@strapi/upload 5.49.0 → 5.50.0

package/dist/server/src/services/metrics.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"metrics.d.ts","sourceRoot":"","sources":["../../../../server/src/services/metrics.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,eAAe,CAAC;qCAMd;IAAE,MAAM,EAAE,KAAK,MAAM,CAAA;CAAE;sBACzB,MAAM,eAAe,OAAO,MAAM,EAAE,GAAG,CAAC;;;AADlE,wBA0BG"}
+{"version":3,"file":"metrics.d.ts","sourceRoot":"","sources":["../../../../server/src/services/metrics.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,eAAe,CAAC;yBAM1B,YAAY;IAAE,MAAM,EAAE,IAAI,CAAC,MAAM,CAAA;CAAE;sBACzB,MAAM,eAAe,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC;;;AADlE,wBA0BG"}

package/dist/server/src/services/provider.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"provider.d.ts","sourceRoot":"","sources":["../../../../server/src/services/provider.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,eAAe,CAAC;AAE1C,OAAO,EAAU,IAAI,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;qCAE5B;IAAE,MAAM,EAAE,KAAK,MAAM,CAAA;CAAE;wBACvB,cAAc;iBAKrB,cAAc;qBAsBV,cAAc,WAAW,IAAI;;AA5BtD,wBA2DG"}
+{"version":3,"file":"provider.d.ts","sourceRoot":"","sources":["../../../../server/src/services/provider.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,eAAe,CAAC;AAE1C,OAAO,EAAU,IAAI,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;yBAExC,YAAY;IAAE,MAAM,EAAE,IAAI,CAAC,MAAM,CAAA;CAAE;wBACvB,cAAc;iBAKrB,cAAc;qBAsBV,cAAc,WAAW,IAAI;;AA5BtD,wBA2DG"}

package/dist/server/src/services/upload.d.ts

@@ -23,7 +23,7 @@ declare const _default: ({ strapi }: {
         field?: string;
         path?: string;
         tmpWorkingDirectory?: string;
-    }) => Promise<Omit<UploadableFile, 'getStream'>>;
+    }) => Promise<Omit<UploadableFile, "getStream">>;
     upload: ({ data, files, }: {
         data: Record<string, unknown>;
         files: InputFile[];

package/dist/server/src/services/upload.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"upload.d.ts","sourceRoot":"","sources":["../../../../server/src/services/upload.ts"],"names":[],"mappings":"AAMA,OAAO,EAML,UAAU,IAAI,eAAe,EAC9B,MAAM,eAAe,CAAC;AAGvB,OAAO,KAAK,EAAE,IAAI,EAAO,MAAM,eAAe,CAAC;AAK/C,OAAO,KAAK,EAAU,IAAI,EAAE,SAAS,EAAE,cAAc,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AAClF,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,+CAA+C,CAAC;AACvF,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,0CAA0C,CAAC;AAEzE,KAAK,IAAI,GAAG;IACV,EAAE,EAAE,MAAM,GAAG,MAAM,CAAC;CACrB,CAAC;AAEF,KAAK,EAAE,GAAG,MAAM,GAAG,MAAM,CAAC;AAE1B,KAAK,aAAa,GAAG;IACnB,IAAI,CAAC,EAAE,IAAI,CAAC;CACb,CAAC;qCAgB0B;IAAE,MAAM,EAAE,KAAK,MAAM,CAAA;CAAE;+CAsErB;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,aAChE,QAAQ,QAAQ,CAAC,UACpB;QACL,KAAK,CAAC,EAAE,EAAE,CAAC;QACX,GAAG,CAAC,EAAE,MAAM,CAAC;QACb,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,mBAAmB,CAAC,EAAE,MAAM,CAAC;KAC9B,KACA,QAAQ,KAAK,cAAc,EAAE,WAAW,CAAC,CAAC;+BA2GxC;QACD,IAAI,EAAE,OAAO,MAAM,EAAE,OAAO,CAAC,CAAC;QAC9B,KAAK,EAAE,SAAS,EAAE,CAAC;KACpB,SACM,aAAa;yBAiMhB,EAAE,0DACkD,QAAQ,SACzD,aAAa;kBA4BhB,EAAE,kBACU;QAAE,IAAI,EAAE;YAAE,QAAQ,EAAE,QAAQ,CAAA;SAAE,CAAC;QAAC,IAAI,EAAE,SAAS,CAAA;KAAE,SAC1D,aAAa;kBAsGK,EAAE;uBAgBE,GAAG,KAAQ,QAAQ,IAAI,EAAE,CAAC;uBAS1B,GAAG;;;;;;;;;+BAyDK,GAAG;;;;mBA4Cd,IAAI;;;;;;;yBAiCE,QAAQ;;;;;8BAoBT,iBAAiB;IAqBhD;;;OAGG;6BAlegC,cAAc;;AA9OrD,wBAmtBE"}
+{"version":3,"file":"upload.d.ts","sourceRoot":"","sources":["../../../../server/src/services/upload.ts"],"names":[],"mappings":"AAMA,OAAO,EAML,UAAU,IAAI,eAAe,EAC9B,MAAM,eAAe,CAAC;AAGvB,OAAO,KAAK,EAAE,IAAI,EAAO,MAAM,eAAe,CAAC;AAK/C,OAAO,KAAK,EAAU,IAAI,EAAE,SAAS,EAAE,cAAc,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AAClF,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,+CAA+C,CAAC;AACvF,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,0CAA0C,CAAC;AAEzE,KAAK,IAAI,GAAG;IACV,EAAE,EAAE,MAAM,GAAG,MAAM,CAAC;CACrB,CAAC;AAEF,KAAK,EAAE,GAAG,MAAM,GAAG,MAAM,CAAC;AAE1B,KAAK,aAAa,GAAG;IACnB,IAAI,CAAC,EAAE,IAAI,CAAC;CACb,CAAC;yBAgBc,YAAY;IAAE,MAAM,EAAE,IAAI,CAAC,MAAM,CAAA;CAAE;+CAsErB;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,aAChE,OAAO,CAAC,QAAQ,CAAC,UACpB;QACL,KAAK,CAAC,EAAE,EAAE,CAAC;QACX,GAAG,CAAC,EAAE,MAAM,CAAC;QACb,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,mBAAmB,CAAC,EAAE,MAAM,CAAC;KAC9B,KACA,OAAO,CAAC,IAAI,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC;+BA2GxC;QACD,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAC9B,KAAK,EAAE,SAAS,EAAE,CAAC;KACpB,SACM,aAAa;yBAiMhB,EAAE,0DACkD,QAAQ,SACzD,aAAa;kBA4BhB,EAAE,kBACU;QAAE,IAAI,EAAE;YAAE,QAAQ,EAAE,QAAQ,CAAA;SAAE,CAAC;QAAC,IAAI,EAAE,SAAS,CAAA;KAAE,SAC1D,aAAa;kBAsGK,EAAE;uBAgBE,GAAG,KAAQ,OAAO,CAAC,IAAI,EAAE,CAAC;uBAS1B,GAAG;;;;;;;;;+BAyDK,GAAG;;;;mBA4Cd,IAAI;;;;;;;yBAiCE,QAAQ;;;;;8BAoBT,iBAAiB;IAqBhD;;;OAGG;6BAlegC,cAAc;;AA9OrD,wBAmtBE"}

package/dist/server/src/services/weekly-metrics.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"weekly-metrics.d.ts","sourceRoot":"","sources":["../../../../server/src/services/weekly-metrics.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,eAAe,CAAC;qCAoBd;IAAE,MAAM,EAAE,KAAK,MAAM,CAAA;CAAE;;;;;;;;;sCAyFT,QAAQ,MAAM,CAAC;;;AAzFzD,wBAoHG"}
+{"version":3,"file":"weekly-metrics.d.ts","sourceRoot":"","sources":["../../../../server/src/services/weekly-metrics.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,eAAe,CAAC;yBAoB1B,YAAY;IAAE,MAAM,EAAE,IAAI,CAAC,MAAM,CAAA;CAAE;;;;;;;;;sCAyFT,OAAO,CAAC,MAAM,CAAC;;;AAzFzD,wBAoHG"}

package/dist/server/src/types.d.ts

@@ -1,6 +1,3 @@
-/// <reference types="node" />
-/// <reference types="node" />
-/// <reference types="node" />
 import type { File as FormidableFile } from 'formidable';
 export type InputFile = FormidableFile & {
     path?: string;
@@ -70,6 +67,10 @@ export interface Config {
         concurrency?: number;
     };
     concurrentUploadSize?: number;
+    security?: {
+        allowedTypes?: string[];
+        deniedTypes?: string[];
+    };
 }
 export interface UploadableFile extends Omit<File, 'id'> {
     filepath?: string;

package/dist/server/src/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../server/src/types.ts"],"names":[],"mappings":";;;AAAA,OAAO,KAAK,EAAE,IAAI,IAAI,cAAc,EAAE,MAAM,YAAY,CAAC;AAEzD,MAAM,MAAM,SAAS,GAAG,cAAc,GAAG;IACvC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF,MAAM,WAAW,UAAU;IACzB,CAAC,EAAE,MAAM,CAAC;IACV,CAAC,EAAE,MAAM,CAAC;CACX;AAED,MAAM,WAAW,IAAI;IACnB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,UAAU,CAAC,EAAE,UAAU,GAAG,IAAI,CAAC;IAC/B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,iBAAiB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC5C,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE;QACR,EAAE,EAAE,MAAM,GAAG,MAAM,CAAC;QACpB,MAAM,EAAE,MAAM,CAAC;QACf,OAAO,EAAE;YAAE,KAAK,EAAE,MAAM,CAAA;SAAE,CAAC;KAC5B,EAAE,CAAC;IACJ,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,MAAM;IACrB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf;;OAEG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;OAEG;IACH,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,IAAI,EAAE,CAAC;CAChB;AAED,MAAM,WAAW,MAAM;IACrB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACzC,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACvC,KAAK,CAAC,EAAE;QACN,KAAK,CAAC,EAAE,OAAO,CAAC;QAChB,WAAW,CAAC,EAAE,MAAM,CAAC;KACtB,CAAC;IACF,oBAAoB,CAAC,EAAE,MAAM,CAAC;CAC/B;AAED,MAAM,WAAW,cAAe,SAAQ,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC;IACtD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,MAAM,CAAC,cAAc,CAAC;IACvC,MAAM,CAAC,EAAE,MAAM,CAAC,cAAc,CAAC;IAC/B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,mBAAmB,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED,MAAM,MAAM,QAAQ,GAAG;IACrB,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,UAAU,CAAC,EAAE,UAAU,GAAG,IAAI,CAAC;IAC/B,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACxB,CAAC"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../server/src/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,IAAI,cAAc,EAAE,MAAM,YAAY,CAAC;AAEzD,MAAM,MAAM,SAAS,GAAG,cAAc,GAAG;IACvC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF,MAAM,WAAW,UAAU;IACzB,CAAC,EAAE,MAAM,CAAC;IACV,CAAC,EAAE,MAAM,CAAC;CACX;AAED,MAAM,WAAW,IAAI;IACnB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,UAAU,CAAC,EAAE,UAAU,GAAG,IAAI,CAAC;IAC/B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,iBAAiB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC5C,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE;QACR,EAAE,EAAE,MAAM,GAAG,MAAM,CAAC;QACpB,MAAM,EAAE,MAAM,CAAC;QACf,OAAO,EAAE;YAAE,KAAK,EAAE,MAAM,CAAA;SAAE,CAAC;KAC5B,EAAE,CAAC;IACJ,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,MAAM;IACrB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf;;OAEG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;OAEG;IACH,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,IAAI,EAAE,CAAC;CAChB;AAED,MAAM,WAAW,MAAM;IACrB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACzC,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACvC,KAAK,CAAC,EAAE;QACN,KAAK,CAAC,EAAE,OAAO,CAAC;QAChB,WAAW,CAAC,EAAE,MAAM,CAAC;KACtB,CAAC;IACF,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,EAAE;QACT,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;QACxB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;KACxB,CAAC;CACH;AAED,MAAM,WAAW,cAAe,SAAQ,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC;IACtD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,MAAM,CAAC,cAAc,CAAC;IACvC,MAAM,CAAC,EAAE,MAAM,CAAC,cAAc,CAAC;IAC/B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,mBAAmB,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED,MAAM,MAAM,QAAQ,GAAG;IACrB,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,UAAU,CAAC,EAAE,UAAU,GAAG,IAAI,CAAC;IAC/B,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACxB,CAAC"}

