Skip to content

fix: Parse Server option fileUpload.fileExtensions fails to determine file extension if filename contains multiple dots #8754

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 7 commits into from
Sep 23, 2023
Merged

fix: Parse Server option fileUpload.fileExtensions fails to determine file extension if filename contains multiple dots #8754

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
09008bf
fix: use last index of period to determine extension
Sep 19, 2023
b2e90ff
Added some more testing for bad file extensions and also invalid file…
Sep 19, 2023
884512d
Change from split to lastIndexOf
Sep 19, 2023
9e9bc41
Merge branch 'alpha' into fix/extension-fix
mtrezza Sep 20, 2023
c5db899
Merge branch 'alpha' into fix/extension-fix
mtrezza Sep 22, 2023
2cd301f
Update spec/ParseFile.spec.js
MarcDerhammer Sep 22, 2023
3f26fda
Update spec/ParseFile.spec.js
MarcDerhammer Sep 22, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
68 changes: 68 additions & 0 deletions spec/ParseFile.spec.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1364,6 +1364,74 @@ describe('Parse.File testing', () => {
);
});

it('works with a period in the file name', async () => {
await reconfigureServer({
fileUpload: {
enableForPublic: true,
fileExtensions: ['^[^hH][^tT][^mM][^lL]?$'],
},
});
const headers = {
'X-Parse-Application-Id': 'test',
'X-Parse-REST-API-Key': 'rest',
};

const values = ['file.png.html', 'file.txt.png.html', 'file.png.txt.html'];

for (const value of values) {
await expectAsync(
request({
method: 'POST',
headers: headers,
url: `http://localhost:8378/1/files/${value}`,
body: '<html></html>\n',
}).catch(e => {
throw new Error(e.data.error);
})
).toBeRejectedWith(
new Parse.Error(Parse.Error.FILE_SAVE_ERROR, `File upload of extension html is disabled.`)
);
}
});

it('works to stop invalid filenames', async () => {
await reconfigureServer({
fileUpload: {
enableForPublic: true,
fileExtensions: ['^[^hH][^tT][^mM][^lL]?$'],
},
});
const headers = {
'X-Parse-Application-Id': 'test',
'X-Parse-REST-API-Key': 'rest',
};

const values = [
'!invalid.png',
'.png',
'.html',
' .html',
'.png.html',
'~invalid.png',
'-invalid.png',
];

for (const value of values) {
await expectAsync(
request({
method: 'POST',
headers: headers,
url: `http://localhost:8378/1/files/${value}`,
body: '<html></html>\n',
}).catch(e => {
throw new Error(e.data.error);
})
).toBeRejectedWith(
new Parse.Error(Parse.Error.INVALID_FILE_NAME, `Filename contains invalid characters.`)
);
}
});

it('works with array', async () => {
await reconfigureServer({
fileUpload: {
Expand Down
2 changes: 1 addition & 1 deletion src/Routers/FilesRouter.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -155,7 +155,7 @@ export class FilesRouter {
};
let extension = contentType;
if (filename && filename.includes('.')) {
extension = filename.split('.')[1];
extension = filename.substring(filename.lastIndexOf('.') + 1);
} else if (contentType && contentType.includes('/')) {
extension = contentType.split('/')[1];
}
Expand Down