CodeMirror/budibase
1
0
Fork 0
mirror of synced 2024-10-02 10:08:09 +13:00
Code Issues Projects Releases Wiki Activity

Move from an allow list to a block list of file extensions.

Browse source
This commit is contained in:
Sam Rose 2023-11-21 10:40:25 +00:00
parent 0d32ab77ae
commit b4cb97963c
No known key found for this signature in database
2 changed files with 56 additions and 43 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

7
packages/server/src/api/controllers/static/index.ts
View file

@ -1,4 +1,4 @@
import { ValidFileExtensions } from "@budibase/shared-core" import { InvalidFileExtensions } from "@budibase/shared-core"
require("svelte/register") require("svelte/register")
@ -86,7 +86,10 @@ export const uploadFile = async function (
) )
} }
if (!env.SELF_HOSTED && !ValidFileExtensions.includes(extension)) { if (
!env.SELF_HOSTED &&
InvalidFileExtensions.includes(extension.toLowerCase())
) {
throw new BadRequestError( throw new BadRequestError(
`File "${file.name}" has an invalid extension: "${extension}"` `File "${file.name}" has an invalid extension: "${extension}"`
) )

92
packages/shared-core/src/constants.ts
View file

@ -96,45 +96,55 @@ export enum BuilderSocketEvent {
export const SocketSessionTTL = 60 export const SocketSessionTTL = 60
export const ValidQueryNameRegex = /^[^()]*$/ export const ValidQueryNameRegex = /^[^()]*$/
export const ValidColumnNameRegex = /^[_a-zA-Z0-9\s]*$/g export const ValidColumnNameRegex = /^[_a-zA-Z0-9\s]*$/g
export const ValidFileExtensions = [
"avif", export const InvalidFileExtensions = [
"css", "action",
"csv", "apk",
"docx", "app",
"drawio", "bat",
"editorconfig", "bin",
"edl", "cab",
"enc", "cmd",
"export", "com",
"geojson", "command",
"gif", "cpl",
"htm", "csh",
"html", "ex_",
"ics", "exe",
"iqy", "gadget",
"jfif", "inf1",
"jpeg", "ins",
"jpg", "inx",
"json", "ipa",
"log", "isu",
"md", "job",
"mid", "jse",
"odt", "ksh",
"pdf", "lnk",
"png", "msc",
"ris", "msi",
"rtf", "msp",
"svg", "mst",
"tex", "osx",
"toml", "out",
"twig", "paf",
"txt", "pif",
"url", "prg",
"wav", "ps1",
"webp", "reg",
"xls", "rgs",
"xlsx", "run",
"xml", "scr",
"yaml", "sct",
"yml", "shb",
"shs",
"u3p",
"vb",
"vbe",
"vbs",
"vbscript",
"workflow",
"ws",
"wsf",
"wsh",
] ]