@openparachute/vault 0.6.4-rc.14 → 0.6.4-rc.15

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openparachute/vault",
-  "version": "0.6.4-rc.14",
+  "version": "0.6.4-rc.15",
   "description": "Agent-native knowledge graph. Notes, tags, links over MCP.",
   "module": "src/cli.ts",
   "type": "module",

package/src/routes.ts

@@ -2908,32 +2908,96 @@ async function handleRetryLegacyInBody(
 
 const MAX_UPLOAD_BYTES = 100 * 1024 * 1024; // 100MB
 
-// Storage allowlist policy:
-//   - audio + image + .pdf (knowledge-vault content: papers, scans, receipts)
-//     + .mp4 (mobile capture default; iOS records mp4, not webm).
-//   - .svg and .html are deliberately excluded — both can embed `<script>`
-//     tags, which would turn an upload into a same-origin XSS vector when
-//     the asset is served back from /storage/. If a future use case needs
-//     SVG, sanitize on read (strip <script>/<foreignObject>) and revisit.
-const ALLOWED_EXTENSIONS = new Set([
-  ".wav", ".mp3", ".m4a", ".ogg", ".webm",
-  ".png", ".jpg", ".jpeg", ".gif", ".webp",
-  ".pdf", ".mp4",
+// Storage upload policy: DENY-LIST (vault#517). A knowledge vault stores
+// arbitrary files — ebooks, office docs, datasets, archives, binaries — so we
+// accept ANY upload EXCEPT the handful of types a browser can execute as
+// active content in our origin when served back from /storage/. (The prior
+// allowlist rejected the long tail: .epub/.csv/.zip/… all came back "File type
+// not allowed".)
+//
+// BLOCKED — same-origin-XSS / active-content set:
+//   .html/.htm/.xhtml/.shtml/.xht  HTML — embeds <script>
+//   .svg                           XML image — embeds <script>
+//   .xml                           can carry XSLT / be parsed as XHTML
+//   .js/.mjs/.cjs                  JavaScript
+//   .css                           style-injection / UI-redress vector
+//
+// Two independent guards keep every STORED file inert when served:
+//   1. Only the curated MIME_TYPES below map to a real (always passive) type;
+//      every other extension serves as application/octet-stream — a download,
+//      never rendered.
+//   2. The GET byte-serve response pins `X-Content-Type-Options: nosniff`, so
+//      a browser can't sniff an octet-stream body into an executable type.
+// The blocklist is belt-and-suspenders on top of those: even if a future MIME
+// entry or an upstream proxy weakened (1) or (2), these extensions still never
+// land on disk. If a future use case needs SVG, sanitize on read (strip
+// <script>/<foreignObject>) and revisit.
+const BLOCKED_EXTENSIONS = new Set([
+  ".html", ".htm", ".xhtml", ".shtml", ".xht",
+  ".svg",
+  ".xml",
+  ".js", ".mjs", ".cjs",
+  ".css",
 ]);
 
+// Explicit MIME types for the commonly-previewed formats. Anything accepted
+// but absent here serves as application/octet-stream — a download, never
+// rendered (e.g. .pages/.key/.numbers/.azw3/.exe/arbitrary binaries). None of
+// these map to an active type (text/html, image/svg+xml), so a served asset
+// can't execute script; `nosniff` on the GET response makes that ironclad.
+//
+// INVARIANT: never add an entry that maps to a browser-active type —
+// text/html, image/svg+xml, application/xhtml+xml, text/javascript,
+// application/wasm, text/css. Doing so re-enables same-origin execution for
+// that extension (and would mean it must also join BLOCKED_EXTENSIONS).
 const MIME_TYPES: Record<string, string> = {
+  // Audio
   ".wav": "audio/wav",
   ".mp3": "audio/mpeg",
   ".m4a": "audio/mp4",
   ".ogg": "audio/ogg",
+  ".oga": "audio/ogg",
+  ".opus": "audio/opus",
+  ".aac": "audio/aac",
+  ".flac": "audio/flac",
   ".webm": "audio/webm",
+  // Image
   ".png": "image/png",
   ".jpg": "image/jpeg",
   ".jpeg": "image/jpeg",
   ".gif": "image/gif",
   ".webp": "image/webp",
-  ".pdf": "application/pdf",
+  ".bmp": "image/bmp",
+  ".tiff": "image/tiff",
+  ".tif": "image/tiff",
+  ".heic": "image/heic",
+  ".heif": "image/heif",
+  ".avif": "image/avif",
+  // Video
   ".mp4": "video/mp4",
+  ".m4v": "video/x-m4v",
+  ".mov": "video/quicktime",
+  // Documents / ebooks / data
+  ".pdf": "application/pdf",
+  ".epub": "application/epub+zip",
+  ".mobi": "application/x-mobipocket-ebook",
+  ".txt": "text/plain; charset=utf-8",
+  ".md": "text/markdown; charset=utf-8",
+  ".markdown": "text/markdown; charset=utf-8",
+  ".rtf": "application/rtf",
+  ".csv": "text/csv; charset=utf-8",
+  ".tsv": "text/tab-separated-values; charset=utf-8",
+  ".json": "application/json; charset=utf-8",
+  ".doc": "application/msword",
+  ".docx": "application/vnd.openxmlformats-officedocument.wordprocessingml.document",
+  ".ppt": "application/vnd.ms-powerpoint",
+  ".pptx": "application/vnd.openxmlformats-officedocument.presentationml.presentation",
+  ".xls": "application/vnd.ms-excel",
+  ".xlsx": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet",
+  ".odt": "application/vnd.oasis.opendocument.text",
+  ".ods": "application/vnd.oasis.opendocument.spreadsheet",
+  ".odp": "application/vnd.oasis.opendocument.presentation",
+  ".zip": "application/zip",
 };
 
