@solidxai/core 0.1.13-beta.20 → 0.1.13-beta.21

package/src/helpers/field-crud-managers/MediaFieldCrudManager.ts

@@ -12,6 +12,7 @@ export interface MediaFieldOptions {
     fieldName: string | undefined | null;
     mediaMaxSizeKb: number | undefined | null;
     mediaTypes: string[];
+    mediaAllowedExtensions?: string[] | null;
     isUpdate: boolean | undefined | null;
 }
 
@@ -86,24 +87,28 @@ export class MediaFieldCrudManager implements FieldCrudManager {
             return null;
         }
 
+        // Extension is authoritative: a declared mimetype is fully attacker-controlled and
+        // proved insufficient on its own (a .msi uploaded as image/png previously resolved to
+        // 'image', since the mimetype match short-circuited before the extension was ever
+        // checked). The extension must independently resolve to a known-safe category before
+        // anything is accepted - not merely "not on the denylist".
         const ext = getLowercaseFileExtension(getUploadedFileName(file));
-        const mt = (file.mimetype || '').toLowerCase().trim();
-        if (mt && MIME_TO_MEDIA_TYPE[mt]) {
-            return MIME_TO_MEDIA_TYPE[mt];
+        const extType = ext ? EXT_TO_MEDIA_TYPE[ext] : undefined;
+        if (!extType) {
+            return null;
         }
 
-        // Some libs may send "image/*" etc. Treat broad families safely.
-        if (mt.startsWith('image/')) return 'image';
-        if (mt.startsWith('audio/')) return 'audio';
-        if (mt.startsWith('video/')) return 'video';
-
-        // Fallback to extension if provided (also covers generic/unrecognized
-        // mimetypes such as application/octet-stream).
-        if (ext && EXT_TO_MEDIA_TYPE[ext]) {
-            return EXT_TO_MEDIA_TYPE[ext];
+        // The mimetype may only confirm or veto what the extension already established, never
+        // grant a category on its own. A mimetype that doesn't resolve to anything (e.g.
+        // application/octet-stream) has no opinion and is treated as agreeing.
+        const mt = (file.mimetype || '').toLowerCase().trim();
+        const mimeType = MIME_TO_MEDIA_TYPE[mt]
+            ?? (mt.startsWith('image/') ? 'image' : mt.startsWith('audio/') ? 'audio' : mt.startsWith('video/') ? 'video' : undefined);
+        if (mimeType && mimeType !== extType) {
+            return null;
         }
 
-        return null;
+        return extType;
     }
 
     validate(dto: any, files: Array<Express.Multer.File>): ValidationError[] {
@@ -112,18 +117,17 @@ export class MediaFieldCrudManager implements FieldCrudManager {
     }
 
     private applyValidations(fieldFiles: Array<Express.Multer.File>): ValidationError[] {
-        // Runs for every media field type and regardless of the admin-configured mediaTypes
-        // allowlist - a dangerous upload is never acceptable, so this must not sit behind
-        // the optional type checks below.
-        const errors = this.validateDangerousFiles(fieldFiles);
+        // A dangerous upload is never acceptable, regardless of admin config, so this is the
+        // only check that sits outside validateCommon() and can't be skipped either way below.
+        const dangerousFileErrors = this.validateDangerousFiles(fieldFiles);
 
         switch (this.options.type) {
             case SolidMediaType.mediaSingle:
-                return [...errors, ...this.validateMediaSingle(fieldFiles)];
+                return [...dangerousFileErrors, ...this.validateMediaSingle(fieldFiles)];
             case SolidMediaType.mediaMultiple:
-                return [...errors, ...this.validateMediaMultiple(fieldFiles)];
+                return [...dangerousFileErrors, ...this.validateMediaMultiple(fieldFiles)];
             default:
-                return errors;
+                return dangerousFileErrors;
         }
     }
 
@@ -137,7 +141,18 @@ export class MediaFieldCrudManager implements FieldCrudManager {
             }));
     }
 
