if (!isAllowedMagicBytes(buffer, ['ffd8ff' /* jpeg */, '89504e47' /* png */])) rejectUpload();
<img src=x onerror=alert(document.cookie)> capcut bug bounty fix