary

uploadCommunityLogo in src/features/Auth/v1/utils/signup.ts is explicitly marked as a simulation that encodes any uploaded file as a base64 data: URL and returns it as the logo value:

export async function uploadCommunityLogo(file: File): Promise<string> {
  // SIMULATION: If you need to switch to a real API, change this implementation
  return new Promise((resolve) => {
    const reader = new FileReader();
    reader.onload = () => resolve(reader.result as string);
    reader.readAsDataURL(file);   // no size check, no type check
  });
}

This data URL is then included in the signup form payload sent to /api/v1/auth/signup-community. Two issues:

1. No file size limit: A user can select a 50 MB PNG. FileReader.readAsDataURL() succeeds, producing a ~67 MB base64 string (base64 overhead). This string is then embedded in the JSON request body sent to the API. The backend must parse a ~67 MB request body per signup attempt.

2. No file type validation: Any file (executables, PDFs, ZIP archives) can be passed to this function. readAsDataURL() encodes anything. The resulting string may later be rendered in an <img src={...}> tag, which silently fails for non-image types rather than warning the user.

The comment acknowledges this is a simulation ("Replace with real FormData upload"), but the stub ships with no guards in the meantime.

Expected Behavior

uploadCommunityLogo should validate that:

• file.size is within a reasonable limit (for example, 2 MB).
• file.type is one of ["image/jpeg", "image/png", "image/webp"].

Both checks should throw an error before FileReader is invoked.

Actual Behavior

Any file of any size and type is encoded and included in the signup payload.

Affected File

src/features/Auth/v1/utils/signup.ts, uploadCommunityLogo function.

---

@NexGenStudioDev I would like to work on this issue. Could you please assign/ it to me? Contributing under NSoC '26.

[abhishek-nexgen-dev]

@anshul23102 Go ahead

[anshul23102]

Assignment Request

Hi @NexGenStudioDev,

I would like to work on this issue under NSoC'26. This is an important validation issue that affects data integrity and security:

Issue: uploadCommunityLogo is a stub that converts files to data URLs with no validation
Impact: Multi-megabyte base64 strings sent in signup payload can cause:

• Network bandwidth waste
• Server request size limit violations
• Memory exhaustion on frontend
• Database bloat

Proposed Solution:

• Validate file size (e.g., max 5MB)
• Validate MIME type (only image files)
• Compress/resize images before base64 encoding
• Add error handling for oversized files

I'm ready to implement this fix. Could you please assign this issue to me?

Thank you!