-    private validateMediaSingle(fieldFiles: Array<Express.Multer.File>): ValidationError[] {
+    // Every optional, admin-configured, per-field check - no-ops when its setting is unset -
+    // shared between mediaSingle and mediaMultiple so neither can drift out of sync with it.
+    private validateCommon(fieldFiles: Array<Express.Multer.File>): ValidationError[] {
+        return [
+            ...this.validateRequired(fieldFiles),
+            ...this.validateSize(fieldFiles),
+            ...this.validateTypes(fieldFiles),
+            ...this.validateAllowedExtensions(fieldFiles),
+        ];
+    }
+
+    private validateRequired(fieldFiles: Array<Express.Multer.File>): ValidationError[] {
         const errors: ValidationError[] = [];
         if (!this.options.isUpdate && this.options.required && fieldFiles.length === 0) {
             errors.push({
@@ -145,13 +160,11 @@ export class MediaFieldCrudManager implements FieldCrudManager {
                 error: `${this.options.fieldName} is required`
             });
         }
-        if (fieldFiles.length > 1) {
-            errors.push({
-                field: this.options.fieldName,
-                error: `${this.options.fieldName} must be a single file`
-            });
-        }
-        // validate size
+        return errors;
+    }
+
+    private validateSize(fieldFiles: Array<Express.Multer.File>): ValidationError[] {
+        const errors: ValidationError[] = [];
         if (this.options.mediaMaxSizeKb) {
             for (let i = 0; i < fieldFiles.length; i++) {
                 const fieldFile = fieldFiles[i];
@@ -164,7 +177,11 @@ export class MediaFieldCrudManager implements FieldCrudManager {
                 }
             }
         }
-        // validate type
+        return errors;
+    }
+
+    private validateTypes(fieldFiles: Array<Express.Multer.File>): ValidationError[] {
+        const errors: ValidationError[] = [];
         if (this.options.mediaTypes && this.options.mediaTypes.length > 0) {
             const allowedFileTypes = this.options.mediaTypes as MediaType[];
 
@@ -182,21 +199,43 @@ export class MediaFieldCrudManager implements FieldCrudManager {
                 }
             }
         }
-
         return errors;
     }
 
-    private validateMediaMultiple(fieldFiles: Array<Express.Multer.File>): ValidationError[] {
-        const errors: ValidationError[] = [];
-        if (!this.options.isUpdate && this.options.required && fieldFiles.length === 0) {
+    private validateAllowedExtensions(fieldFiles: Array<Express.Multer.File>): ValidationError[] {
+        const allowed = this.options.mediaAllowedExtensions;
+        if (!allowed || allowed.length === 0) {
+            return [];
+        }
+
+        const normalizedAllowed = new Set(allowed.map(ext => ext.toLowerCase().replace(/^\./, '')));
+        return fieldFiles
+            .filter(fieldFile => {
+                const ext = getLowercaseFileExtension(getUploadedFileName(fieldFile));
+                return !ext || !normalizedAllowed.has(ext);
+            })
+            .map(fieldFile => ({
+                field: this.options.fieldName,
+                error: `${this.options.fieldName} file type not allowed. ` +
+                    `Allowed extensions: ${[...normalizedAllowed].join(', ')}.`
+            }));
+    }
+
+    private validateMediaSingle(fieldFiles: Array<Express.Multer.File>): ValidationError[] {
+        const errors = this.validateCommon(fieldFiles);
+        if (fieldFiles.length > 1) {
             errors.push({
                 field: this.options.fieldName,
-                error: `${this.options.fieldName} is required`
+                error: `${this.options.fieldName} must be a single file`
             });
         }
         return errors;
     }
 
+    private validateMediaMultiple(fieldFiles: Array<Express.Multer.File>): ValidationError[] {
+        return this.validateCommon(fieldFiles);
+    }
+
     transformForCreate(dto: any): any {
         return dto;
     }

