@cosmicdrift/kumiko-framework 0.197.0 → 0.197.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-framework",
-  "version": "0.197.0",
+  "version": "0.197.1",
   "description": "Framework core — engine, pipeline, API, DB, and every other bit that makes Kumiko go.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -186,7 +186,7 @@
     "./package.json": "./package.json"
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-types": "0.197.0",
+    "@cosmicdrift/kumiko-types": "0.197.1",
     "bullmq": "^5.76.7",
     "bun-types": "^1.3.13",
     "hono": "^4.13.1",
@@ -202,7 +202,7 @@
     "zod": "^4.4.3"
   },
   "devDependencies": {
-    "@cosmicdrift/kumiko-dispatcher-live": "0.197.0",
+    "@cosmicdrift/kumiko-dispatcher-live": "0.197.1",
     "bun-types": "^1.3.13",
     "pino-pretty": "^13.1.3"
   },

package/src/derivatives/__tests__/derivatives-context.test.ts

@@ -171,4 +171,47 @@ describe("createDerivativesContext — variant()", () => {
     expect(provider.mimeTypeOf(result.storageKey)).toBe(result.mimeType);
     expect(result.mimeType).toBe("image/webp");
   });
+
+  // #2021 — a variant with no spec.format used to fall straight through to
+  // the source's mimeType, which is client-controlled (`file.type` off the
+  // upload). A field without `accept` plus a broad `image/*` renderer
+  // wildcard (like `setup()`'s here) let a client ride an active-content
+  // type like `image/svg+xml` all the way to the response Content-Type.
+  test("no spec.format + a non-allowlisted source mimeType does not take over that mimeType", async () => {
+    const { ctx, provider } = await setup("image/svg+xml");
+    const spec = {} as const;
+
+    const result = await ctx.variant(FILE_REF_ID, spec, "thumb");
+
+    expect(result.mimeType).not.toBe("image/svg+xml");
+    expect(result.mimeType).toBe("application/octet-stream");
+    expect(provider.mimeTypeOf(result.storageKey)).toBe("application/octet-stream");
+  });
+
+  test("no spec.format + a non-allowlisted source mimeType — a cache hit returns the same normalized value", async () => {
+    const { ctx } = await setup("image/svg+xml");
+    const spec = {} as const;
+
+    const first = await ctx.variant(FILE_REF_ID, spec, "thumb");
+    const second = await ctx.variant(FILE_REF_ID, spec, "thumb");
+
+    expect(first.mimeType).toBe("application/octet-stream");
+    expect(second.mimeType).toBe("application/octet-stream");
+  });
+
+  test("no spec.format keeps a known-safe source mimeType — resize-without-reformat stays intact", async () => {
+    const { ctx } = await setup("image/png");
+
+    const result = await ctx.variant(FILE_REF_ID, { maxEdge: 320 }, "thumb");
+
+    expect(result.mimeType).toBe("image/png");
+  });
+
+  test("no spec.format normalizes a `; charset=` suffix off the source mimeType instead of leaking it raw", async () => {
+    const { ctx } = await setup("image/jpeg; charset=binary");
+
+    const result = await ctx.variant(FILE_REF_ID, {}, "thumb");
+
+    expect(result.mimeType).toBe("image/jpeg");
+  });
 });

package/src/derivatives/__tests__/variant-route.integration.test.ts

@@ -27,7 +27,14 @@ const fakeRender: DerivativeRendererPlugin["render"] = async () => {
 const photoEntity = createEntity({
   table: "variant_route_photos",
   fields: {
-    avatar: createImageField({ variants: { thumb: { maxEdge: 100, format: "webp" } } }),
+    avatar: createImageField({
+      variants: {
+        thumb: { maxEdge: 100, format: "webp" },
+        // No format — resize-without-reformat, the legitimate reason
+        // spec.format can be omitted (see #2021).
+        raw: { maxEdge: 100 },
+      },
+    }),
   },
 });
 
