From 79dcc468b899a9caf922f74ef17316315ea6592f Mon Sep 17 00:00:00 2001 From: Sam Rose Date: Tue, 21 Nov 2023 10:42:44 +0000 Subject: [PATCH] Add a test for uppercase malicious extensions. --- .../server/src/api/routes/tests/attachment.spec.ts | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/packages/server/src/api/routes/tests/attachment.spec.ts b/packages/server/src/api/routes/tests/attachment.spec.ts index 14d2e845f6..e230b0688a 100644 --- a/packages/server/src/api/routes/tests/attachment.spec.ts +++ b/packages/server/src/api/routes/tests/attachment.spec.ts @@ -35,6 +35,17 @@ describe("/api/applications/:appId/sync", () => { }) }) + it("should reject an upload with a malicious uppercase file extension", async () => { + await config.withEnv({ SELF_HOSTED: undefined }, async () => { + let resp = (await config.api.attachment.process( + "OHNO.EXE", + Buffer.from([0]), + { expectStatus: 400 } + )) as unknown as APIError + expect(resp.message).toContain("invalid extension") + }) + }) + it("should reject an upload with no file", async () => { let resp = (await config.api.attachment.process( undefined as any,