package/src/services/chatter-message.service.ts

@@ -8,6 +8,7 @@ import { classify } from '@angular-devkit/core/src/utils/strings';
 import { CHATTER_MESSAGE_STATUS, CHATTER_MESSAGE_SUBTYPE, CHATTER_MESSAGE_TYPE, CHATTER_MESSAGE_USER_FIELDS } from 'src/constants/chatter-message.constants';
 import { isDangerousMediaFile } from 'src/constants/media-file-types';
 import { ERROR_MESSAGES } from 'src/constants/error-messages';
+import { MediaFieldCrudManager, SolidMediaType } from 'src/helpers/field-crud-managers/MediaFieldCrudManager';
 import { PostChatterMessageDto } from 'src/dtos/post-chatter-message.dto';
 import { UpdateChatterNoteMessageDto } from 'src/dtos/update-chatter-note-message.dto';
 import { ModelMetadataHelperService } from 'src/helpers/model-metadata-helper.service';
@@ -196,6 +197,34 @@ export class ChatterMessageService extends CRUDService<ChatterMessage> {
         }
     }
 
+    /**
+     * Validates newly-uploaded attachments against each declared media field's real config
+     * (mediaTypes/mediaMaxSizeKb/mediaAllowedExtensions), grouped by fieldname - the same rules
+     * MediaFieldCrudManager already enforces everywhere else. Shared between postMessage and
+     * updateCustomNoteMessage so the two entry points can't drift apart; isUpdate is the only
+     * thing that differs between them.
+     */
+    private validateChatterAttachmentsForFields(files: Express.Multer.File[], mediaFields: any[], isUpdate: boolean): void {
+        for (const mediaField of mediaFields) {
+            const media = files.filter(multerFile => multerFile.fieldname === mediaField.name);
+            if (media.length === 0) continue;
+
+            const validator = new MediaFieldCrudManager({
+                type: mediaField.type as SolidMediaType,
+                required: mediaField.required,
+                fieldName: mediaField.name,
+                mediaMaxSizeKb: mediaField.mediaMaxSizeKb,
+                mediaTypes: mediaField.mediaTypes,
+                mediaAllowedExtensions: mediaField.mediaAllowedExtensions,
+                isUpdate,
+            });
+            const validationErrors = validator.validate({}, media);
+            if (validationErrors.length > 0) {
+                throw new BadRequestException(validationErrors.map(error => error.error).join(', '));
+            }
+        }
+    }
+
     private async publishChatterMentionNotifications(message: ChatterMessage, model: any) {
         if (message.messageType !== CHATTER_MESSAGE_TYPE.CUSTOM || message.messageSubType !== CHATTER_MESSAGE_SUBTYPE.NOTE) {
             return;
@@ -329,6 +358,24 @@ export class ChatterMessageService extends CRUDService<ChatterMessage> {
 
         this.validateChatterMediaFiles(files);
 
+        let chatterModel: any = null;
+        let mediaFields: any[] = [];
+        if (removeAttachmentIds.length > 0 || hasNewFiles) {
+            chatterModel = await this.modelMetadataService.findOneBySingularName('chatterMessage', {
+                fields: {
+                    model: true,
+                    mediaStorageProvider: true,
+                },
+                module: true,
+            });
+
+            mediaFields = chatterModel.fields.filter(field => field.type === 'mediaSingle' || field.type === 'mediaMultiple');
+
+            if (hasNewFiles) {
+                this.validateChatterAttachmentsForFields(files, mediaFields, true);
+            }
+        }
+
         if (hasMessageBody) {
             message.messageBody = trimmedMessageBody;
         }
@@ -345,15 +392,6 @@ export class ChatterMessageService extends CRUDService<ChatterMessage> {
         const savedMessage = await this.repo.save(message);
 
         if (removeAttachmentIds.length > 0 || hasNewFiles) {
-            const model = await this.modelMetadataService.findOneBySingularName('chatterMessage', {
-                fields: {
-                    model: true,
-                    mediaStorageProvider: true,
-                },
-                module: true,
-            });
-
-            const mediaFields = model.fields.filter(field => field.type === 'mediaSingle' || field.type === 'mediaMultiple');
             const attachmentFieldIds = mediaFields.map(field => field.id);
 
             if (removeAttachmentIds.length > 0 && attachmentFieldIds.length > 0) {
@@ -361,7 +399,7 @@ export class ChatterMessageService extends CRUDService<ChatterMessage> {
                     where: {
                         id: In(removeAttachmentIds),
                         entityId: savedMessage.id,
-                        modelMetadata: { id: model.id },
+                        modelMetadata: { id: chatterModel.id },
                         fieldMetadata: { id: In(attachmentFieldIds) },
                     },
                     relations: {
@@ -434,10 +472,9 @@ export class ChatterMessageService extends CRUDService<ChatterMessage> {
 
         this.stampMessageAuditFields(chatterMessage);
 