package/dist/server/src/utils/cron.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cron.d.ts","sourceRoot":"","sources":["../../../../server/src/utils/cron.ts"],"names":[],"mappings":"AAAA,QAAA,MAAM,uBAAuB,SAAU,IAAI,WAC0C,CAAC;AAEtF,OAAO,EAAE,uBAAuB,EAAE,CAAC"}
+{"version":3,"file":"cron.d.ts","sourceRoot":"","sources":["../../../../server/src/utils/cron.ts"],"names":[],"mappings":"AAAA,QAAA,MAAM,uBAAuB,GAAI,MAAM,IAAI,WAC0C,CAAC;AAEtF,OAAO,EAAE,uBAAuB,EAAE,CAAC"}

package/dist/server/src/utils/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../server/src/utils/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,MAAM,oBAAoB,CAAC;AAC7C,OAAO,KAAK,iBAAiB,MAAM,gCAAgC,CAAC;AACpE,OAAO,KAAK,eAAe,MAAM,+BAA+B,CAAC;AACjE,OAAO,KAAK,QAAQ,MAAM,sBAAsB,CAAC;AACjD,OAAO,KAAK,MAAM,MAAM,oBAAoB,CAAC;AAC7C,OAAO,KAAK,IAAI,MAAM,kBAAkB,CAAC;AACzC,OAAO,KAAK,aAAa,MAAM,4BAA4B,CAAC;AAC5D,OAAO,KAAK,OAAO,MAAM,qBAAqB,CAAC;AAC/C,OAAO,KAAK,UAAU,MAAM,wBAAwB,CAAC;AACrD,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,yBAAyB,CAAC;AACvE,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,8BAA8B,CAAC;AAEhF,KAAK,QAAQ,GAAG;IACd,MAAM,EAAE,UAAU,CAAC,OAAO,MAAM,CAAC,CAAC;IAClC,oBAAoB,EAAE,OAAO,iBAAiB,CAAC;IAC/C,QAAQ,EAAE,UAAU,CAAC,OAAO,QAAQ,CAAC,CAAC;IACtC,MAAM,EAAE,OAAO,MAAM,CAAC;IACtB,IAAI,EAAE,OAAO,IAAI,CAAC;IAClB,aAAa,EAAE,UAAU,CAAC,OAAO,aAAa,CAAC,CAAC;IAChD,OAAO,EAAE,UAAU,CAAC,OAAO,OAAO,CAAC,CAAC;IACpC,mBAAmB,EAAE,OAAO,eAAe,CAAC;IAC5C,UAAU,EAAE,OAAO,UAAU,CAAC;IAC9B,UAAU,EAAE,UAAU,CAAC,OAAO,uBAAuB,CAAC,CAAC;IACvD,cAAc,EAAE,UAAU,CAAC,OAAO,2BAA2B,CAAC,CAAC;CAChE,CAAC;AAEF,eAAO,MAAM,UAAU,uCAAwC,KAAK,KAAG,QAAQ,CAAC,KAAK,CAEpF,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../server/src/utils/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,MAAM,oBAAoB,CAAC;AAC7C,OAAO,KAAK,iBAAiB,MAAM,gCAAgC,CAAC;AACpE,OAAO,KAAK,eAAe,MAAM,+BAA+B,CAAC;AACjE,OAAO,KAAK,QAAQ,MAAM,sBAAsB,CAAC;AACjD,OAAO,KAAK,MAAM,MAAM,oBAAoB,CAAC;AAC7C,OAAO,KAAK,IAAI,MAAM,kBAAkB,CAAC;AACzC,OAAO,KAAK,aAAa,MAAM,4BAA4B,CAAC;AAC5D,OAAO,KAAK,OAAO,MAAM,qBAAqB,CAAC;AAC/C,OAAO,KAAK,UAAU,MAAM,wBAAwB,CAAC;AACrD,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,yBAAyB,CAAC;AACvE,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,8BAA8B,CAAC;AAEhF,KAAK,QAAQ,GAAG;IACd,MAAM,EAAE,UAAU,CAAC,OAAO,MAAM,CAAC,CAAC;IAClC,oBAAoB,EAAE,OAAO,iBAAiB,CAAC;IAC/C,QAAQ,EAAE,UAAU,CAAC,OAAO,QAAQ,CAAC,CAAC;IACtC,MAAM,EAAE,OAAO,MAAM,CAAC;IACtB,IAAI,EAAE,OAAO,IAAI,CAAC;IAClB,aAAa,EAAE,UAAU,CAAC,OAAO,aAAa,CAAC,CAAC;IAChD,OAAO,EAAE,UAAU,CAAC,OAAO,OAAO,CAAC,CAAC;IACpC,mBAAmB,EAAE,OAAO,eAAe,CAAC;IAC5C,UAAU,EAAE,OAAO,UAAU,CAAC;IAC9B,UAAU,EAAE,UAAU,CAAC,OAAO,uBAAuB,CAAC,CAAC;IACvD,cAAc,EAAE,UAAU,CAAC,OAAO,2BAA2B,CAAC,CAAC;CAChE,CAAC;AAEF,eAAO,MAAM,UAAU,GAAI,KAAK,SAAS,MAAM,QAAQ,EAAE,MAAM,KAAK,KAAG,QAAQ,CAAC,KAAK,CAEpF,CAAC"}

package/dist/server/src/utils/mime-validation.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mime-validation.d.ts","sourceRoot":"","sources":["../../../../server/src/utils/mime-validation.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,eAAe,CAAC;AAG1C,MAAM,MAAM,cAAc,GAAG;IAC3B,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;CACxB,CAAC;AACF,KAAK,qBAAqB,GAAG;IAC3B,IAAI,EAAE,uBAAuB,GAAG,kBAAkB,GAAG,eAAe,CAAC;IACrE,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;CAC9B,CAAC;AAEF,KAAK,gBAAgB,GAAG;IACtB,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE,qBAAqB,CAAC;IAC9B,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB,CAAC;AAEF,KAAK,WAAW,GAAG;IACjB,IAAI,EAAE,GAAG,CAAC;IACV,aAAa,EAAE,MAAM,CAAC;IACtB,KAAK,EAAE,qBAAqB,CAAC;CAC9B,CAAC;AAeF,wBAAsB,cAAc,CAAC,IAAI,EAAE,GAAG,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAoC3E;AAsBD,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,cAAc,GAAG,OAAO,CAcnF;AA6ED,wBAAgB,eAAe,CAAC,IAAI,EAAE,GAAG;;;EAWxC;AAED,wBAAsB,YAAY,CAChC,IAAI,EAAE,GAAG,EACT,MAAM,EAAE,cAAc,EACtB,MAAM,EAAE,IAAI,CAAC,MAAM,GAClB,OAAO,CAAC,gBAAgB,CAAC,CA0K3B;AA2BD,wBAAsB,aAAa,CAAC,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAoEhG;AAED,wBAAsB,qBAAqB,CACzC,KAAK,EAAE,GAAG,EACV,MAAM,EAAE,IAAI,CAAC,MAAM,GAClB,OAAO,CAAC;IACT,UAAU,EAAE,GAAG,EAAE,CAAC;IAClB,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,MAAM,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC;CAC5B,CAAC,CAyCD;AAED,MAAM,MAAM,eAAe,GAAG;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACjB,CAAC;AAEF,MAAM,MAAM,mBAAmB,GAAG;IAChC,UAAU,EAAE,GAAG,EAAE,CAAC;IAClB,YAAY,EAAE,GAAG,CAAC;IAClB,MAAM,EAAE,eAAe,EAAE,CAAC;CAC3B,CAAC;AAEF;;GAEG;AACH,wBAAsB,oBAAoB,CACxC,UAAU,EAAE,GAAG,EACf,IAAI,EAAE,GAAG,EACT,MAAM,EAAE,IAAI,CAAC,MAAM,GAClB,OAAO,CAAC,mBAAmB,CAAC,CAoD9B"}
+{"version":3,"file":"mime-validation.d.ts","sourceRoot":"","sources":["../../../../server/src/utils/mime-validation.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,eAAe,CAAC;AAG1C,MAAM,MAAM,cAAc,GAAG;IAC3B,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;CACxB,CAAC;AACF,KAAK,qBAAqB,GAAG;IAC3B,IAAI,EAAE,uBAAuB,GAAG,kBAAkB,GAAG,eAAe,CAAC;IACrE,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;CAC9B,CAAC;AAEF,KAAK,gBAAgB,GAAG;IACtB,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE,qBAAqB,CAAC;IAC9B,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB,CAAC;AAEF,KAAK,WAAW,GAAG;IACjB,IAAI,EAAE,GAAG,CAAC;IACV,aAAa,EAAE,MAAM,CAAC;IACtB,KAAK,EAAE,qBAAqB,CAAC;CAC9B,CAAC;AAeF,wBAAsB,cAAc,CAAC,IAAI,EAAE,GAAG,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAoC3E;AAsBD,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,cAAc,GAAG,OAAO,CAcnF;AA6ED,wBAAgB,eAAe,CAAC,IAAI,EAAE,GAAG;;;EAWxC;AAED,wBAAsB,YAAY,CAChC,IAAI,EAAE,GAAG,EACT,MAAM,EAAE,cAAc,EACtB,MAAM,EAAE,IAAI,CAAC,MAAM,GAClB,OAAO,CAAC,gBAAgB,CAAC,CAmL3B;AA2BD,wBAAsB,aAAa,CAAC,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAoEhG;AAED,wBAAsB,qBAAqB,CACzC,KAAK,EAAE,GAAG,EACV,MAAM,EAAE,IAAI,CAAC,MAAM,GAClB,OAAO,CAAC;IACT,UAAU,EAAE,GAAG,EAAE,CAAC;IAClB,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,MAAM,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC;CAC5B,CAAC,CAyCD;AAED,MAAM,MAAM,eAAe,GAAG;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACjB,CAAC;AAEF,MAAM,MAAM,mBAAmB,GAAG;IAChC,UAAU,EAAE,GAAG,EAAE,CAAC;IAClB,YAAY,EAAE,GAAG,CAAC;IAClB,MAAM,EAAE,eAAe,EAAE,CAAC;CAC3B,CAAC;AAEF;;GAEG;AACH,wBAAsB,oBAAoB,CACxC,UAAU,EAAE,GAAG,EACf,IAAI,EAAE,GAAG,EACT,MAAM,EAAE,IAAI,CAAC,MAAM,GAClB,OAAO,CAAC,mBAAmB,CAAC,CAoD9B"}

package/dist/server/utils/mime-validation.js

@@ -181,7 +181,9 @@ async function validateFile(file, config, strapi) {
     // Reject if detected is not in allow list (extension/declared cannot override).
     // Exception: file-type often returns application/zip for Office formats (docx, xlsx); skip so the next block can allow via extension type.
     const isZipWithAllowedExt = detectedMime === 'application/zip' && expectedMimeFromExt && expectedMimeFromExt !== 'application/zip' && Array.isArray(allowedTypes) && allowedTypes.length > 0 && matchesMimePattern(expectedMimeFromExt, allowedTypes);
-    if (detectedMime && Array.isArray(allowedTypes) && allowedTypes.length > 0 && !matchesMimePattern(detectedMime, allowedTypes) && !isZipWithAllowedExt) {
+    // Exception: file-type often returns application/xml for SVG; trust .svg extension when image/svg+xml is allowed.
+    const isSvgXmlWithAllowedExt = detectedMime === 'application/xml' && fileExt === '.svg' && expectedMimeFromExt === 'image/svg+xml' && Array.isArray(allowedTypes) && allowedTypes.length > 0 && matchesMimePattern(expectedMimeFromExt, allowedTypes);
+    if (detectedMime && Array.isArray(allowedTypes) && allowedTypes.length > 0 && !matchesMimePattern(detectedMime, allowedTypes) && !isZipWithAllowedExt && !isSvgXmlWithAllowedExt) {
         return {
             isValid: false,
             error: {

