External/SnapOtter
1
0
Fork 0
mirror of https://github.com/snapotter-hq/SnapOtter.git synced 2026-08-03 07:46:42 +02:00
Code Issues Packages Projects Releases Wiki Activity

fix: file library upload accepts all file types, not just images

Browse Source 
The upload endpoint was rejecting non-image files via validateImageBuffer.
Now non-image files skip validation and use the MIME type from the
multipart upload. Width/height are null for non-image files.
This commit is contained in:
SnapOtter
2026-06-14 23:11:38 +08:00
parent f4061fe4b0
commit 6bcee1e073
1 changed files with 9 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files
apps/api/src/routes/user-files.ts
+9 -11
View File
@@ -250,16 +250,12 @@ export async function userFileRoutes(app: FastifyInstance): Promise<void> {
if (buffer.length === 0) continue;
// Validate image
const validation = await validateImageBuffer(buffer, part.filename);
if (!validation.valid) {
return reply.status(400).send({
error: `Invalid file "${part.filename}": ${validation.reason}`,
});
}
// Try image validation; non-image files skip validation and use MIME from extension
const validation = await validateImageBuffer(buffer, part.filename).catch(() => null);
const isValidImage = validation?.valid === true;
// Sanitize SVG uploads to prevent XXE, SSRF, and script injection
const safeBuffer = isSvgBuffer(buffer) ? sanitizeSvg(buffer) : buffer;
const safeBuffer = isValidImage && isSvgBuffer(buffer) ? sanitizeSvg(buffer) : buffer;
// Re-check quota with actual file size before persisting
try {
@@ -270,7 +266,9 @@ export async function userFileRoutes(app: FastifyInstance): Promise<void> {
}
const safeName = sanitizeFilename(part.filename ?? "upload");
const mimeType = formatToMime(validation.format);
const mimeType = isValidImage
? formatToMime(validation.format)
: part.mimetype || "application/octet-stream";
// Persist to disk
const storedName = await saveFile(safeBuffer, safeName);
@@ -286,8 +284,8 @@ export async function userFileRoutes(app: FastifyInstance): Promise<void> {
storedName,
mimeType,
size: fileSize,
width: validation.width,
height: validation.height,
width: isValidImage ? validation.width : null,
height: isValidImage ? validation.height : null,
version: 1,
parentId: null,
toolChain: null,