-        const savedMessage = await this.repo.save(chatterMessage);
-
+        let mediaFields: any[] = [];
         if (files && files.length > 0) {
-            const model = await this.modelMetadataService.findOneBySingularName('chatterMessage', {
+            const chatterModel = await this.modelMetadataService.findOneBySingularName('chatterMessage', {
                 fields: {
                     model: true,
                     mediaStorageProvider: true,
@@ -445,8 +482,13 @@ export class ChatterMessageService extends CRUDService<ChatterMessage> {
                 module: true,
             });
 
-            const mediaFields = model.fields.filter(field => field.type === 'mediaSingle' || field.type === 'mediaMultiple');
+            mediaFields = chatterModel.fields.filter(field => field.type === 'mediaSingle' || field.type === 'mediaMultiple');
+            this.validateChatterAttachmentsForFields(files, mediaFields, false);
+        }
+
+        const savedMessage = await this.repo.save(chatterMessage);
 
+        if (files && files.length > 0) {
             for (const mediaField of mediaFields) {
                 const media = files.filter(multerFile => multerFile.fieldname === mediaField.name);
                 if (media.length > 0) {

package/src/services/crud.service.ts

@@ -446,6 +446,7 @@ private async prepareManyToManyAuditSnapshot(entity: T,id: number,modelSingularN
                     ...commonOptions,
                     mediaMaxSizeKb: fieldMetadata.mediaMaxSizeKb,
                     mediaTypes: fieldMetadata.mediaTypes,
+                    mediaAllowedExtensions: fieldMetadata.mediaAllowedExtensions,
                     type: fieldMetadata.type as unknown as SolidMediaType
                 };
                 return new MediaFieldCrudManager(options);

package/src/services/field-metadata.service.ts

@@ -945,6 +945,7 @@ export class FieldMetadataService implements OnApplicationBootstrap {
                     "isSystem",
                     "mediaTypes",
                     "mediaMaxSizeKb",
+                    "mediaAllowedExtensions",
                     "mediaStorageProviderId",
                     "required",
                     "unique",
@@ -966,6 +967,7 @@ export class FieldMetadataService implements OnApplicationBootstrap {
                     "isSystem",
                     "mediaTypes",
                     "mediaMaxSizeKb",
+                    "mediaAllowedExtensions",
                     "mediaStorageProviderId",
                     "required",
                     "unique",

package/src/services/media.service.ts

@@ -113,6 +113,7 @@ export class MediaService extends CRUDService<Media> {
       fieldName: 'files',
       mediaMaxSizeKb: createDto['fieldMetadata']?.mediaMaxSizeKb,
       mediaTypes: createDto['fieldMetadata']?.mediaTypes || [],
+      mediaAllowedExtensions: createDto['fieldMetadata']?.mediaAllowedExtensions || [],
       isUpdate: false,
     });
     const validationErrors = validator.validate(createDto, files);

package/src/services/module-metadata.service.ts

@@ -13,6 +13,7 @@ import { ConfigService } from '@nestjs/config';
 import * as fs from 'fs/promises'; // Use the Promise-based version of fs for async/await
 import * as path from 'path'; // To handle file paths
 import { ERROR_MESSAGES } from 'src/constants/error-messages';
+import { isDangerousMediaFile } from 'src/constants/media-file-types';
 import { DisallowInProduction } from 'src/decorators/disallow-in-production.decorator';
 import { ModuleMetadataHelperService } from 'src/helpers/module-metadata-helper.service';
 import { ModuleMetadataRepository } from 'src/repository/module-metadata.repository';
@@ -137,6 +138,9 @@ export class ModuleMetadataService {
 