package/dist/server/utils/mime-validation.js.map

@@ -1 +1 @@
-{"version":3,"file":"mime-validation.js","sources":["../../../server/src/utils/mime-validation.ts"],"sourcesContent":["import { open } from 'node:fs/promises';\nimport { extname } from 'node:path';\nimport { lookup } from 'mime-types';\nimport type { Core } from '@strapi/types';\nimport { errors } from '@strapi/utils';\n\nexport type SecurityConfig = {\n  allowedTypes?: string[];\n  deniedTypes?: string[];\n};\ntype UploadValidationError = {\n  code: 'MIME_TYPE_NOT_ALLOWED' | 'VALIDATION_ERROR' | 'UNKNOWN_ERROR';\n  message: string;\n  details: Record<string, any>;\n};\n\ntype ValidationResult = {\n  isValid: boolean;\n  error?: UploadValidationError;\n  detectedMime?: string;\n};\n\ntype ErrorDetail = {\n  file: any;\n  originalIndex: number;\n  error: UploadValidationError;\n};\n\nasync function readFileChunk(filePath: string, chunkSize: number = 4100): Promise<Buffer> {\n  const file = await open(filePath, 'r');\n\n  try {\n    const buffer = Buffer.alloc(chunkSize);\n    const { bytesRead } = await file.read(buffer, 0, chunkSize, 0);\n\n    return buffer.subarray(0, bytesRead);\n  } finally {\n    await file.close();\n  }\n}\n\nexport async function detectMimeType(file: any): Promise<string | undefined> {\n  let buffer: Buffer;\n\n  // Support multiple property names used by different multipart parsers (formidable uses filepath)\n  const filePath = file.filepath ?? file.path ?? file.tempFilePath ?? file.filePath;\n\n  if (filePath) {\n    try {\n      buffer = await readFileChunk(filePath, 4100);\n    } catch (error) {\n      throw new Error(\n        `Failed to read file: ${error instanceof Error ? error.message : String(error)}`\n      );\n    }\n  } else if (file.buffer) {\n    buffer = file.buffer.length > 4100 ? file.buffer.subarray(0, 4100) : file.buffer;\n  } else {\n    // No file path or buffer; cannot detect MIME. Validation will use declared/extension or reject.\n    return undefined;\n  }\n\n  try {\n    /**\n     * Use dynamic import to support file-type which is ESM-only\n     * Static imports fail during CommonJS build since bundler can't transform ESM-only packages\n     * @see https://gist.github.com/sindresorhus/a39789f98801d908bbc7ff3ecc99d99c\n     */\n    const { fileTypeFromBuffer } = await import('file-type');\n\n    const result = await fileTypeFromBuffer(new Uint8Array(buffer));\n    return result?.mime;\n  } catch (error) {\n    throw new Error(\n      `Failed to detect MIME type: ${error instanceof Error ? error.message : String(error)}`\n    );\n  }\n}\n\nfunction matchesMimePattern(mimeType: string, patterns: string[]): boolean {\n  if (!patterns?.length) return false;\n\n  return patterns.some((pattern) => {\n    const normalizedPattern = pattern.toLowerCase();\n    const normalizedMimeType = mimeType.toLowerCase();\n\n    if (normalizedPattern.includes('*')) {\n      const regexPattern = normalizedPattern.replace(/\\*/g, '.*');\n\n      const regex = new RegExp(`^${regexPattern}$`);\n      const matches = regex.test(normalizedMimeType);\n      return matches;\n    }\n\n    const exactMatch = normalizedPattern === normalizedMimeType;\n    return exactMatch;\n  });\n}\n\nexport function isMimeTypeAllowed(mimeType: string, config: SecurityConfig): boolean {\n  const { allowedTypes, deniedTypes } = config;\n\n  if (!mimeType) return false;\n\n  if (deniedTypes?.length && matchesMimePattern(mimeType, deniedTypes)) {\n    return false;\n  }\n\n  if (Array.isArray(allowedTypes)) {\n    return allowedTypes.length > 0 && matchesMimePattern(mimeType, allowedTypes);\n  }\n\n  return true;\n}\n\n/**\n * Single gate for allow/deny. Returns ValidationResult.\n * Doc: docs/docs/01-core/upload/01-backend/01-mime-validation.md\n */\nfunction validateAllowBanLists(\n  mimetype: string,\n  fileName: string,\n  declaredType: string,\n  detectedType: string | undefined,\n  config: SecurityConfig\n): ValidationResult {\n  if (!mimetype) {\n    return {\n      isValid: false,\n      error: {\n        code: 'MIME_TYPE_NOT_ALLOWED',\n        message: 'MIME type is not allowed',\n        details: {\n          fileName,\n          reason: 'No MIME type to validate',\n          declaredType,\n          detectedType,\n          allowedTypes: config.allowedTypes,\n          deniedTypes: config.deniedTypes,\n        },\n      },\n    };\n  }\n  if (config.deniedTypes?.length && matchesMimePattern(mimetype, config.deniedTypes)) {\n    return buildNotAllowedError(fileName, declaredType, detectedType, mimetype, config);\n  }\n  if (!Array.isArray(config.allowedTypes)) {\n    return { isValid: true, detectedMime: mimetype };\n  }\n  if (config.allowedTypes.length === 0) {\n    return {\n      isValid: false,\n      error: {\n        code: 'MIME_TYPE_NOT_ALLOWED',\n        message: 'MIME type is not allowed',\n        details: {\n          fileName,\n          reason: 'Allow list is empty',\n          declaredType,\n          detectedType,\n          allowedTypes: config.allowedTypes,\n          deniedTypes: config.deniedTypes,\n        },\n      },\n    };\n  }\n  if (matchesMimePattern(mimetype, config.allowedTypes)) {\n    return { isValid: true, detectedMime: mimetype };\n  }\n  return {\n    isValid: false,\n    error: {\n      code: 'MIME_TYPE_NOT_ALLOWED',\n      message: `File type '${mimetype}' is not allowed`,\n      details: {\n        fileName,\n        declaredType,\n        detectedType,\n        finalType: mimetype,\n        allowedTypes: config.allowedTypes,\n        deniedTypes: config.deniedTypes,\n      },\n    },\n  };\n}\n\nfunction isDeclaredGeneric(declaredMimeType: string): boolean {\n  return !declaredMimeType || declaredMimeType === 'application/octet-stream';\n}\n\nexport function extractFileInfo(file: any) {\n  const fileName =\n    file.originalFilename ||\n    file.name ||\n    file.filename ||\n    file.newFilename ||\n    file.originalname ||\n    'unknown';\n  const declaredMimeType = file.mimetype || file.type || file.mimeType || file.mime || '';\n\n  return { fileName, declaredMimeType };\n}\n\nexport async function validateFile(\n  file: any,\n  config: SecurityConfig,\n  strapi: Core.Strapi\n): Promise<ValidationResult> {\n  const { allowedTypes, deniedTypes } = config;\n\n  const { fileName, declaredMimeType } = extractFileInfo(file);\n\n  const fileExt = extname(fileName).toLowerCase();\n  const expectedMimeFromExt = fileExt ? lookup(fileExt) || null : null;\n\n  // Reject if declared type is denied.\n  if (\n    !isDeclaredGeneric(declaredMimeType) &&\n    deniedTypes?.length &&\n    matchesMimePattern(declaredMimeType, deniedTypes)\n  ) {\n    return buildNotAllowedError(fileName, declaredMimeType, undefined, declaredMimeType, config);\n  }\n\n  // Reject if extension's type is denied.\n  if (\n    expectedMimeFromExt &&\n    deniedTypes?.length &&\n    matchesMimePattern(expectedMimeFromExt, deniedTypes)\n  ) {\n    return buildNotAllowedError(fileName, declaredMimeType, undefined, expectedMimeFromExt, config);\n  }\n\n  // Run content detection.\n  let detectedMime: string | undefined;\n  try {\n    detectedMime = await detectMimeType(file);\n  } catch (error) {\n    const errMsg = error instanceof Error ? error.message : String(error);\n    strapi.log.warn(`Failed to detect MIME type from file: ${errMsg}`, {\n      fileName,\n      error: errMsg,\n    });\n  }\n\n  const declaredMatchesExtension =\n    !isDeclaredGeneric(declaredMimeType) &&\n    expectedMimeFromExt !== null &&\n    expectedMimeFromExt !== undefined &&\n    (matchesMimePattern(declaredMimeType, [expectedMimeFromExt]) ||\n      matchesMimePattern(expectedMimeFromExt, [declaredMimeType]));\n  const detectedMatchesDeclared =\n    detectedMime && declaredMimeType && matchesMimePattern(detectedMime, [declaredMimeType]);\n\n  // Trusted declaration: declared matches extension and detection confirms.\n  if (declaredMatchesExtension && detectedMatchesDeclared) {\n    return validateAllowBanLists(\n      declaredMimeType,\n      fileName,\n      declaredMimeType,\n      detectedMime,\n      config\n    );\n  }\n\n  // Reject if detected type is denied.\n  if (detectedMime && deniedTypes?.length && matchesMimePattern(detectedMime, deniedTypes)) {\n    return buildNotAllowedError(fileName, declaredMimeType, detectedMime, detectedMime, config);\n  }\n\n  // Reject if detected is not in allow list (extension/declared cannot override).\n  // Exception: file-type often returns application/zip for Office formats (docx, xlsx); skip so the next block can allow via extension type.\n  const isZipWithAllowedExt =\n    detectedMime === 'application/zip' &&\n    expectedMimeFromExt &&\n    expectedMimeFromExt !