-
-
Notifications
You must be signed in to change notification settings - Fork 4.8k
fix: Add problematic MIME types to default value of Parse Server option fileUpload.fileExtensions
#9902
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
fix: Add problematic MIME types to default value of Parse Server option fileUpload.fileExtensions
#9902
Conversation
|
🚀 Thanks for opening this pull request! |
📝 WalkthroughWalkthroughUpdated the default regex pattern for file upload extension filtering across configuration and documentation files. The pattern changed from Changes
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes
Pre-merge checks and finishing touches✅ Passed checks (2 passed)
✨ Finishing touches
🧪 Generate unit tests (beta)
📜 Recent review detailsConfiguration used: CodeRabbit UI Review profile: CHILL Plan: Pro 📒 Files selected for processing (3)
🧰 Additional context used🧬 Code graph analysis (1)src/Options/Definitions.js (1)
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (13)
🔇 Additional comments (3)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
✅ Snyk checks have passed. No issues have been found so far.
💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse. |
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## alpha #9902 +/- ##
=======================================
Coverage 92.99% 92.99%
=======================================
Files 187 187
Lines 15177 15177
Branches 177 177
=======================================
Hits 14114 14114
Misses 1051 1051
Partials 12 12 ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
## [8.3.1-alpha.1](8.3.0...8.3.1-alpha.1) (2025-11-05) ### Bug Fixes * Add problematic MIME types to default value of Parse Server option `fileUpload.fileExtensions` ([#9902](#9902)) ([fa245cb](fa245cb))
|
🎉 This change has been released in version 8.3.1-alpha.1 |
# [8.4.0](8.3.0...8.4.0) (2025-11-05) ### Bug Fixes * Add problematic MIME types to default value of Parse Server option `fileUpload.fileExtensions` ([#9902](#9902)) ([fa245cb](fa245cb)) * Uploading a file by providing an origin URL allows for Server-Side Request Forgery (SSRF); fixes vulnerability [GHSA-x4qj-2f4q-r4rx](GHSA-x4qj-2f4q-r4rx) ([#9903](#9903)) ([9776386](9776386)) ### Features * Add support for Node 24 ([#9901](#9901)) ([25dfe19](25dfe19))
|
🎉 This change has been released in version 8.4.0 |
Pull Request
Issue
The fix to address GHSA-9prm-jqwx-45x9 was to add a new Parse Server option
fileUpload.fileExtensionsto restrict file upload of specific file extensions. A specific concern were HTML file extensions.A quick research shows that the following MIME types are currently mapped to
text/html:The current default value for
fileUpload.fileExtensionsis^(?!(h|H)(t|T)(m|M)(l|L)?$)which doesn't includexhtmlandshtml.Thanks to @luryus for bringing this to our attention.
Approach
Add
xhtmlandshtmlto the default value. The new default value would be^(?![xXsS]?[hH][tT][mM][lL]?$).Summary by CodeRabbit