Derived file upload content type from extension instead of client

[kevinansfield]

The /files/upload endpoint now determines the MIME type from the
file extension server-side rather than trusting the client-provided
value, preventing content type spoofing on S3/GCS storage backends.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 3e8ea202-68e8-4c0d-b044-ca7eb68ee643

📥 Commits

Reviewing files that changed from the base of the PR and between 292bdc3 and 6da0e97.

📒 Files selected for processing (2)

• ghost/core/core/server/api/endpoints/files.js
• ghost/core/test/e2e-api/admin/files.test.js

---

Walkthrough

The pull request modifies how file MIME types are determined when uploading files. The implementation change in files.js replaces reliance on client-provided MIME types with filename-based detection using the mime-types library, falling back to application/octet-stream if detection fails. A corresponding end-to-end test is added to verify that files uploaded with incorrect MIME types have their content type correctly derived from the file extension instead.

🚥 Pre-merge checks | ✅ 3

✅ Passed checks (3 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly and specifically describes the main change: deriving file upload content type from extension instead of trusting the client-provided value.
Description check	✅ Passed	The description is directly related to the changeset, explaining the security rationale for determining MIME type server-side from file extensions instead of client-provided values.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

• 📝 Generate docstrings (stacked PR)
• 📝 Generate docstrings (commit on current branch)

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Post copyable unit tests in a comment
• Commit unit tests in branch file-upload-content-type

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}