   async createInDB(manager: EntityManager, createDto: CreateModuleMetadataDto, files: Express.Multer.File[] = []) {
     if (files.length > 0) {
+      if (isDangerousMediaFile(files[0])) {
+        throw new BadRequestException('Dangerous file types are not allowed for the menu icon.');
+      }
       const fileStoragePath = this.getFullFilePathForDisk(this.getFileName(files[0]));
       this.fileService.copy(files[0].path, fileStoragePath);
       this.fileService.delete(files[0].path);
@@ -241,6 +245,9 @@ export class ModuleMetadataService {
       throw new NotFoundException(ERROR_MESSAGES.MODULE_ID_NOT_FOUND(id));
     }
     if (files.length > 0) {
+      if (isDangerousMediaFile(files[0])) {
+        throw new BadRequestException('Dangerous file types are not allowed for the menu icon.');
+      }
 
       const fileStoragePath = this.getFullFilePathForDisk(this.getFileName(files[0]));
       this.fileService.copy(files[0].path, fileStoragePath);

package/src/services/setting.service.ts

@@ -17,6 +17,7 @@ import type { SolidCoreSetting } from './settings/default-settings-provider.serv
 import { Logger } from '@nestjs/common';
 import { EncryptionService } from './encryption.service';
 import { sanitizeStoredMediaFileName } from './media-storage.utils';
+import { isDangerousMediaFile } from 'src/constants/media-file-types';
 
 
 @Injectable()
@@ -358,6 +359,10 @@ export class SettingService {
     // Handle uploaded files
     if (uploadedFiles?.length) {
       for (const file of uploadedFiles) {
+        if (isDangerousMediaFile(file)) {
+          throw new BadRequestException('Dangerous file types are not allowed for settings.');
+        }
+
         const settingKey = file.fieldname;
         // originalname is attacker-controlled and feeds straight into a storage path.
         const relativeFileName = `${file.filename}-${sanitizeStoredMediaFileName(file.originalname)}`;

package/src/services/settings/default-settings-provider.service.ts

@@ -532,6 +532,20 @@ const getSolidCoreSettings = (isProd: boolean) =>
       ],
       helpText: "Default storage implementation used for file handling, such as local disk or S3.",
     },
+    {
+      moduleName: "solid-core",
+      key: "maxMediaFileSizeMb",
+      value: (() => {
+        const parsedMb = Number(process.env.AB_MEDIA_MAX_FILE_SIZE_MB);
+        return Number.isFinite(parsedMb) && parsedMb > 0 ? parsedMb : 100;
+      })(),
+      level: SettingLevel.SystemAdminReadonly,
+      label: "Max Media File Size (MB)",
+      group: "storage-settings",
+      sortOrder: 45,
+      controlType: "numeric",
+      helpText: "Global upload size limit enforced by Multer under every per-field mediaMaxSizeKb restriction. Read-only here: it's applied once at process start, so changing AB_MEDIA_MAX_FILE_SIZE_MB requires an app restart to take effect - editing this in the admin UI would not do that.",
+    },
 
     // aws-s3-settings-provider.service.ts
     {

package/src/solid-core.module.ts

@@ -557,6 +557,19 @@ import { SwitchNode } from './services/workflow/nodes/switch.node';
       imports: [ConfigModule],
       useFactory: async (configService: ConfigService) => ({
         dest: process.env.AB_MEDIA_UPLOAD_DIR ?? "media-uploads",
+        // A global floor under whatever per-field mediaMaxSizeKb restrictions apply, not a
+        // replacement for them - some upload paths (e.g. chatter attachments) had no size cap
+        // enforced anywhere before this. Must stay >= the largest legitimate per-field limit
+        // already configured (chatter's messageAttachments is 102400 KB / 100MB), since Multer
+        // enforces this before any of our own field-level checks ever run. Mirrored (read-only,
+        // for visibility only - see comment there for why) as the "maxMediaFileSizeMb" setting
+        // in default-settings-provider.service.ts; keep both parsing expressions in sync.
+        limits: {
+          fileSize: (() => {
+            const parsedMb = Number(process.env.AB_MEDIA_MAX_FILE_SIZE_MB);
+            return (Number.isFinite(parsedMb) && parsedMb > 0 ? parsedMb : 100) * 1024 * 1024;
+          })(),
+        },
       }),
       inject: [ConfigService],
     }),