== 'application/zip' &&\n    Array.isArray(allowedTypes) &&\n    allowedTypes.length > 0 &&\n    matchesMimePattern(expectedMimeFromExt, allowedTypes);\n  if (\n    detectedMime &&\n    Array.isArray(allowedTypes) &&\n    allowedTypes.length > 0 &&\n    !matchesMimePattern(detectedMime, allowedTypes) &&\n    !isZipWithAllowedExt\n  ) {\n    return {\n      isValid: false,\n      error: {\n        code: 'MIME_TYPE_NOT_ALLOWED',\n        message: 'MIME type is not allowed',\n        details: {\n          fileName,\n          reason:\n            'File content was detected as a type not in the allow list; extension or declared type cannot override',\n          declaredType: declaredMimeType,\n          detectedType: detectedMime,\n          expectedMimeFromExtension: expectedMimeFromExt,\n          allowedTypes,\n          deniedTypes,\n        },\n      },\n    };\n  }\n\n  // Use detected type when defined and (no extension, or detected matches extension, or declared is generic).\n  const detectedMatchesExtension =\n    detectedMime &&\n    expectedMimeFromExt !== null &&\n    expectedMimeFromExt !== undefined &&\n    matchesMimePattern(detectedMime, [expectedMimeFromExt]);\n  if (\n    detectedMime &&\n    (!expectedMimeFromExt || detectedMatchesExtension || isDeclaredGeneric(declaredMimeType))\n  ) {\n    // Office/zip exception: use extension type when detection returned application/zip and extension is in allow list.\n    if (\n      detectedMime === 'application/zip' &&\n      expectedMimeFromExt &&\n      expectedMimeFromExt !== 'application/zip'\n    ) {\n      const extResult = validateAllowBanLists(\n        expectedMimeFromExt,\n        fileName,\n        declaredMimeType,\n        detectedMime,\n        config\n      );\n      if (extResult.isValid) {\n        strapi.log.warn(\n          'MIME type detection returned application/zip; trusting extension for allow list',\n          { fileName, fileExtension: fileExt, expectedMimeFromExtension: expectedMimeFromExt }\n        );\n        return extResult;\n      }\n    }\n    return validateAllowBanLists(detectedMime, fileName, declaredMimeType, detectedMime, config);\n  }\n\n  // Use extension's type when present.\n  if (expectedMimeFromExt) {\n    return validateAllowBanLists(\n      expectedMimeFromExt,\n      fileName,\n      declaredMimeType,\n      detectedMime,\n      config\n    );\n  }\n\n  // Use declared type as last resort.\n  if (declaredMimeType) {\n    return validateAllowBanLists(\n      declaredMimeType,\n      fileName,\n      declaredMimeType,\n      detectedMime,\n      config\n    );\n  }\n\n  // Reject when no type can be chosen.\n  return {\n    isValid: false,\n    error: {\n      code: 'MIME_TYPE_NOT_ALLOWED',\n      message: 'Cannot verify file type for security reasons',\n      details: {\n        fileName,\n        reason: 'No MIME type to validate (no declared type, no extension, no detection)',\n        declaredType: declaredMimeType,\n        detectedType: detectedMime,\n        allowedTypes,\n        deniedTypes,\n      },\n    },\n  };\n}\n\nfunction buildNotAllowedError(\n  fileName: string,\n  declaredType: string,\n  detectedType: string | undefined,\n  rejectedType: string,\n  config: SecurityConfig\n): ValidationResult {\n  return {\n    isValid: false,\n    error: {\n      code: 'MIME_TYPE_NOT_ALLOWED',\n      message: `File type '${rejectedType}' is not allowed`,\n      details: {\n        fileName,\n        declaredType,\n        detectedType,\n        finalType: rejectedType,\n        allowedTypes: config.allowedTypes,\n        deniedTypes: config.deniedTypes,\n        reason: 'MIME type is in the denied list',\n      },\n    },\n  };\n}\n\nexport async function validateFiles(files: any, strapi: Core.Strapi): Promise<ValidationResult[]> {\n  const filesArray = Array.isArray(files) ? files : [files];\n\n  if (!filesArray.length) {\n    return [];\n  }\n\n  // Use array path so 'plugin::upload' is a single key (lodash string path splits on '.')\n  let config: SecurityConfig = strapi.config.get(\n    ['plugin::upload', 'security'],\n    {}\n  ) as SecurityConfig;\n  if (!config || typeof config !== 'object') {\n    config = {};\n  }\n  if (\n    config.allowedTypes &&\n    (!Array.isArray(config.allowedTypes) ||\n      !config.allowedTypes.every((item) => typeof item === 'string'))\n  ) {\n    throw new errors.ApplicationError(\n      'Invalid configuration: allowedTypes must be an array of strings.'\n    );\n  }\n\n  if (\n    config.deniedTypes &&\n    (!Array.isArray(config.deniedTypes) ||\n      !config.deniedTypes.every((item) => typeof item === 'string'))\n  ) {\n    throw new errors.ApplicationError(\n      'Invalid configuration: deniedTypes must be an array of strings.'\n    );\n  }\n\n  if (!config.allowedTypes && !config.deniedTypes) {\n    strapi.log.warn(\n      'No upload security configuration found. Consider configuring plugin.upload.security for enhanced file validation.'\n    );\n    // Do not return; we still run validation so MIME detection runs and stored file gets detected type when possible\n  }\n\n  const validationPromises = filesArray.map(async (file, index) => {\n    try {\n      return await validateFile(file, config, strapi);\n    } catch (error) {\n      strapi.log.error('Unexpected error during file validation', {\n        fileIndex: index,\n        fileName: file?.name || file?.originalname,\n        error: error instanceof Error ? error.message : String(error),\n      });\n\n      return {\n        isValid: false,\n        error: {\n          code: 'VALIDATION_ERROR' as const,\n          message: `Validation failed for file at index ${index}`,\n          details: {\n            index,\n            fileName: file?.name || file?.originalname,\n            originalError: error instanceof Error ? error.message : String(error),\n          },\n        },\n      };\n    }\n  });\n\n  return Promise.all(validationPromises);\n}\n\nexport async function enforceUploadSecurity(\n  files: any,\n  strapi: Core.Strapi\n): Promise<{\n  validFiles: any[];\n  validFileNames: string[];\n  errors: Array<ErrorDetail>;\n}> {\n  const validationResults = await validateFiles(files, strapi);\n  const filesArray = Array.isArray(files) ? files : [files];\n\n  const validFiles: any[] = [];\n  const validFileNames: string[] = [];\n  const errors: Array<ErrorDetail> = [];\n\n  for (const [index, result] of validationResults.entries()) {\n    if (result.isValid) {\n      const file = filesArray[index];\n      // Enrich file with detected MIME type for use in storage\n      if (result.detectedMime) {\n        file.detectedMimeType = result.detectedMime;\n      }\n      validFiles.push(file);\n      validFileNames.push(file.originalFilename || file.name);\n    } else if (result.error) {\n      errors.push({\n        file: filesArray[index],\n        originalIndex: index,\n        error: result.error,\n      });\n    } else {\n      // Handle case where validation failed but no error details are provided\n      errors.push({\n        file: filesArray[index],\n        originalIndex: index,\n        error: {\n          code: 'UNKNOWN_ERROR' as const,\n          message: 'File validation failed for unknown reason',\n          details: {\n            index,\n            fileName: filesArray[index]?.name || filesArray[index]?.originalname,\n          },\n        },\n      });\n    }\n  }\n\n  return { validFiles, validFileNames, errors };\n}\n\nexport type FileUploadError = {\n  name: string;\n  message: string;\n};\n\nexport type PrepareUploadResult = {\n  validFiles: any[];\n  filteredBody: any;\n  errors: FileUploadError[];\n};\n\n/**\n * Prepare files and body for upload by enforcing security and parsing fileInfo\n */\nexport async function prepareUploadRequest(\n  filesInput: any,\n  body: any,\n  strapi: Core.Strapi\n): Promise<PrepareUploadResult> {\n  const securityResults = await enforceUploadSecurity(filesInput, strapi);\n\n  let filteredBody = body;\n  if (body?.fileInfo) {\n    // Parse JSON strings in fileInfo\n    let parsedFileInfo = body.fileInfo;\n    if (Array.isArray(body.fileInfo)) {\n      parsedFileInfo = body.fileInfo.map((fi: any) =>\n        typeof fi === 'string' ? JSON.parse(fi) : fi\n      );\n    } else if (typeof body.fileInfo === 'string') {\n      parsedFileInfo = JSON.parse(body.fileInfo);\n    }\n\n    // Filter fileInfo by index - only keep entries for files that passed validation\n    if (Array.isArray(parsedFileInfo)) {\n      const invalidIndices = new Set(securityResults.errors.map((e) => e.originalIndex));\n      const filteredFileInfo = parsedFileInfo.filter(\n        (_: any, index: number) => !invalidIndices.has(index)\n      );\n\n      if (filteredFileInfo.length === 1) {\n        filteredBody = {\n          ...body,\n          fileInfo: filteredFileInfo[0],\n        };\n      } else {\n        filteredBody = {\n          ...body,\n          fileInfo: filteredFileInfo,\n        };\n      }\n    } else {\n      filteredBody = {\n        ...body,\n        fileInfo: parsedFileInfo,\n      };\n    }\n  }\n\n  // Map errors to simplified format\n  const uploadErrors: FileUploadError[] = securityResults.errors.map((e) => ({\n    name: e.file?.originalFilename || e.file?.name || 'unknown',\n    message: e.error.message,\n  }));\n\n  return {\n    validFiles: securityResults.validFiles,\n    filteredBody,\n    errors: uploadErrors,\n  };\n}\n"],"names":["readFileChunk","filePath","chunkSize","file","open","buffer","Buffer","alloc","bytesRead","read","subarray","close","detectMimeType","filepath","path","tempFilePath","error","Error","message","String","length","undefined","fileTypeFromBuffer","result","Uint8Array","mime","matchesMimePattern","mimeType","patterns","some","pattern","normalizedPattern","toLowerCase","normalizedMimeType","includes","regexPattern","replace","regex","RegExp","matches","test","exactMatch","validateAllowBanLists","mimetype","fileName","declaredType","detectedType","config","isValid","code","details","reason","allowedTypes","deniedTypes","buildNotAllowedError","Array","isArray","detectedMime","finalType","isDeclaredGeneric","declaredMimeType","extractFileInfo","originalFilename","name","filename","newFilename","originalname","type","validateFile","strapi","fileExt","extname","expectedMimeFromExt","lookup","errMsg","log","warn","declaredMatchesExtension","detectedMatchesDeclared","isZipWithAllowedExt","expectedMimeFromExtension","detectedMatchesExtension","extResult","fileExtension","rejectedType","validateFiles","files","filesArray","get","every","item","errors","ApplicationError","validationPromises","map","index","fileIndex","originalError","Promise","all","enforceUploadSecurity","validationResults","validFiles","validFileNames","entries","detectedMimeType","push","originalIndex","prepareUploadRequest","filesInput","body","securityResults","filteredBody","fileInfo","parsedFileInfo","fi","JSON","parse","invalidIndices","Set","e","filteredFileInfo","filter","_","has","uploadErrors"],"mappings":";;;;;;;AA4BA,eAAeA,aAAAA,CAAcC,QAAgB,EAAEC,SAAAA,GAAoB,IAAI,EAAA;IACrE,MAAMC,IAAAA,GAAO,MAAMC,aAAAA,CAAKH,QAAAA,EAAU,GAAA,CAAA;IAElC,IAAI;QACF,MAAMI,MAAAA,GAASC,MAAAA,CAAOC,KAAK,CAACL,SAAAA,CAAAA;QAC5B,MAAM,EAAEM,SAAS,EAAE,GAAG,MAAML,KAAKM,IAAI,CAACJ,MAAAA,EAAQ,CAAA,EAAGH,SAAAA,EAAW,CAAA,CAAA;QAE5D,OAAOG,MAAAA,CAAOK,QAAQ,CAAC,CAAA,EAAGF,SAAAA,CAAAA;IAC5B,CAAA,QAAU;AACR,QAAA,MAAML,KAAKQ,KAAK,EAAA;AAClB,IAAA;AACF;AAEO,eAAeC,eAAeT,IAAS,EAAA;IAC5C,IAAIE,MAAAA;;IAGJ,MAAMJ,QAAAA,GAAWE,IAAAA,CAAKU,QAAQ,IAAIV,IAAAA,CAAKW,IAAI,IAAIX,IAAAA,CAAKY,YAAY,IAAIZ,IAAAA,CAAKF,QAAQ;AAEjF,IAAA,IAAIA,QAAAA,EAAU;QACZ,IAAI;YACFI,MAAAA,GAAS,MAAML,cAAcC,QAAAA,EAAU,IAAA,CAAA;AACzC,QAAA,CAAA,CAAE,OAAOe,KAAAA,EAAO;YACd,MAAM,IAAIC,KAAAA,CACR,CAAC,qBAAqB,EAAED,KAAAA,YAAiBC,KAAAA,GAAQD,KAAAA,CAAME,OAAO,GAAGC,MAAAA,CAAOH,KAAAA,CAAAA,CAAAA,CAAQ,CAAA;AAEpF,QAAA;IACF,CAAA,MAAO,IAAIb,IAAAA,CAAKE,MAAM,EAAE;AACtBA,QAAAA,MAAAA,GAASF,IAAAA,CAAKE,MAAM,CAACe,MAAM,GAAG,IAAA,GAAOjB,IAAAA,CAAKE,MAAM,CAACK,QAAQ,CAAC,CAAA,EAAG,IAAA,CAAA,GAAQP,KAAKE,MAAM;IAClF,CAAA,MAAO;;QAEL,OAAOgB,SAAAA;AACT,IAAA;IAEA,IAAI;AACF;;;;AAIC,QACD,MAAM,EAAEC,kBAAkB,EAAE,GAAG,MAAM,OAAO,WAAA,CAAA;AAE5C,QAAA,MAAMC,MAAAA,GAAS,MAAMD,kBAAAA,CAAmB,IAAIE,UAAAA,CAAWnB,MAAAA,CAAAA,CAAAA;AACvD,QAAA,OAAOkB,MAAAA,EAAQE,IAAAA;AACjB,IAAA,CAAA,CAAE,OAAOT,KAAAA,EAAO;QACd,MAAM,IAAIC,KAAAA,CACR,CAAC,4BAA4B,EAAED,KAAAA,YAAiBC,KAAAA,GAAQD,KAAAA,CAAME,OAAO,GAAGC,MAAAA,CAAOH,KAAAA,CAAAA,CAAAA,CAAQ,CAAA;AAE3F,IAAA;AACF;AAEA,SAASU,kBAAAA,CAAmBC,QAAgB,EAAEC,QAAkB,EAAA;IAC9D,IAAI,CAACA,QAAAA,EAAUR,MAAAA,EAAQ,OAAO,KAAA;IAE9B,OAAOQ,QAAAA,CAASC,IAAI,CAAC,CAACC,OAAAA,GAAAA;QACpB,MAAMC,iBAAAA,GAAoBD,QAAQE,WAAW,EAAA;QAC7C,MAAMC,kBAAAA,GAAqBN,SAASK,WAAW,EAAA;QAE/C,IAAID,iBAAAA,CAAkBG,QAAQ,CAAC,GAAA,CAAA,EAAM;AACnC,YAAA,MAAMC,YAAAA,GAAeJ,iBAAAA,CAAkBK,OAAO,CAAC,KAAA,EAAO,IAAA,CAAA;YAEtD,MAAMC,KAAAA,GAAQ,IAAIC,MAAAA,CAAO,CAAC,CAAC,EAAEH,YAAAA,CAAa,CAAC,CAAC,CAAA;YAC5C,MAAMI,OAAAA,GAAUF,KAAAA,CAAMG,IAAI,CAACP,kBAAAA,CAAAA;YAC3B,OAAOM,OAAAA;AACT,QAAA;AAEA,QAAA,MAAME,aAAaV,iBAAAA,KAAsBE,kBAAAA;QACzC,OAAOQ,UAAAA;AACT,IAAA,CAAA,CAAA;AACF;AAkBA;;;IAIA,SAASC,qBAAAA,CACPC,QAAgB,EAChBC,QAAgB,EAChBC,YAAoB,EACpBC,YAAgC,EAChCC,MAAsB,EAAA;AAEtB,IAAA,IAAI,CAACJ,QAAAA,EAAU;QACb,OAAO;YACLK,OAAAA,EAAS,KAAA;YACThC,KAAAA,EAAO;gBACLiC,IAAAA,EAAM,uBAAA;gBACN/B,OAAAA,EAAS,0BAAA;gBACTgC,OAAAA,EAAS;AACPN,oBAAAA,QAAAA;oBACAO,MAAAA,EAAQ,0BAAA;AACRN,oBAAAA,YAAAA;AACAC,oBAAAA,YAAAA;AACAM,oBAAAA,YAAAA,EAAcL,OAAOK,YAAY;AACjCC,oBAAAA,WAAAA,EAAaN,OAAOM;AACtB;AACF;AACF,SAAA;AACF,IAAA;IACA,IAAIN,MAAAA,CAAOM,WAAW,EAAEjC,MAAAA,IAAUM,mBAAmBiB,QAAAA,EAAUI,MAAAA,CAAOM,WAAW,CAAA,EAAG;AAClF,QAAA,OAAOC,oBAAAA,CAAqBV,QAAAA,EAAUC,YAAAA,EAAcC,YAAAA,EAAcH,QAAAA,EAAUI,MAAAA,CAAAA;AAC9E,IAAA;AACA,IAAA,IAAI,CAACQ,KAAAA,CAAMC,OAAO,CAACT,MAAAA,CAAOK,YAAY,CAAA,EAAG;QACvC,OAAO;YAAEJ,OAAAA,EAAS,IAAA;YAAMS,YAAAA,EAAcd;AAAS,SAAA;AACjD,IAAA;AACA,IAAA,IAAII,MAAAA,CAAOK,YAAY,CAAChC,MAAM,KAAK,CAAA,EAAG;QACpC,OAAO;YACL4B,OAAAA,EAAS,KAAA;YACThC,KAAAA,EAAO;gBACLiC,IAAAA,EAAM,uBAAA;gBACN/B,OAAAA,EAAS,0BAAA;gBACTgC,OAAAA,EAAS;AACPN,oBAAAA,QAAAA;oBACAO,MAAAA,EAAQ,qBAAA;AACRN,oBAAAA,YAAAA;AACAC,oBAAAA,YAAAA;AACAM,oBAAAA,YAAAA,EAAcL,OAAOK,YAAY;AACjCC,oBAAAA,WAAAA,EAAaN,OAAOM;AACtB;AACF;AACF,SAAA;AACF,IAAA;AACA,IAAA,IAAI3B,kBAAAA,CAAmBiB,QAAAA,EAAUI,MAAAA,CAAOK,YAAY,CAAA,EAAG;QACrD,OAAO;YAAEJ,OAAAA,EAAS,IAAA;YAAMS,YAAAA,EAAcd;AAAS,SAAA;AACjD,IAAA;IACA,OAAO;QACLK,OAAAA,EAAS,KAAA;QACThC,KAAAA,EAAO;YACLiC,IAAAA,EAAM,uBAAA;AACN/B,YAAAA,OAAAA,EAAS,CAAC,WAAW,EAAEyB,QAAAA,CAAS,gBAAgB,CAAC;YACjDO,OAAAA,EAAS;AACPN,gBAAAA,QAAAA;AACAC,gBAAAA,YAAAA;AACAC,gBAAAA,YAAAA;gBACAY,SAAAA,EAAWf,QAAAA;AACXS,gBAAAA,YAAAA,EAAcL,OAAOK,YAAY;AACjCC,gBAAAA,WAAAA,EAAaN,OAAOM;AACtB;AACF;AACF,KAAA;AACF;AAEA,SAASM,kBAAkBC,gBAAwB,EAAA;IACjD,OAAO,CAACA,oBAAoBA,gBAAAA,KAAqB,0BAAA;AACnD;AAEO,SAASC,gBAAgB1D,IAAS,EAAA;AACvC,IAAA,MAAMyC,QAAAA,GACJzC,IAAAA,CAAK2D,gBAAgB,IACrB3D,KAAK4D,IAAI,IACT5D,IAAAA,CAAK6D,QAAQ,IACb7D,IAAAA,CAAK8D,WAAW,IAChB9D,IAAAA,CAAK+D,YAAY,IACjB,SAAA;AACF,IAAA,MAAMN,gBAAAA,GAAmBzD,IAAAA,CAAKwC,QAAQ,IAAIxC,IAAAA,CAAKgE,IAAI,IAAIhE,IAAAA,CAAKwB,QAAQ,IAAIxB,IAAAA,CAAKsB,IAAI,IAAI,EAAA;IAErF,OAAO;AAAEmB,QAAAA,QAAAA;AAAUgB,QAAAA;AAAiB,KAAA;AACtC;AAEO,eAAeQ,YAAAA,CACpBjE,IAAS,EACT4C,MAAsB,EACtBsB,MAAmB,EAAA;AAEnB,IAAA,MAAM,EAAEjB,YAAY,EAAEC,WAAW,EAAE,GAAGN,MAAAA;AAEtC,IAAA,MAAM,EAAEH,QAAQ,EAAEgB,gBAAgB,EAAE,GAAGC,eAAAA,CAAgB1D,IAAAA,CAAAA;IAEvD,MAAMmE,OAAAA,GAAUC,iBAAAA,CAAQ3B,QAAAA,CAAAA,CAAUZ,WAAW,EAAA;AAC7C,IAAA,MAAMwC,mBAAAA,GAAsBF,OAAAA,GAAUG,gBAAAA,CAAOH,OAAAA,CAAAA,IAAY,IAAA,GAAO,IAAA;;AAGhE,IAAA,IACE,CAACX,iBAAAA,CAAkBC,gBAAAA,CAAAA,IACnBP,aAAajC,MAAAA,IACbM,kBAAAA,CAAmBkC,kBAAkBP,WAAAA,CAAAA,EACrC;AACA,QAAA,OAAOC,oBAAAA,CAAqBV,QAAAA,EAAUgB,gBAAAA,EAAkBvC,SAAAA,EAAWuC,gBAAAA,EAAkBb,MAAAA,CAAAA;AACvF,IAAA;;AAGA,IAAA,IACEyB,mBAAAA,IACAnB,WAAAA,EAAajC,MAAAA,IACbM,kBAAAA,CAAmB8C,qBAAqBnB,WAAAA,CAAAA,EACxC;AACA,QAAA,OAAOC,oBAAAA,CAAqBV,QAAAA,EAAUgB,gBAAAA,EAAkBvC,SAAAA,EAAWmD,mBAAAA,EAAqBzB,MAAAA,CAAAA;AAC1F,IAAA;;IAGA,IAAIU,YAAAA;IACJ,IAAI;AACFA,QAAAA,YAAAA,GAAe,MAAM7C,cAAAA,CAAeT,IAAAA,CAAAA;AACtC,IAAA,CAAA,CAAE,OAAOa,KAAAA,EAAO;AACd,QAAA,MAAM0D,SAAS1D,KAAAA,YAAiBC,KAAAA,GAAQD,KAAAA,CAAME,OAAO,GAAGC,MAAAA,CAAOH,KAAAA,CAAAA;QAC/DqD,MAAAA,CAAOM,GAAG,CAACC,IAAI,CAAC,CAAC,sCAAsC,EAAEF,QAAQ,EAAE;AACjE9B,YAAAA,QAAAA;YACA5B,KAAAA,EAAO0D;AACT,SAAA,CAAA;AACF,IAAA;IAEA,MAAMG,wBAAAA,GACJ,CAAClB,iBAAAA,CAAkBC,gBAAAA,CAAAA,IACnBY,mBAAAA,KAAwB,QACxBA,mBAAAA,KAAwBnD,SAAAA,KACvBK,kBAAAA,CAAmBkC,gBAAAA,EAAkB;AAACY,QAAAA;AAAoB,KAAA,CAAA,IACzD9C,mBAAmB8C,mBAAAA,EAAqB;AAACZ,QAAAA;KAAiB,CAAA,CAAA;AAC9D,IAAA,MAAMkB,uBAAAA,GACJrB,YAAAA,IAAgBG,gBAAAA,IAAoBlC,kBAAAA,CAAmB+B,YAAAA,EAAc;AAACG,QAAAA;AAAiB,KAAA,CAAA;;AAGzF,IAAA,IAAIiB,4BAA4BC,uBAAAA,EAAyB;AACvD,QAAA,OAAOpC,qBAAAA,CACLkB,gBAAAA,EACAhB,QAAAA,EACAgB,gBAAAA,EACAH,YAAAA,EACAV,MAAAA,CAAAA;AAEJ,IAAA;;AAGA,IAAA,IAAIU,YAAAA,IAAgBJ,WAAAA,EAAajC,MAAAA,IAAUM,kBAAAA,CAAmB+B,cAAcJ,WAAAA,CAAAA,EAAc;AACxF,QAAA,OAAOC,oBAAAA,CAAqBV,QAAAA,EAAUgB,gBAAAA,EAAkBH,YAAAA,EAAcA,YAAAA,EAAcV,MAAAA,CAAAA;AACtF,IAAA;;;AAIA,IAAA,MAAMgC,mBAAAA,GACJtB,YAAAA,KAAiB,iBAAA,IACjBe,mBAAAA,IACAA,wBAAwB,iBAAA,IACxBjB,KAAAA,CAAMC,OAAO,CAACJ,iBACdA,YAAAA,CAAahC,MAAM,GAAG,CAAA,IACtBM,mBAAmB8C,mBAAAA,EAAqBpB,YAAAA,CAAAA;AAC1C,IAAA,IACEK,YAAAA,IACAF,KAAAA,CAAMC,OAAO,CAACJ,iBACdA,YAAAA,CAAahC,MAAM,GAAG,CAAA,IACtB,CAACM,kBAAAA,CAAmB+B,YAAAA,EAAcL,YAAAA,CAAAA,IAClC,CAAC2B,mBAAAA,EACD;QACA,OAAO;YACL/B,OAAAA,EAAS,KAAA;YACThC,KAAAA,EAAO;gBACLiC,IAAAA,EAAM,uBAAA;gBACN/B,OAAAA,EAAS,0BAAA;gBACTgC,OAAAA,EAAS;AACPN,oBAAAA,QAAAA;oBACAO,MAAAA,EACE,uGAAA;oBACFN,YAAAA,EAAce,gBAAAA;oBACdd,YAAAA,EAAcW,YAAAA;oBACduB,yBAAAA,EAA2BR,mBAAAA;AAC3BpB,oBAAAA,YAAAA;AACAC,oBAAAA;AACF;AACF;AACF,SAAA;AACF,IAAA;;AAGA,IAAA,MAAM4B,2BACJxB,YAAAA,IACAe,mBAAAA,KAAwB,QACxBA,mBAAAA,KAAwBnD,SAAAA,IACxBK,mBAAmB+B,YAAAA,EAAc;AAACe,QAAAA;AAAoB,KAAA,CAAA;AACxD,IAAA,IACEf,iBACC,CAACe,uBAAuBS,wBAAAA,IAA4BtB,iBAAAA,CAAkBC,iBAAgB,CAAA,EACvF;;AAEA,QAAA,IACEH,YAAAA,KAAiB,iBAAA,IACjBe,mBAAAA,IACAA,mBAAAA,KAAwB,iBAAA,EACxB;AACA,YAAA,MAAMU,SAAAA,GAAYxC,qBAAAA,CAChB8B,mBAAAA,EACA5B,QAAAA,EACAgB,kBACAH,YAAAA,EACAV,MAAAA,CAAAA;YAEF,IAAImC,SAAAA,CAAUlC,OAAO,EAAE;AACrBqB,gBAAAA,MAAAA,CAAOM,GAAG,CAACC,IAAI,CACb,iFAAA,EACA;AAAEhC,oBAAAA,QAAAA;oBAAUuC,aAAAA,EAAeb,OAAAA;oBAASU,yBAAAA,EAA2BR;AAAoB,iBAAA,CAAA;gBAErF,OAAOU,SAAAA;AACT,YAAA;AACF,QAAA;AACA,QAAA,OAAOxC,qBAAAA,CAAsBe,YAAAA,EAAcb,QAAAA,EAAUgB,gBAAAA,EAAkBH,YAAAA,EAAcV,MAAAA,CAAAA;AACvF,IAAA;;AAGA,IAAA,IAAIyB,mBAAAA,EAAqB;AACvB,QAAA,OAAO9B,qBAAAA,CACL8B,mBAAAA,EACA5B,QAAAA,EACAgB,gBAAAA,EACAH,YAAAA,EACAV,MAAAA,CAAAA;AAEJ,IAAA;;AAGA,IAAA,IAAIa,gBAAAA,EAAkB;AACpB,QAAA,OAAOlB,qBAAAA,CACLkB,gBAAAA,EACAhB,QAAAA,EACAgB,gBAAAA,EACAH,YAAAA,EACAV