ngf-pattern too permissive if pattern ends in an exclude

[mpolichette]

Hey there friends,

I ran into an issue while maintaining some old software. I was trying to set a ngf-pattern which was being overly inclusive.

My pattern was ngf-pattern="image/*,!.tif,!.tiff" but it was still allowing a .pdf to be selected. Upon debugging I found the issue is that the globStringToRegex function was compiling my include regex to (^image\/.*$)|/i. The important part is that it ends with a |. This is being overly inclusive.

The issue lies here: https://github.com/danialfarid/ng-file-upload/blob/master/src/validate.js#L16
The code eagerly is appending | when there are left over glob parts to parse, but doesn't account for it if the rest of the parts are excludes.

A simple fix for now is to make sure the last pattern is an include E.G. ngf-pattern="!.tif,!.tiff,image/*" However, even in the README an exclude is placed last:

ngf-pattern="'.pdf,.jpg,video/*,!.jog'" // comma separated wildcard to filter file names and types allowed
              // you can exclude specific files by ! at the beginning.
              // validate error name: pattern

[ghost]

I think you are missing the single quotations. So it should be

ngf-pattern="'image/*,!.tif,!.tiff'"

[mpolichette]

Hey bonniekao, sorry for the slow response. Thank you for your suggestion, but I have done some pretty thorough debugging at this point and have even specified the location of the bug.

I have implemented the simple fix I stated above, which is to end with an include statement and it works. However, I think other people will be surprised by this behavior.