[Security]: Strengthen MP4 upload validation and enforce file-size limits

[Jidnyasa-P]

Description

Course video uploads currently validate only the filename extension.

A file renamed to .mp4 may pass the current validation even when its MIME type is invalid. There is also no configured upload-size limit, allowing unexpectedly large files to consume server storage or memory.

Proposed solution

Strengthen the Multer configuration by:

• Checking both file extension and MIME type.
• Allowing only expected MP4 MIME types.
• Adding a configurable maximum video size.
• Providing a safe default, such as 250 MB.
• Returning clear 400 or 413 responses for rejected uploads.
• Limiting the maximum number of uploaded section videos.
• Removing already-written files when course creation fails.
• Sanitizing generated filenames.
• Adding tests for accepted and rejected uploads.

Suggested environment setting:

MAX_VIDEO_SIZE_MB=250

Acceptance criteria

• Valid MP4 files are accepted.
• Renamed non-video files are rejected.
• Unsupported MIME types are rejected.
• Oversized videos are rejected.
• Upload-count limits are enforced.
• Failed course creation does not leave orphaned files.
• Error responses do not expose internal filesystem paths.
• The maximum size can be configured through the environment.
• Backend tests cover valid type, invalid type, oversized file, and cleanup.
• No frontend changes are required.

Suggested files

backend/routers/userRoutes.js
backend/controllers/userControllers.js
backend/utils/uploadCleanup.js
backend/.env.example
backend/tests/video-upload.test.js

[Jidnyasa-P]

/assign

[Jidnyasa-P]

@udaycodespace Kindly assign this issue to me under ECSOC26

[udaycodespace]

@Jidnyasa-P It’s been 4 days with no progress. Please try to complete it by the first half of Monday, so I can review it by Monday night.

In the PR, please include the relevant commands and their outputs, along with a snippet/screenshot of the UI changes, if applicable.