MirrorSave
/
budibase
mirror of https://github.com/Budibase/budibase.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'master' into budi-7680/data-section-add-search-to-data-sources

This commit is contained in:
Adria Navarro 2023-11-21 13:29:43 +01:00 committed by GitHub
parent 2c0b026486 2be8940334
commit 09dbbf5ee3
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
3 changed files with 73 additions and 43 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
packages/server/src/api/controllers/static/index.ts
View File

@ -1,4 +1,4 @@
import { ValidFileExtensions } from "@budibase/shared-core" import { InvalidFileExtensions } from "@budibase/shared-core"
require("svelte/register") require("svelte/register")
@ -86,7 +86,10 @@ export const uploadFile = async function (
) )
} }
if (!env.SELF_HOSTED && !ValidFileExtensions.includes(extension)) { if (
!env.SELF_HOSTED &&
InvalidFileExtensions.includes(extension.toLowerCase())
) {
throw new BadRequestError( throw new BadRequestError(
`File "${file.name}" has an invalid extension: "${extension}"` `File "${file.name}" has an invalid extension: "${extension}"`
) )

11
packages/server/src/api/routes/tests/attachment.spec.ts
View File

@ -35,6 +35,17 @@ describe("/api/applications/:appId/sync", () => {
}) })
}) })
it("should reject an upload with a malicious uppercase file extension", async () => {
await config.withEnv({ SELF_HOSTED: undefined }, async () => {
let resp = (await config.api.attachment.process(
"OHNO.EXE",
Buffer.from([0]),
{ expectStatus: 400 }
)) as unknown as APIError
expect(resp.message).toContain("invalid extension")
})
})
it("should reject an upload with no file", async () => { it("should reject an upload with no file", async () => {
let resp = (await config.api.attachment.process( let resp = (await config.api.attachment.process(
undefined as any, undefined as any,

98
packages/shared-core/src/constants.ts
View File

@ -96,45 +96,61 @@ export enum BuilderSocketEvent {
export const SocketSessionTTL = 60 export const SocketSessionTTL = 60
export const ValidQueryNameRegex = /^[^()]*$/ export const ValidQueryNameRegex = /^[^()]*$/
export const ValidColumnNameRegex = /^[_a-zA-Z0-9\s]*$/g export const ValidColumnNameRegex = /^[_a-zA-Z0-9\s]*$/g
export const ValidFileExtensions = [
"avif", export const InvalidFileExtensions = [
"css", "7z",
"csv", "action",
"docx", "apk",
"drawio", "app",
"editorconfig", "bat",
"edl", "bin",
"enc", "cab",
"export", "cmd",
"geojson", "com",
"gif", "command",
"htm", "cpl",
"html", "csh",
"ics", "ex_",
"iqy", "exe",
"jfif", "gadget",
"jpeg", "inf1",
"jpg", "ins",
"json", "inx",
"log", "ipa",
"md", "isu",
"mid", "job",
"odt", "js",
"pdf", "jse",
"png", "ksh",
"ris", "lnk",
"rtf", "msc",
"svg", "msi",
"tex", "msp",
"toml", "mst",
"twig", "osx",
"txt", "out",
"url", "paf",
"wav", "php",
"webp", "pif",
"xls", "prg",
"xlsx", "ps1",
"xml", "reg",
"yaml", "rgs",
"yml", "run",
"scr",
"sct",
"shb",
"shs",
"tar",
"u3p",
"vb",
"vbe",
"vbs",
"vbscript",
"wasm",
"workflow",
"ws",
"wsf",
"wsh",
"zip",
] ]