 export async function handleStorage(
@@ -2954,9 +3018,17 @@ export async function handleStorage(
     if (file.size > MAX_UPLOAD_BYTES) {
       return json({ error: `File too large (${Math.round(file.size / 1024 / 1024)}MB). Max: 100MB` }, 413);
     }
-    const ext = extname(file.name).toLowerCase();
-    if (!ALLOWED_EXTENSIONS.has(ext)) {
-      return json({ error: `File type ${ext} not allowed` }, 400);
+    // Strip trailing dots/whitespace before extracting the extension so a
+    // `evil.html.` / `evil.svg ` can't slip past the blocklist
+    // (extname("evil.html.") === "."). The blocklist is belt-and-suspenders;
+    // anything that still gets through serves as octet-stream + nosniff anyway.
+    const ext = extname(file.name.replace(/[.\s]+$/, "")).toLowerCase();
+    if (BLOCKED_EXTENSIONS.has(ext)) {
+      // Active-content types only — blocked because they execute as script when
+      // served same-origin from /storage/ (see BLOCKED_EXTENSIONS). Everything
+      // else (incl. unknown/arbitrary files) is accepted and served as a
+      // download (octet-stream + nosniff).
+      return json({ error: `File type ${ext} not allowed (active/executable content)` }, 400);
     }
 
     const date = new Date().toISOString().split("T")[0]!;
@@ -3057,6 +3129,12 @@ export async function handleStorage(
       headers: {
         "Content-Type": contentType,
         "Content-Length": String(stat.size),
+        // Defense-in-depth: never let a browser MIME-sniff a stored asset into
+        // an active type (e.g. an octet-stream body sniffed as text/html).
+        // Combined with the upload blocklist (no .svg/.html) this closes the
+        // same-origin XSS surface for served attachments. Mirrors routing.ts's
+        // SPA-asset stance.
+        "X-Content-Type-Options": "nosniff",
       },
     });
   }

package/src/storage.test.ts

@@ -1,10 +1,16 @@
 /**
- * Storage upload allowlist tests (issue #127).
+ * Storage upload policy tests (issue #127 origin; vault#517 deny-list).
  *
- * The allowlist guards `POST /api/storage/upload` against turning user
- * uploads into XSS vectors when the asset is later served back from
- * `/storage/`. We pin both the accepted set and the deliberate exclusions
- * so a future widening doesn't quietly let SVG/HTML in.
+ * `POST /api/storage/upload` accepts ANY file EXCEPT the active-content set a
+ * browser can execute when the asset is served back same-origin from
+ * `/storage/` (.svg/.html/.htm/.xhtml/.xml/.js/.mjs/.cjs/.css). A knowledge
+ * vault stores arbitrary files — ebooks, office docs, datasets, archives,
+ * binaries — so the long tail (.epub/.csv/.zip/.exe/…) is accepted, not
+ * rejected. We pin the accepted breadth AND the deliberate blocklist so a
+ * future edit can't quietly let SVG/HTML in (or quietly start rejecting docs).
+ * Two guards keep served files inert: every non-curated type serves as
+ * application/octet-stream, and the GET serve path pins
+ * `X-Content-Type-Options: nosniff`.
  */
 
 import { describe, test, expect, beforeAll, afterAll } from "bun:test";
@@ -91,6 +97,43 @@ describe("storage upload allowlist", () => {
     }
   });
 
