Image Loading and Validation

In this lesson we improve the image upload endpoint to validate and sanitize uploads so the app only accepts real images and returns a safe, processed image. The endpoint already handled uploads and compression; here we add stronger checks to prevent renamed executables or malformed data from being accepted and to ensure the processed output is a valid image before sending it back. What you’ll get

Robust server-side image validation using a layered approach (quick type checks + deep validation).
Single-pass reading of uploaded bytes to avoid repeated file seeks.
Re-encoding via OpenCV to control JPEG compression and then verifying the result with Pillow before returning it.
Clear error messages and appropriate HTTP status codes for failure modes.

Validation checklist

Check	Why it matters
`image` file present + filename provided	Basic presence check to avoid empty requests
`secure_filename` used	Sanitize client-supplied filenames to avoid path traversal and other filename attacks
File extension validated	Quick client-visible indicator (not sufficient alone)
`imghdr` quick content check	Fast sanity-check of bytes (helps catch obvious mismatches)
`Pillow.Image.verify()`	Robust verification that data is a valid image format
Non-empty upload	Prevent zero-byte or truncated files
`quality` as integer 0–100	Ensure re-encoding parameter is sane and predictable
Decode with OpenCV, re-encode to JPEG, verify with Pillow	Ensure any processing produced a valid image and control compression

Install Pillow before running the updated code:

pip install Pillow

Complete implementation

from flask import Blueprint, request, jsonify, send_file
import cv2
import numpy as np
import io
import imghdr
from werkzeug.utils import secure_filename
from PIL import Image, UnidentifiedImageError

bp = Blueprint('main', __name__)

@bp.route('/upload', methods=['POST'])
def upload():
    # 1) Basic presence checks
    if 'image' not in request.files:
        return jsonify({'error': 'No image part in the request'}), 400

    image = request.files['image']

    if image.filename == '':
        return jsonify({'error': 'No image selected for uploading'}), 400

    # 2) Secure the filename
    filename = secure_filename(image.filename)

    # 3) Check the file extension (client-side indicator)
    allowed_extensions = {'png', 'jpg', 'jpeg', 'gif'}
    if not ('.' in filename and filename.rsplit('.', 1)[1].lower() in allowed_extensions):
        return jsonify({'error': 'Invalid file extension'}), 400

    # 4) Read the uploaded bytes once
    image_content = image.read()
    if not image_content:
        return jsonify({'error': 'Empty file uploaded'}), 400

    # 5) Quick content check with imghdr
    # imghdr returns 'jpeg' for JPEG files, so check against that set
    allowed_imghdr = {'jpeg', 'png', 'gif'}
    detected_type = imghdr.what(None, h=image_content)
    if detected_type is None or detected_type not in allowed_imghdr:
        return jsonify({'error': 'Invalid image file (content type mismatch)'}), 400

    # 6) Robust verification using Pillow
    try:
        pil_img = Image.open(io.BytesIO(image_content))
        pil_img.verify()  # raises if the file is not a valid image
    except (UnidentifiedImageError, OSError) as e:
        return jsonify({'error': 'Invalid image file (failed verification)'}), 400

    # 7) Validate quality parameter (default 10)
    quality_str = request.form.get('quality', '10')
    try:
        quality = int(quality_str)
    except (TypeError, ValueError):
        return jsonify({'error': 'Quality must be an integer between 0 and 100'}), 400

    if quality < 0 or quality > 100:
        return jsonify({'error': 'Quality must be between 0 and 100'}), 400

    # 8) Decode the image with OpenCV using the already-read bytes
    img_array = np.frombuffer(image_content, np.uint8)
    img = cv2.imdecode(img_array, cv2.IMREAD_UNCHANGED)
    if img is None:
        return jsonify({'error': 'Failed to decode image with OpenCV'}), 400

    # 9) Re-encode as JPEG with the requested quality
    success, encoded_buf = cv2.imencode('.jpg', img, [int(cv2.IMWRITE_JPEG_QUALITY), quality])
    if not success:
        return jsonify({'error': 'Failed to encode processed image'}), 500

    # 10) Wrap buffer in BytesIO and verify processed image with Pillow
    img_bytes = encoded_buf.tobytes()
    img_io = io.BytesIO(img_bytes)
    try:
        processed_img = Image.open(img_io)
        processed_img.verify()
    except (UnidentifiedImageError, OSError) as e:
        return jsonify({'error': 'Processed image verification failed'}), 500

    # Reset pointer and return the validated processed image
    img_io.seek(0)
    return send_file(img_io, mimetype='image/jpeg')

Example request (curl)

curl -X POST "http://127.0.0.1:5000/upload" \
  -F "image=@DSC08804.JPG" \
  -F "quality=100"

Example request (Postman)

Key	Type	Value
image	File	DSC08804.JPG
quality	Text	100

Notes and recommendations

imghdr is a helpful quick check but not foolproof; Pillow’s Image.verify() provides stronger validation.
Read the raw upload bytes once and reuse them for all checks and decoding; this avoids extra seeks and keeps flow simple.
Decode and re-encode with OpenCV so you can apply compression control; always verify the processed image with Pillow to ensure you do not return malformed binary.
Re-encoding to JPEG will flatten animations and drop alpha channels — animated GIFs become a single frame and transparency is lost.
Use secure production deployment: the Flask built-in server is not intended for production. Consider a production WSGI server such as Gunicorn.

Do not use Flask’s development server for production workloads. Use a production WSGI server like gunicorn and follow best practices for HTTPS and request size limits.

Links and references

This update hardens the upload route so it validates incoming images, sanitizes inputs, and only returns a verified, processed image to clients.

Course Introduction

Introduction to AI-Assisted Development

Planning Phase

Development Phase - Backend

Development Phase - Frontend

Project Completion

Image Loading and Validation

Watch Video