refactor: Server crash when uploading file without extension; fixes security vulnerability [GHSA-792q-q67h-w579](https://github.com/parse-community/parse-server/security/advisories/GHSA-792q-q67h-w579) (#8779)

2023-10-21 01:03:02 +02:00
parent 5dd3aa0d48
commit fe02d3e8aa
2 changed files with 30 additions and 2 deletions
--- a/src/Routers/FilesRouter.js
+++ b/src/Routers/FilesRouter.js
@@ -159,9 +159,9 @@ export class FilesRouter {
      } else if (contentType && contentType.includes('/')) {
        extension = contentType.split('/')[1];
      }
-      extension = extension.split(' ').join('');
+      extension = extension?.split(' ')?.join('');

-      if (!isValidExtension(extension)) {
+      if (extension && !isValidExtension(extension)) {
        next(
          new Parse.Error(
            Parse.Error.FILE_SAVE_ERROR,