@@ -207,4 +214,44 @@ describe("GET /api/files/:id/variant/:name", () => {
     expect(res.status).toBe(415);
     expect(await res.json()).toEqual({ error: "unsupported_media_type" });
   });
+
+  // #2021 — the "raw" variant has no `format`, so its mimeType comes from
+  // outputMimeType's fallback branch. `avatar` has no `accept`, so the
+  // source mimeType is exactly the client-controlled `file.type` from the
+  // upload — this proves the route no longer echoes it verbatim.
+  test("a variant with no spec.format never echoes a non-safe, client-controlled source mimeType", async () => {
+    const token = await stack.jwt.sign(user);
+    const fd = new FormData();
+    fd.append("file", new File([Buffer.from([1, 2, 3])], "avatar.svg", { type: "image/svg+xml" }));
+    fd.append("entityType", "photo");
+    fd.append("fieldName", "avatar");
+    const { body, contentType } = await buildMultipartBody(fd);
+    const uploadRes = await stack.app.request("/api/files", {
+      method: "POST",
+      headers: { Authorization: `Bearer ${token}`, "Content-Type": contentType },
+      body,
+    });
+    expect(uploadRes.status).toBe(201);
+    const { id: fileId } = (await uploadRes.json()) as { id: string };
+
+    const res = await stack.app.request(`/api/files/${fileId}/variant/raw`, {
+      headers: { Authorization: `Bearer ${token}` },
+    });
+
+    expect(res.status).toBe(200);
+    expect(res.headers.get("Content-Type")).not.toBe("image/svg+xml");
+    expect(res.headers.get("Content-Type")).toBe("application/octet-stream");
+  });
+
+  test("a variant with no spec.format keeps a known-safe source mimeType through the full route (resize without reformat)", async () => {
+    const fileId = await uploadFile();
+    const token = await stack.jwt.sign(user);
+
+    const res = await stack.app.request(`/api/files/${fileId}/variant/raw`, {
+      headers: { Authorization: `Bearer ${token}` },
+    });
+
+    expect(res.status).toBe(200);
+    expect(res.headers.get("Content-Type")).toBe("image/jpeg");
+  });
 });

package/src/derivatives/derivatives-context.ts

@@ -69,6 +69,23 @@ function isFileRefRow(row: Record<string, unknown>): row is FileRefRow {
   return typeof row["storageKey"] === "string" && typeof row["mimeType"] === "string";
 }
 
+// sourceMimeType is client-controlled (it's `file.type` off the upload — see
+// file-routes.ts's "a field without `accept` lets a client upload anything")
+// and, when spec.format is unset, a renderer is documented to preserve the
+// source's own format (DerivativeRendererPlugin's doc comment) — so the
+// bytes really are in this format, but the STRING itself must still be
+// allowlisted before it becomes a response Content-Type or storage-provider
+// metadata. Otherwise an app whose renderer wildcard is broad enough (e.g.
+// `image/*`) would let a client-declared `image/svg+xml` ride straight
+// through as an honestly-declared (non-sniffed) active-content type (#2021).
+const KNOWN_SAFE_VARIANT_MIME_TYPES: ReadonlySet<string> = new Set([
+  "image/jpeg",
+  "image/png",
+  "image/webp",
+  "image/avif",
+  "image/gif",
+]);
+
 // The spec — not the renderer — determines the output mimeType, so it's the
 // single source of truth for both what gets written to storage and what the
 // caller receives; a cache hit never runs the renderer, so there's nothing
@@ -81,8 +98,12 @@ function outputMimeType(spec: VariantSpec, sourceMimeType: string): string {
       return "image/avif";
     case "jpeg":
       return "image/jpeg";
-    default:
-      return sourceMimeType;
+    default: {
+      const normalized = normalizeMimeType(sourceMimeType);
+      return KNOWN_SAFE_VARIANT_MIME_TYPES.has(normalized)
+        ? normalized
+        : "application/octet-stream";
+    }
   }
 }