Upload images guard (MVG picture can show local files content: http://www.imagemagick.org/script/magick-vector-graphics.php).

verify-image-file-signature.js

// on input[type="file"]#change
var file = fileInput.files[0];

        (function(){
            var reader = new FileReader();
            reader.onload = function(e) {
                var view = new DataView(e.target.result),
                    // 0xFFD8 — jpeg file signature (filesignatures.net/?search=jpg&mode=EXT)
                    isPngSignature = view.getUint32(0, false) ===  0x89504E47 && view.getUint32(4, false) === 0x0D0A1A0A,
                    // 0x 89 50 4E 47 0D 0A 1A 0A — png signature (filesignatures.net/?search=png&mode=EXT)
                    isJpgSignature = view.getUint16(0, false) === 0xFFD8;

                if (!isJpgSignature && !isPngSignature) {
                    throw 'Incorrect signature';
                }
            };
            reader.readAsArrayBuffer(file.slice(0, 64 * 1024));
        })();

/* magic-picture.mvg.jpg reads /etc/hosts and show it to hacker:
push graphic-context 
  viewbox 0 0 260 260
  push graphic-context
    push graphic-context
      font-size 5
      fill 'white'
      stroke-width 1
      image over 1,1 260,260 'label:@/etc/hosts'
    pop graphic-context
  pop graphic-context
pop graphic-context

*/