joe/kami-parse-server
Public Access
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: Server crash when uploading file without extension; fixes security vulnerability [GHSA-792q-q67h-w579](https://github.com/parse-community/parse-server/security/advisories/GHSA-792q-q67h-w579) (#8781)

Browse Source
This commit is contained in:
Manuel
2023-10-21 01:01:35 +02:00
committed by GitHub
parent 3602ecb169
commit fd86278919
2 changed files with 30 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

28
spec/ParseFile.spec.js
View File

@@ -1364,6 +1364,34 @@ describe('Parse.File testing', () => {
); );
}); });
it('allows file without extension', async () => {
await reconfigureServer({
fileUpload: {
enableForPublic: true,
fileExtensions: ['^[^hH][^tT][^mM][^lL]?$'],
},
});
const headers = {
'X-Parse-Application-Id': 'test',
'X-Parse-REST-API-Key': 'rest',
};
const values = ['filenamewithoutextension'];
for (const value of values) {
await expectAsync(
request({
method: 'POST',
headers: headers,
url: `http://localhost:8378/1/files/${value}`,
body: '<html></html>\n',
}).catch(e => {
throw new Error(e.data.error);
})
).toBeResolved();
}
});
it('works with array', async () => { it('works with array', async () => {
await reconfigureServer({ await reconfigureServer({
fileUpload: { fileUpload: {

4
src/Routers/FilesRouter.js
View File

@@ -159,9 +159,9 @@ export class FilesRouter {
} else if (contentType && contentType.includes('/')) { } else if (contentType && contentType.includes('/')) {
extension = contentType.split('/')[1]; extension = contentType.split('/')[1];
} }
extension = extension.split(' ').join(''); extension = extension?.split(' ')?.join('');
if (!isValidExtension(extension)) { if (extension && !isValidExtension(extension)) {
next( next(
new Parse.Error( new Parse.Error(
Parse.Error.FILE_SAVE_ERROR, Parse.Error.FILE_SAVE_ERROR,