,MAAAA,CAAAA;AAEJ,IAAA;;IAGA,OAAO;QACLC,OAAAA,EAAS,KAAA;QACThC,KAAAA,EAAO;YACLiC,IAAAA,EAAM,uBAAA;YACN/B,OAAAA,EAAS,8CAAA;YACTgC,OAAAA,EAAS;AACPN,gBAAAA,QAAAA;gBACAO,MAAAA,EAAQ,yEAAA;gBACRN,YAAAA,EAAce,gBAAAA;gBACdd,YAAAA,EAAcW,YAAAA;AACdL,gBAAAA,YAAAA;AACAC,gBAAAA;AACF;AACF;AACF,KAAA;AACF;AAEA,SAASC,oBAAAA,CACPV,QAAgB,EAChBC,YAAoB,EACpBC,YAAgC,EAChCsC,YAAoB,EACpBrC,MAAsB,EAAA;IAEtB,OAAO;QACLC,OAAAA,EAAS,KAAA;QACThC,KAAAA,EAAO;YACLiC,IAAAA,EAAM,uBAAA;AACN/B,YAAAA,OAAAA,EAAS,CAAC,WAAW,EAAEkE,YAAAA,CAAa,gBAAgB,CAAC;YACrDlC,OAAAA,EAAS;AACPN,gBAAAA,QAAAA;AACAC,gBAAAA,YAAAA;AACAC,gBAAAA,YAAAA;gBACAY,SAAAA,EAAW0B,YAAAA;AACXhC,gBAAAA,YAAAA,EAAcL,OAAOK,YAAY;AACjCC,gBAAAA,WAAAA,EAAaN,OAAOM,WAAW;gBAC/BF,MAAAA,EAAQ;AACV;AACF;AACF,KAAA;AACF;AAEO,eAAekC,aAAAA,CAAcC,KAAU,EAAEjB,MAAmB,EAAA;AACjE,IAAA,MAAMkB,UAAAA,GAAahC,KAAAA,CAAMC,OAAO,CAAC8B,SAASA,KAAAA,GAAQ;AAACA,QAAAA;AAAM,KAAA;IAEzD,IAAI,CAACC,UAAAA,CAAWnE,MAAM,EAAE;AACtB,QAAA,OAAO,EAAE;AACX,IAAA;;AAGA,IAAA,IAAI2B,MAAAA,GAAyBsB,MAAAA,CAAOtB,MAAM,CAACyC,GAAG,CAC5C;AAAC,QAAA,gBAAA;AAAkB,QAAA;AAAW,KAAA,EAC9B,EAAC,CAAA;AAEH,IAAA,IAAI,CAACzC,MAAAA,IAAU,OAAOA,MAAAA,KAAW,QAAA,EAAU;AACzCA,QAAAA,MAAAA,GAAS,EAAC;AACZ,IAAA;IACA,IACEA,MAAAA,CAAOK,YAAY,KAClB,CAACG,KAAAA,CAAMC,OAAO,CAACT,MAAAA,CAAOK,YAAY,CAAA,IACjC,CAACL,MAAAA,CAAOK,YAAY,CAACqC,KAAK,CAAC,CAACC,IAAAA,GAAS,OAAOA,IAAAA,KAAS,QAAA,CAAQ,CAAA,EAC/D;QACA,MAAM,IAAIC,YAAAA,CAAOC,gBAAgB,CAC/B,kEAAA,CAAA;AAEJ,IAAA;IAEA,IACE7C,MAAAA,CAAOM,WAAW,KACjB,CAACE,KAAAA,CAAMC,OAAO,CAACT,MAAAA,CAAOM,WAAW,CAAA,IAChC,CAACN,MAAAA,CAAOM,WAAW,CAACoC,KAAK,CAAC,CAACC,IAAAA,GAAS,OAAOA,IAAAA,KAAS,QAAA,CAAQ,CAAA,EAC9D;QACA,MAAM,IAAIC,YAAAA,CAAOC,gBAAgB,CAC/B,iEAAA,CAAA;AAEJ,IAAA;AAEA,IAAA,IAAI,CAAC7C,MAAAA,CAAOK,YAAY,IAAI,CAACL,MAAAA,CAAOM,WAAW,EAAE;QAC/CgB,MAAAA,CAAOM,GAAG,CAACC,IAAI,CACb,mHAAA,CAAA;;AAGJ,IAAA;AAEA,IAAA,MAAMiB,kBAAAA,GAAqBN,UAAAA,CAAWO,GAAG,CAAC,OAAO3F,IAAAA,EAAM4F,KAAAA,GAAAA;QACrD,IAAI;YACF,OAAO,MAAM3B,YAAAA,CAAajE,IAAAA,EAAM4C,MAAAA,EAAQsB,MAAAA,CAAAA;AAC1C,QAAA,CAAA,CAAE,OAAOrD,KAAAA,EAAO;AACdqD,YAAAA,MAAAA,CAAOM,GAAG,CAAC3D,KAAK,CAAC,yCAAA,EAA2C;gBAC1DgF,SAAAA,EAAWD,KAAAA;gBACXnD,QAAAA,EAAUzC,IAAAA,EAAM4D,QAAQ5D,IAAAA,EAAM+D,YAAAA;AAC9BlD,gBAAAA,KAAAA,EAAOA,KAAAA,YAAiBC,KAAAA,GAAQD,KAAAA,CAAME,OAAO,GAAGC,MAAAA,CAAOH,KAAAA;AACzD,aAAA,CAAA;YAEA,OAAO;gBACLgC,OAAAA,EAAS,KAAA;gBACThC,KAAAA,EAAO;oBACLiC,IAAAA,EAAM,kBAAA;oBACN/B,OAAAA,EAAS,CAAC,oCAAoC,EAAE6E,KAAAA,CAAAA,CAAO;oBACvD7C,OAAAA,EAAS;AACP6C,wBAAAA,KAAAA;wBACAnD,QAAAA,EAAUzC,IAAAA,EAAM4D,QAAQ5D,IAAAA,EAAM+D,YAAAA;AAC9B+B,wBAAAA,aAAAA,EAAejF,KAAAA,YAAiBC,KAAAA,GAAQD,KAAAA,CAAME,OAAO,GAAGC,MAAAA,CAAOH,KAAAA;AACjE;AACF;AACF,aAAA;AACF,QAAA;AACF,IAAA,CAAA,CAAA;IAEA,OAAOkF,OAAAA,CAAQC,GAAG,CAACN,kBAAAA,CAAAA;AACrB;AAEO,eAAeO,qBAAAA,CACpBd,KAAU,EACVjB,MAAmB,EAAA;IAMnB,MAAMgC,iBAAAA,GAAoB,MAAMhB,aAAAA,CAAcC,KAAAA,EAAOjB,MAAAA,CAAAA;AACrD,IAAA,MAAMkB,UAAAA,GAAahC,KAAAA,CAAMC,OAAO,CAAC8B,SAASA,KAAAA,GAAQ;AAACA,QAAAA;AAAM,KAAA;AAEzD,IAAA,MAAMgB,aAAoB,EAAE;AAC5B,IAAA,MAAMC,iBAA2B,EAAE;AACnC,IAAA,MAAMZ,SAA6B,EAAE;AAErC,IAAA,KAAK,MAAM,CAACI,KAAAA,EAAOxE,OAAO,IAAI8E,iBAAAA,CAAkBG,OAAO,EAAA,CAAI;QACzD,IAAIjF,MAAAA,CAAOyB,OAAO,EAAE;YAClB,MAAM7C,IAAAA,GAAOoF,UAAU,CAACQ,KAAAA,CAAM;;YAE9B,IAAIxE,MAAAA,CAAOkC,YAAY,EAAE;gBACvBtD,IAAAA,CAAKsG,gBAAgB,GAAGlF,MAAAA,CAAOkC,YAAY;AAC7C,YAAA;AACA6C,YAAAA,UAAAA,CAAWI,IAAI,CAACvG,IAAAA,CAAAA;AAChBoG,YAAAA,cAAAA,CAAeG,IAAI,CAACvG,IAAAA,CAAK2D,gBAAgB,IAAI3D,KAAK4D,IAAI,CAAA;QACxD,CAAA,MAAO,IAAIxC,MAAAA,CAAOP,KAAK,EAAE;AACvB2E,YAAAA,MAAAA,CAAOe,IAAI,CAAC;gBACVvG,IAAAA,EAAMoF,UAAU,CAACQ,KAAAA,CAAM;gBACvBY,aAAAA,EAAeZ,KAAAA;AACf/E,gBAAAA,KAAAA,EAAOO,OAAOP;AAChB,aAAA,CAAA;QACF,CAAA,MAAO;;AAEL2E,YAAAA,MAAAA,CAAOe,IAAI,CAAC;gBACVvG,IAAAA,EAAMoF,UAAU,CAACQ,KAAAA,CAAM;gBACvBY,aAAAA,EAAeZ,KAAAA;gBACf/E,KAAAA,EAAO;oBACLiC,IAAAA,EAAM,eAAA;oBACN/B,OAAAA,EAAS,2CAAA;oBACTgC,OAAAA,EAAS;AACP6C,wBAAAA,KAAAA;wBACAnD,QAAAA,EAAU2C,UAAU,CAACQ,KAAAA,CAAM,EAAEhC,QAAQwB,UAAU,CAACQ,MAAM,EAAE7B;AAC1D;AACF;AACF,aAAA,CAAA;AACF,QAAA;AACF,IAAA;IAEA,OAAO;AAAEoC,QAAAA,UAAAA;AAAYC,QAAAA,cAAAA;AAAgBZ,QAAAA;AAAO,KAAA;AAC9C;AAaA;;AAEC,IACM,eAAeiB,oBAAAA,CACpBC,UAAe,EACfC,IAAS,EACTzC,MAAmB,EAAA;IAEnB,MAAM0C,eAAAA,GAAkB,MAAMX,qBAAAA,CAAsBS,UAAAA,EAAYxC,MAAAA,CAAAA;AAEhE,IAAA,IAAI2C,YAAAA,GAAeF,IAAAA;AACnB,IAAA,IAAIA,MAAMG,QAAAA,EAAU;;QAElB,IAAIC,cAAAA,GAAiBJ,KAAKG,QAAQ;AAClC,QAAA,IAAI1D,KAAAA,CAAMC,OAAO,CAACsD,IAAAA,CAAKG,QAAQ,CAAA,EAAG;AAChCC,YAAAA,cAAAA,GAAiBJ,IAAAA,CAAKG,QAAQ,CAACnB,GAAG,CAAC,CAACqB,EAAAA,GAClC,OAAOA,EAAAA,KAAO,QAAA,GAAWC,IAAAA,CAAKC,KAAK,CAACF,EAAAA,CAAAA,GAAMA,EAAAA,CAAAA;AAE9C,QAAA,CAAA,MAAO,IAAI,OAAOL,IAAAA,CAAKG,QAAQ,KAAK,QAAA,EAAU;AAC5CC,YAAAA,cAAAA,GAAiBE,IAAAA,CAAKC,KAAK,CAACP,IAAAA,CAAKG,QAAQ,CAAA;AAC3C,QAAA;;QAGA,IAAI1D,KAAAA,CAAMC,OAAO,CAAC0D,cAAAA,CAAAA,EAAiB;YACjC,MAAMI,cAAAA,GAAiB,IAAIC,GAAAA,CAAIR,eAAAA,CAAgBpB,MAAM,CAACG,GAAG,CAAC,CAAC0B,CAAAA,GAAMA,CAAAA,CAAEb,aAAa,CAAA,CAAA;YAChF,MAAMc,gBAAAA,GAAmBP,cAAAA,CAAeQ,MAAM,CAC5C,CAACC,GAAQ5B,KAAAA,GAAkB,CAACuB,cAAAA,CAAeM,GAAG,CAAC7B,KAAAA,CAAAA,CAAAA;YAGjD,IAAI0B,gBAAAA,CAAiBrG,MAAM,KAAK,CAAA,EAAG;gBACjC4F,YAAAA,GAAe;AACb,oBAAA,GAAGF,IAAI;oBACPG,QAAAA,EAAUQ,gBAAgB,CAAC,CAAA;AAC7B,iBAAA;YACF,CAAA,MAAO;gBACLT,YAAAA,GAAe;AACb,oBAAA,GAAGF,IAAI;oBACPG,QAAAA,EAAUQ;AACZ,iBAAA;AACF,YAAA;QACF,CAAA,MAAO;YACLT,YAAAA,GAAe;AACb,gBAAA,GAAGF,IAAI;gBACPG,QAAAA,EAAUC;AACZ,aAAA;AACF,QAAA;AACF,IAAA;;IAGA,MAAMW,YAAAA,GAAkCd,gBAAgBpB,MAAM,CAACG,GAAG,CAAC,CAAC0B,KAAO;AACzEzD,YAAAA,IAAAA,EAAMyD,EAAErH,IAAI,EAAE2D,oBAAoB0D,CAAAA,CAAErH,IAAI,EAAE4D,IAAAA,IAAQ,SAAA;YAClD7C,OAAAA,EAASsG,CAAAA,CAAExG,KAAK,CAACE;SACnB,CAAA,CAAA;IAEA,OAAO;AACLoF,QAAAA,UAAAA,EAAYS,gBAAgBT,UAAU;AACtCU,QAAAA,YAAAA;QACArB,MAAAA,EAAQkC;AACV,KAAA;AACF;;;;;;;;;"}
+{"version":3,"file":"mime-validation.js","sources":["../../../server/src/utils/mime-validation.ts"],"sourcesContent":["import { open } from 'node:fs/promises';\nimport { extname } from 'node:path';\nimport { lookup } from 'mime-types';\nimport type { Core } from '@strapi/types';\nimport { errors } from '@strapi/utils';\n\nexport type SecurityConfig = {\n  allowedTypes?: string[];\n  deniedTypes?: string[];\n};\ntype UploadValidationError = {\n  code: 'MIME_TYPE_NOT_ALLOWED' | 'VALIDATION_ERROR' | 'UNKNOWN_ERROR';\n  message: string;\n  details: Record<string, any>;\n};\n\ntype ValidationResult = {\n  isValid: boolean;\n  error?: UploadValidationError;\n  detectedMime?: string;\n};\n\ntype ErrorDetail = {\n  file: any;\n  originalIndex: number;\n  error: UploadValidationError;\n};\n\nasync function readFileChunk(filePath: string, chunkSize: number = 4100): Promise<Buffer> {\n  const file = await open(filePath, 'r');\n\n  try {\n    const buffer = Buffer.alloc(chunkSize);\n    const { bytesRead } = await file.read(buffer, 0, chunkSize, 0);\n\n    return buffer.subarray(0, bytesRead);\n  } finally {\n    await file.close();\n  }\n}\n\nexport async function detectMimeType(file: any): Promise<string | undefined> {\n  let buffer: Buffer;\n\n  // Support multiple property names used by different multipart parsers (formidable uses filepath)\n  const filePath = file.filepath ?? file.path ?? file.tempFilePath ?? file.filePath;\n\n  if (filePath) {\n    try {\n      buffer = await readFileChunk(filePath, 4100);\n    } catch (error) {\n      throw new Error(\n        `Failed to read file: ${error instanceof Error ? error.message : String(error)}`\n      );\n    }\n  } else if (file.buffer) {\n    buffer = file.buffer.length > 4100 ? file.buffer.subarray(0, 4100) : file.buffer;\n  } else {\n    // No file path or buffer; cannot detect MIME. Validation will use declared/extension or reject.\n    return undefined;\n  }\n\n  try {\n    /**\n     * Use dynamic import to support file-type which is ESM-only\n     * Static imports fail during CommonJS build since bundler can't transform ESM-only packages\n     * @see https://gist.github.com/sindresorhus/a39789f98801d908bbc7ff3ecc99d99c\n     */\n    const { fileTypeFromBuffer } = await import('file-type');\n\n    const result = await fileTypeFromBuffer(new Uint8Array(buffer));\n    return result?.mime;\n  } catch (error) {\n    throw new Error(\n      `Failed to detect MIME type: ${error instanceof Error ? error.message : String(error)}`\n    );\n  }\n}\n\nfunction matchesMimePattern(mimeType: string, patterns: string[]): boolean {\n  if (!patterns?.length) return false;\n\n  return patterns.some((pattern) => {\n    const normalizedPattern = pattern.toLowerCase();\n    const normalizedMimeType = mimeType.toLowerCase();\n\n    if (normalizedPattern.includes('*')) {\n      const regexPattern = normalizedPattern.replace(/\\*/g, '.*');\n\n      const regex = new RegExp(`^${regexPattern}$`);\n      const matches = regex.test(normalizedMimeType);\n      return matches;\n    }\n\n    const exactMatch = normalizedPattern === normalizedMimeType;\n    return exactMatch;\n  });\n}\n\nexport function isMimeTypeAllowed(mimeType: string, config: SecurityConfig): boolean {\n  const { allowedTypes, deniedTypes } = config;\n\n  if (!mimeType) return false;\n\n  if (deniedTypes?.length && matchesMimePattern(mimeType, deniedTypes)) {\n    return false;\n  }\n\n  if (Array.isArray(allowedTypes)) {\n    return allowedTypes.length > 0 && matchesMimePattern(mimeType, allowedTypes);\n  }\n\n  return true;\n}\n\n/**\n * Single gate for allow/deny. Returns ValidationResult.