[Security] Block active content attachment uploads

[PClmnt]

Description

Apply active-content attachment checks to all upload paths, not only public-user uploads, so authenticated users cannot store browser-executable attachment content through builder or table upload endpoints.

Addresses

• https://github.com/Budibase/vulns/issues/34
• GHSA-82rc-gxrg-v4gf

App Export

• N/A

Screenshots

• N/A, backend upload validation fix only.

Launchcontrol

Attachment uploads now reject active web content for all users.

---

Summary by cubic

Block active-content attachment uploads across all endpoints to prevent browser-executable files from being stored. Applies to both public and authenticated uploads to mitigate stored XSS.

• Bug Fixes
  • Enforce extension, MIME, and content-based checks on all upload paths (builder and table) for every user.
  • Expand blocked types: extensions js, jse, mjs, wasm; MIME application/javascript, text/javascript, application/wasm.
  • Update tests to assert 400 rejection for builder uploads and authenticated table uploads.

^{Written for commit f4f52c1. Summary will update on new commits.}