RocketChat / RocketChat/Rocket.Chat
Accepted media type image allows files with .jpg extension to be uploaded even if contents are not an image
Open
Nobody has claimed this yet.
planned
- Dominant language
- TypeScript
- Stars
- 46.1k
- Forks
- 13.9k
- Avg merge
- 3d 3h
- Merged PRs (30d)
- 130
Description
Description:
Accepted Media Types filter on file uploads set to image/* incorrectly accepts files that are not images but have .jpg extension
Steps to reproduce:
- Settings > File Upload > Accepted Media Types: images/*
- Upload an actual_image.jpg file goes through
- Upload random.cer file Media Type Not Accepted Application/pkix-cert
- Rename random.cer to random.jpg file goes through
Expected behavior:
random.jpg should not be uploaded
Server Setup Information:
- Version of Rocket.Chat Server: 1.0.3
- Operating System: RHEL 7.2 (reports as 4.15.0-1035-aws)
- Deployment Method: docker
- Number of Running Instances: 3
- DB Replicaset Oplog:
- NodeJS Version: 8.11.4
- MongoDB Version: 3.6.12
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start at the File Upload settings and trace the accepted media type validation used during uploads. Reproduce the case with an actual image and a certificate renamed to .jpg; done means image/* accepts real images while rejecting files whose contents are not images.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- typescript
- Domain
- backend, security
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 38/100