processing / processing/p5.js-web-editor

File Type Restriction Bypass via Rename

Open
#4,102 3 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Awaiting Maintainer Approval Bug
Dominant language
JavaScript
Stars
1.7k
Forks
1.7k
Avg merge
3d 4h
Merged PRs (30d)
8

Description

p5.js version

No response

What is your operating system?

None

Web browser and version

No response

Actual Behavior

User attempts to create a new file with a .obj extension (e.g., demo.obj) in the p5.js web editor
The editor correctly blocks the creation and displays an error:
"Invalid file type. Valid extensions are .js, .css, .json, .xml, .stl, .txt, .csv, .tsv, .mtl, .frag, and .vert."
User creates a file with a valid extension (e.g., demo.js) — this succeeds
User then renames demo.js to demo.obj
The editor allows the rename without any validation, successfully creating a .obj file — bypassing the restriction entirely

Image
Expected Behavior

When a user attempts to rename a file to an invalid extension (e.g., .obj), the editor should trigger the same validation as it does during file creation
The rename action should be blocked and display the same error message:
"Invalid file type. Valid extensions are .js, .css, .json, .xml, .stl, .txt, .csv, .tsv, .mtl, .frag, and .vert."
The filename should revert back to its previous valid name
File type restrictions should be consistently enforced across all entry points — both creation and rename — so there is no way to bypass the whitelist

Steps to reproduce
Steps:

Step 1: Open the p5.js web editor and log in to your account

Step 2: In the Sketch Files panel on the left side, click the "+" button to create a new file

Step 3: In the "Create File" dialog, type demo.obj and click "Add File"

✅ Confirm that the editor blocks this and shows the error:
"Invalid file type. Valid extensions are .js, .css, .json, .xml, .stl, .txt, .csv, .tsv, .mtl, .frag, and .vert."

Step 4: Again click the "+" button and this time type demo.txt and click "Add File"

✅ Confirm that the file demo.txt is created successfully and appears in the Sketch Files panel

Step 5: In the Sketch Files panel, double-click on demo.txt to rename it

Step 6: Clear the filename and type demo.obj, then press Enter to confirm the rename


// Paste your code here :)

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Reproduce the issue in the p5.js web editor through the Sketch Files panel, comparing the Create File flow with the double-click rename entry point. Trace where the invalid-extension error is enforced during creation and where rename is confirmed. Done means renaming to an unsupported extension is blocked, the existing valid name is restored, and the same error message is shown.

Written by the indexing model from the issue text.

Assessment

Tech stack
javascript
Domain
frontend
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Quiet
Clarity
Clearly specified
Newbie friendliness
58/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.