Language: Java
Label: safe
CWE: CWE-434 \u2014 Unrestricted Upload of File with Dangerous Type
The product allows the attacker to upload or transfer files of dangerous types that can be automatically processed within the product's environment.

Code:
    private boolean isImage(MultipartFile file) {
        BufferedImage image = null;
        try (InputStream input = file.getInputStream()) {
            image = ImageIO.read(input);
        } catch (IOException e) {
            LogUtil.error(e.getMessage(), e);
            return false;
        }
        Pattern pattern = Pattern.compile("\\.(png|jpg|jpeg|gif)$");
        Matcher matcher = pattern.matcher(file.getOriginalFilename().toLowerCase());
        if (image == null || image.getWidth() <= 0 || image.getHeight() <= 0 || !matcher.find()) {
            return false;
        }

        return true;
    }