fix(uploads): security fix

polonel · Jun 20, 2021 · 25c5ae4 · 25c5ae4
1 parent caaec12
commit 25c5ae4
Showing 1 changed file with 13 additions and 1 deletion.
diff --git a/src/controllers/tickets.js b/src/controllers/tickets.js
@@ -637,7 +637,7 @@ ticketsController.uploadAttachment = function (req, res) {
 
     if (
       mimetype.indexOf('image/') === -1 &&
-      mimetype.indexOf('text/') === -1 &&
+      mimetype.indexOf('text/plain') === -1 &&
       mimetype.indexOf('audio/mpeg') === -1 &&
       mimetype.indexOf('audio/mp3') === -1 &&
       mimetype.indexOf('audio/wav') === -1 &&
@@ -660,6 +660,18 @@ ticketsController.uploadAttachment = function (req, res) {
     var savePath = path.join(__dirname, '../../public/uploads/tickets', object.ticketId)
     var sanitizedFilename = filename.replace(/[^a-z0-9.]/gi, '_').toLowerCase()
 
+    var ext = path.extname(sanitizedFilename)
+    var badExts = ['.html', '.htm', '.js']
+
+    if (badExts.includes(ext)) {
+      error = {
+        status: 400,
+        message: 'Invalid File Type'
+      }
+
+      return file.resume()
+    }
+
     if (!fs.existsSync(savePath)) fs.ensureDirSync(savePath)
 
     object.filePath = path.join(savePath, 'attachment_' + sanitizedFilename)