\n * Doc: docs/docs/01-core/upload/01-backend/01-mime-validation.md\n */\nfunction validateAllowBanLists(\n  mimetype: string,\n  fileName: string,\n  declaredType: string,\n  detectedType: string | undefined,\n  config: SecurityConfig\n): ValidationResult {\n  if (!mimetype) {\n    return {\n      isValid: false,\n      error: {\n        code: 'MIME_TYPE_NOT_ALLOWED',\n        message: 'MIME type is not allowed',\n        details: {\n          fileName,\n          reason: 'No MIME type to validate',\n          declaredType,\n          detectedType,\n          allowedTypes: config.allowedTypes,\n          deniedTypes: config.deniedTypes,\n        },\n      },\n    };\n  }\n  if (config.deniedTypes?.length && matchesMimePattern(mimetype, config.deniedTypes)) {\n    return buildNotAllowedError(fileName, declaredType, detectedType, mimetype, config);\n  }\n  if (!Array.isArray(config.allowedTypes)) {\n    return { isValid: true, detectedMime: mimetype };\n  }\n  if (config.allowedTypes.length === 0) {\n    return {\n      isValid: false,\n      error: {\n        code: 'MIME_TYPE_NOT_ALLOWED',\n        message: 'MIME type is not allowed',\n        details: {\n          fileName,\n          reason: 'Allow list is empty',\n          declaredType,\n          detectedType,\n          allowedTypes: config.allowedTypes,\n          deniedTypes: config.deniedTypes,\n        },\n      },\n    };\n  }\n  if (matchesMimePattern(mimetype, config.allowedTypes)) {\n    return { isValid: true, detectedMime: mimetype };\n  }\n  return {\n    isValid: false,\n    error: {\n      code: 'MIME_TYPE_NOT_ALLOWED',\n      message: `File type '${mimetype}' is not allowed`,\n      details: {\n        fileName,\n        declaredType,\n        detectedType,\n        finalType: mimetype,\n        allowedTypes: config.allowedTypes,\n        deniedTypes: config.deniedTypes,\n      },\n    },\n  };\n}\n\nfunction isDeclaredGeneric(declaredMimeType: string): boolean {\n  return !declaredMimeType || declaredMimeType === 'application/octet-stream';\n}\n\nexport function extractFileInfo(file: any) {\n  const fileName =\n    file.originalFilename ||\n    file.name ||\n    file.filename ||\n    file.newFilename ||\n    file.originalname ||\n    'unknown';\n  const declaredMimeType = file.mimetype || file.type || file.mimeType || file.mime || '';\n\n  return { fileName, declaredMimeType };\n}\n\nexport async function validateFile(\n  file: any,\n  config: SecurityConfig,\n  strapi: Core.Strapi\n): Promise<ValidationResult> {\n  const { allowedTypes, deniedTypes } = config;\n\n  const { fileName, declaredMimeType } = extractFileInfo(file);\n\n  const fileExt = extname(fileName).toLowerCase();\n  const expectedMimeFromExt = fileExt ? lookup(fileExt) || null : null;\n\n  // Reject if declared type is denied.\n  if (\n    !isDeclaredGeneric(declaredMimeType) &&\n    deniedTypes?.length &&\n    matchesMimePattern(declaredMimeType, deniedTypes)\n  ) {\n    return buildNotAllowedError(fileName, declaredMimeType, undefined, declaredMimeType, config);\n  }\n\n  // Reject if extension's type is denied.\n  if (\n    expectedMimeFromExt &&\n    deniedTypes?.length &&\n    matchesMimePattern(expectedMimeFromExt, deniedTypes)\n  ) {\n    return buildNotAllowedError(fileName, declaredMimeType, undefined, expectedMimeFromExt, config);\n  }\n\n  // Run content detection.\n  let detectedMime: string | undefined;\n  try {\n    detectedMime = await detectMimeType(file);\n  } catch (error) {\n    const errMsg = error instanceof Error ? error.message : String(error);\n    strapi.log.warn(`Failed to detect MIME type from file: ${errMsg}`, {\n      fileName,\n      error: errMsg,\n    });\n  }\n\n  const declaredMatchesExtension =\n    !isDeclaredGeneric(declaredMimeType) &&\n    expectedMimeFromExt !== null &&\n    expectedMimeFromExt !== undefined &&\n    (matchesMimePattern(declaredMimeType, [expectedMimeFromExt]) ||\n      matchesMimePattern(expectedMimeFromExt, [declaredMimeType]));\n  const detectedMatchesDeclared =\n    detectedMime && declaredMimeType && matchesMimePattern(detectedMime, [declaredMimeType]);\n\n  // Trusted declaration: declared matches extension and detection confirms.\n  if (declaredMatchesExtension && detectedMatchesDeclared) {\n    return validateAllowBanLists(\n      declaredMimeType,\n      fileName,\n      declaredMimeType,\n      detectedMime,\n      config\n    );\n  }\n\n  // Reject if detected type is denied.\n  if (detectedMime && deniedTypes?.length && matchesMimePattern(detectedMime, deniedTypes)) {\n    return buildNotAllowedError(fileName, declaredMimeType, detectedMime, detectedMime, config);\n  }\n\n  // Reject if detected is not in allow list (extension/declared cannot override).\n  // Exception: file-type often returns application/zip for Office formats (docx, xlsx); skip so the next block can allow via extension type.\n  const isZipWithAllowedExt =\n    detectedMime === 'application/zip' &&\n    expectedMimeFromExt &&\n    expectedMimeFromExt !== 'application/zip' &&\n    Array.isArray(allowedTypes) &&\n    allowedTypes.length > 0 &&\n    matchesMimePattern(expectedMimeFromExt, allowedTypes);\n  // Exception: file-type often returns application/xml for SVG; trust .svg extension when image/svg+xml is allowed.\n  const isSvgXmlWithAllowedExt =\n    detectedMime === 'application/xml' &&\n    fileExt === '.svg' &&\n    expectedMimeFromExt === 'image/svg+xml' &&\n    Array.isArray(allowedTypes) &&\n    allowedTypes.length > 0 &&\n    matchesMimePattern(expectedMimeFromExt, allowedTypes);\n  if (\n    detectedMime &&\n    Array.isArray(allowedTypes) &&\n    allowedTypes.length > 0 &&\n    !matchesMimePattern(detectedMime, allowedTypes) &&\n    !isZipWithAllowedExt &&\n    !isSvgXmlWithAllowedExt\n  ) {\n    return {\n      isValid: false,\n      error: {\n        code: 'MIME_TYPE_NOT_ALLOWED',\n        message: 'MIME type is not allowed',\n        details: {\n          fileName,\n          reason:\n            'File content was detected as a type not in the allow list; extension or declared type cannot override',\n          declaredType: declaredMimeType,\n          detectedType: detectedMime,\n          expectedMimeFromExtension: expectedMimeFromExt,\n          allowedTypes,\n          deniedTypes,\n        },\n      },\n    };\n  }\n\n  // Use detected type when defined and (no extension, or detected matches extension, or declared is generic).\n  const detectedMatchesExtension =\n    detectedMime &&\n    expectedMimeFromExt !== null &&\n    expectedMimeFromExt !== undefined &&\n    matchesMimePattern(detectedMime, [expectedMimeFromExt]);\n  if (\n    detectedMime &&\n    (!expectedMimeFromExt || detectedMatchesExtension || isDeclaredGeneric(declaredMimeType))\n  ) {\n    // Office/zip exception: use extension type when detection returned application/zip and extension is in allow list.\n    if (\n      detectedMime === 'application/zip' &&\n      expectedMimeFromExt &&\n      expectedMimeFromExt !== 'application/zip'\n    ) {\n      const extResult = validateAllowBanLists(\n        expectedMimeFromExt,\n        fileName,\n        declaredMimeType,\n        detectedMime,\n        config\n      );\n      if (extResult.isValid) {\n        strapi.log.warn(\n          'MIME type detection returned application/zip; trusting extension for allow list',\n          { fileName, fileExtension: fileExt, expectedMimeFromExtension: expectedMimeFromExt }\n        );\n        return extResult;\n      }\n    }\n    return validateAllowBanLists(detectedMime, fileName, declaredMimeType, detectedMime, config);\n  }\n\n  // Use extension's type when present.\n  if (expectedMimeFromExt) {\n    return validateAllowBanLists(\n      expectedMimeFromExt,\n      fileName,\n      declaredMimeType,\n      detectedMime,\n      config\n    );\n  }\n\n  // Use declared type as last resort.\n  if (declaredMimeType) {\n    return validateAllowBanLists(\n      declaredMimeType,\n      fileName,\n      declaredMimeType,\n      detectedMime,\n      config\n    );\n  }\n\n  // Reject when no type can be chosen.\n  return {\n    isValid: false,\n    error: {\n      code: 'MIME_TYPE_NOT_ALLOWED',\n      message: 'Cannot verify file type for security reasons',\n      details: {\n        fileName,\n        reason: 'No MIME type to validate (no declared type, no extension, no detection)',\n        declaredType: declaredMimeType,\n        detectedType: detectedMime,\n        allowedTypes,\n        deniedTypes,\n      },\n    },\n  };\n}\n\nfunction buildNotAllowedError(\n  fileName: string,\n  declaredType: string,\n  detectedType: string | undefined,\n  rejectedType: string,\n  config: SecurityConfig\n): ValidationResult {\n  return {\n    isValid: false,\n    error: {\n      code: 'MIME_TYPE_NOT_ALLOWED',\n      message: `File type '${rejectedType}' is not allowed`,\n      details: {\n        fileName,\n        declaredType,\n        detectedType,\n        finalType: rejectedType,\n        allowedTypes: config.allowedTypes,\n        deniedTypes: config.deniedTypes,\n        reason: 'MIME type is in the denied list',\n      },\n    },\n  };\n}\n\nexport async function validateFiles(files: any, strapi: Core.Strapi): Promise<ValidationResult[]> {\n  const filesArray = Array.isArray(files) ? files : [files];\n\n  if (!filesArray.length) {\n    return [];\n  }\n\n  // Use array path so 'plugin::upload' is a single key (lodash string path splits on '.')