+  test("accepts .epub — the reported gap (ebooks are knowledge content)", async () => {
+    const res = await handleStorage(uploadRequest("book.epub", "application/epub+zip"), "/upload", "default", uploadStore);
+    expect(res.status).toBe(201);
+    const body = (await res.json()) as { mimeType: string; path: string };
+    expect(body.mimeType).toBe("application/epub+zip");
+    expect(body.path).toMatch(/\.epub$/);
+  });
+
+  test("accepts common document / text / data / archive types", async () => {
+    for (const [name, mime, expected] of [
+      ["notes.txt", "text/plain", "text/plain; charset=utf-8"],
+      ["readme.md", "text/markdown", "text/markdown; charset=utf-8"],
+      ["data.csv", "text/csv", "text/csv; charset=utf-8"],
+      ["data.json", "application/json", "application/json; charset=utf-8"],
+      ["doc.docx", "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "application/vnd.openxmlformats-officedocument.wordprocessingml.document"],
+      ["archive.zip", "application/zip", "application/zip"],
+      ["clip.mov", "video/quicktime", "video/quicktime"],
+      ["photo.heic", "image/heic", "image/heic"],
+    ] as const) {
+      const res = await handleStorage(uploadRequest(name, mime), "/upload", "default", uploadStore);
+      expect(res.status).toBe(201);
+      const body = (await res.json()) as { mimeType: string };
+      expect(body.mimeType).toBe(expected);
+    }
+  });
+
+  test("accepts arbitrary / unknown files — served as octet-stream (download), never run", async () => {
+    // Deny-list policy (vault#517): anything not in the active-content blocklist
+    // is accepted. Unknown/no-MIME extensions serve as octet-stream — a download.
+    for (const name of ["deck.pages", "tool.exe", "data.bin", "Makefile", "archive.tar.gz"] as const) {
+      const res = await handleStorage(uploadRequest(name, "application/octet-stream"), "/upload", "default", uploadStore);
+      expect(res.status).toBe(201);
+      const body = (await res.json()) as { mimeType: string };
+      expect(body.mimeType).toBe("application/octet-stream");
+    }
+  });
+
   test("rejects .svg — XSS vector via inline <script> (#127)", async () => {
     const res = await handleStorage(uploadRequest("evil.svg", "image/svg+xml"), "/upload", "default", uploadStore);
     expect(res.status).toBe(400);
@@ -105,9 +148,31 @@ describe("storage upload allowlist", () => {
     expect(body.error).toContain(".html");
   });
 
-  test("rejects unknown extensions (default-deny)", async () => {
-    const res = await handleStorage(uploadRequest("payload.exe", "application/octet-stream"), "/upload", "default", uploadStore);
-    expect(res.status).toBe(400);
+  test("rejects the active-content set (.js/.mjs/.cjs/.xhtml/.htm/.xml/.css/.shtml)", async () => {
+    for (const [name, mime] of [
+      ["script.js", "text/javascript"],
+      ["mod.mjs", "text/javascript"],
+      ["mod.cjs", "text/javascript"],
+      ["page.xhtml", "application/xhtml+xml"],
+      ["page.xht", "application/xhtml+xml"],
+      ["page.htm", "text/html"],
+      ["page.shtml", "text/html"],
+      ["feed.xml", "application/xml"],
+      ["style.css", "text/css"],
+    ] as const) {
+      const res = await handleStorage(uploadRequest(name, mime), "/upload", "default", uploadStore);
+      expect(res.status).toBe(400);
+      const body = (await res.json()) as { error: string };
+      expect(body.error).toContain("not allowed");
+    }
+  });
+
+  test("trailing-dot / trailing-space can't slip a blocked type past the guard", async () => {
+    // extname("evil.html.") === "." — normalize the trailing run first.
+    for (const name of ["evil.html.", "evil.svg ", "evil.js."] as const) {
+      const res = await handleStorage(uploadRequest(name, "text/plain"), "/upload", "default", uploadStore);
+      expect(res.status).toBe(400);
+    }
   });
 });
 
@@ -166,6 +231,8 @@ describe("storage GET tag-scope enforcement", () => {
     const res = await handleStorage(getReq(inScopePath), `/${inScopePath}`, VAULT, store, ctx);
     expect(res.status).toBe(200);
     expect(res.headers.get("Content-Type")).toBe("application/pdf");
+    // Served bytes pin nosniff so a browser can't sniff them into an active type.
+    expect(res.headers.get("X-Content-Type-Options")).toBe("nosniff");
     expect((await res.arrayBuffer()).byteLength).toBe(4);
   });