\n  let config: SecurityConfig = strapi.config.get(\n    ['plugin::upload', 'security'],\n    {}\n  ) as SecurityConfig;\n  if (!config || typeof config !== 'object') {\n    config = {};\n  }\n  if (\n    config.allowedTypes &&\n    (!Array.isArray(config.allowedTypes) ||\n      !config.allowedTypes.every((item) => typeof item === 'string'))\n  ) {\n    throw new errors.ApplicationError(\n      'Invalid configuration: allowedTypes must be an array of strings.'\n    );\n  }\n\n  if (\n    config.deniedTypes &&\n    (!Array.isArray(config.deniedTypes) ||\n      !config.deniedTypes.every((item) => typeof item === 'string'))\n  ) {\n    throw new errors.ApplicationError(\n      'Invalid configuration: deniedTypes must be an array of strings.'\n    );\n  }\n\n  if (!config.allowedTypes && !config.deniedTypes) {\n    strapi.log.warn(\n      'No upload security configuration found. Consider configuring plugin.upload.security for enhanced file validation.'\n    );\n    // Do not return; we still run validation so MIME detection runs and stored file gets detected type when possible\n  }\n\n  const validationPromises = filesArray.map(async (file, index) => {\n    try {\n      return await validateFile(file, config, strapi);\n    } catch (error) {\n      strapi.log.error('Unexpected error during file validation', {\n        fileIndex: index,\n        fileName: file?.name || file?.originalname,\n        error: error instanceof Error ? error.message : String(error),\n      });\n\n      return {\n        isValid: false,\n        error: {\n          code: 'VALIDATION_ERROR' as const,\n          message: `Validation failed for file at index ${index}`,\n          details: {\n            index,\n            fileName: file?.name || file?.originalname,\n            originalError: error instanceof Error ? error.message : String(error),\n          },\n        },\n      };\n    }\n  });\n\n  return Promise.all(validationPromises);\n}\n\nexport async function enforceUploadSecurity(\n  files: any,\n  strapi: Core.Strapi\n): Promise<{\n  validFiles: any[];\n  validFileNames: string[];\n  errors: Array<ErrorDetail>;\n}> {\n  const validationResults = await validateFiles(files, strapi);\n  const filesArray = Array.isArray(files) ? files : [files];\n\n  const validFiles: any[] = [];\n  const validFileNames: string[] = [];\n  const errors: Array<ErrorDetail> = [];\n\n  for (const [index, result] of validationResults.entries()) {\n    if (result.isValid) {\n      const file = filesArray[index];\n      // Enrich file with detected MIME type for use in storage\n      if (result.detectedMime) {\n        file.detectedMimeType = result.detectedMime;\n      }\n      validFiles.push(file);\n      validFileNames.push(file.originalFilename || file.name);\n    } else if (result.error) {\n      errors.push({\n        file: filesArray[index],\n        originalIndex: index,\n        error: result.error,\n      });\n    } else {\n      // Handle case where validation failed but no error details are provided\n      errors.push({\n        file: filesArray[index],\n        originalIndex: index,\n        error: {\n          code: 'UNKNOWN_ERROR' as const,\n          message: 'File validation failed for unknown reason',\n          details: {\n            index,\n            fileName: filesArray[index]?.name || filesArray[index]?.originalname,\n          },\n        },\n      });\n    }\n  }\n\n  return { validFiles, validFileNames, errors };\n}\n\nexport type FileUploadError = {\n  name: string;\n  message: string;\n};\n\nexport type PrepareUploadResult = {\n  validFiles: any[];\n  filteredBody: any;\n  errors: FileUploadError[];\n};\n\n/**\n * Prepare files and body for upload by enforcing security and parsing fileInfo\n */\nexport async function prepareUploadRequest(\n  filesInput: any,\n  body: any,\n  strapi: Core.Strapi\n): Promise<PrepareUploadResult> {\n  const securityResults = await enforceUploadSecurity(filesInput, strapi);\n\n  let filteredBody = body;\n  if (body?.fileInfo) {\n    // Parse JSON strings in fileInfo\n    let parsedFileInfo = body.fileInfo;\n    if (Array.isArray(body.fileInfo)) {\n      parsedFileInfo = body.fileInfo.map((fi: any) =>\n        typeof fi === 'string' ? JSON.parse(fi) : fi\n      );\n    } else if (typeof body.fileInfo === 'string') {\n      parsedFileInfo = JSON.parse(body.fileInfo);\n    }\n\n    // Filter fileInfo by index - only keep entries for files that passed validation\n    if (Array.isArray(parsedFileInfo)) {\n      const invalidIndices = new Set(securityResults.errors.map((e) => e.originalIndex));\n      const filteredFileInfo = parsedFileInfo.filter(\n        (_: any, index: number) => !invalidIndices.has(index)\n      );\n\n      if (filteredFileInfo.length === 1) {\n        filteredBody = {\n          ...body,\n          fileInfo: filteredFileInfo[0],\n        };\n      } else {\n        filteredBody = {\n          ...body,\n          fileInfo: filteredFileInfo,\n        };\n      }\n    } else {\n      filteredBody = {\n        ...body,\n        fileInfo: parsedFileInfo,\n      };\n    }\n  }\n\n  // Map errors to simplified format\n  const uploadErrors: FileUploadError[] = securityResults.errors.map((e) => ({\n    name: e.file?.originalFilename || e.file?.name || 'unknown',\n    message: e.error.message,\n  }));\n\n  return {\n    validFiles: securityResults.validFiles,\n    filteredBody,\n    errors: uploadErrors,\n  };\n}\n"],"names":["readFileChunk","filePath","chunkSize","file","open","buffer","Buffer","alloc","bytesRead","read","subarray","close","detectMimeType","filepath","path","tempFilePath","error","Error","message","String","length","undefined","fileTypeFromBuffer","result","Uint8Array","mime","matchesMimePattern","mimeType","patterns","some","pattern","normalizedPattern","toLowerCase","normalizedMimeType","includes","regexPattern","replace","regex","RegExp","matches","test","exactMatch","validateAllowBanLists","mimetype","fileName","declaredType","detectedType","config","isValid","code","details","reason","allowedTypes","deniedTypes","buildNotAllowedError","Array","isArray","detectedMime","finalType","isDeclaredGeneric","declaredMimeType","extractFileInfo","originalFilename","name","filename","newFilename","originalname","type","validateFile","strapi","fileExt","extname","expectedMimeFromExt","lookup","errMsg","log","warn","declaredMatchesExtension","detectedMatchesDeclared","isZipWithAllowedExt","isSvgXmlWithAllowedExt","expectedMimeFromExtension","detectedMatchesExtension","extResult","fileExtension","rejectedType","validateFiles","files","filesArray","get","every","item","errors","ApplicationError","validationPromises","map","index","fileIndex","originalError","Promise","all","enforceUploadSecurity","validationResults","validFiles","validFileNames","entries","detectedMimeType","push","originalIndex","prepareUploadRequest","filesInput","body","securityResults","filteredBody","fileInfo","parsedFileInfo","fi","JSON","parse","invalidIndices","Set","e","filteredFileInfo","filter","_","has","uploadErrors"],"mappings":";;;;;;;AA4BA,eAAeA,aAAAA,CAAcC,QAAgB,EAAEC,SAAAA,GAAoB,IAAI,EAAA;IACrE,MAAMC,IAAAA,GAAO,MAAMC,aAAAA,CAAKH,QAAAA,EAAU,GAAA,CAAA;IAElC,IAAI;QACF,MAAMI,MAAAA,GAASC,MAAAA,CAAOC,KAAK,CAACL,SAAAA,CAAAA;QAC5B,MAAM,EAAEM,SAAS,EAAE,GAAG,MAAML,KAAKM,IAAI,CAACJ,MAAAA,EAAQ,CAAA,EAAGH,SAAAA,EAAW,CAAA,CAAA;QAE5D,OAAOG,MAAAA,CAAOK,QAAQ,CAAC,CAAA,EAAGF,SAAAA,CAAAA;IAC5B,CAAA,QAAU;AACR,QAAA,MAAML,KAAKQ,KAAK,EAAA;AAClB,IAAA;AACF;AAEO,eAAeC,eAAeT,IAAS,EAAA;IAC5C,IAAIE,MAAAA;;IAGJ,MAAMJ,QAAAA,GAAWE,IAAAA,CAAKU,QAAQ,IAAIV,IAAAA,CAAKW,IAAI,IAAIX,IAAAA,CAAKY,YAAY,IAAIZ,IAAAA,CAAKF,QAAQ;AAEjF,IAAA,IAAIA,QAAAA,EAAU;QACZ,IAAI;YACFI,MAAAA,GAAS,MAAML,cAAcC,QAAAA,EAAU,IAAA,CAAA;AACzC,QAAA,CAAA,CAAE,OAAOe,KAAAA,EAAO;YACd,MAAM,IAAIC,KAAAA,CACR,CAAC,qBAAqB,EAAED,KAAAA,YAAiBC,KAAAA,GAAQD,KAAAA,CAAME,OAAO,GAAGC,MAAAA,CAAOH,KAAAA,CAAAA,CAAAA,CAAQ,CAAA;AAEpF,QAAA;IACF,CAAA,MAAO,IAAIb,IAAAA,CAAKE,MAAM,EAAE;AACtBA,QAAAA,MAAAA,GAASF,IAAAA,CAAKE,MAAM,CAACe,MAAM,GAAG,IAAA,GAAOjB,IAAAA,CAAKE,MAAM,CAACK,QAAQ,CAAC,CAAA,EAAG,IAAA,CAAA,GAAQP,KAAKE,MAAM;IAClF,CAAA,MAAO;;QAEL,OAAOgB,SAAAA;AACT,IAAA;IAEA,IAAI;AACF;;;;AAIC,QACD,MAAM,EAAEC,kBAAkB,EAAE,GAAG,MAAM,OAAO,WAAA,CAAA;AAE5C,QAAA,MAAMC,MAAAA,GAAS,MAAMD,kBAAAA,CAAmB,IAAIE,UAAAA,CAAWnB,MAAAA,CAAAA,CAAAA;AACvD,QAAA,OAAOkB,MAAAA,EAAQE,IAAAA;AACjB,IAAA,CAAA,CAAE,OAAOT,KAAAA,EAAO;QACd,MAAM,IAAIC,KAAAA,CACR,CAAC,4BAA4B,EAAED,KAAAA,YAAiBC,KAAAA,GAAQD,KAAAA,CAAME,OAAO,GAAGC,MAAAA,CAAOH,KAAAA,CAAAA,CAAAA,CAAQ,CAAA;AAE3F,IAAA;AACF;AAEA,SAASU,kBAAAA,CAAmBC,QAAgB,EAAEC,QAAkB,EAAA;IAC9D,IAAI,CAACA,QAAAA,EAAUR,MAAAA,EAAQ,OAAO,KAAA;IAE9B,OAAOQ,QAAAA,CAASC,IAAI,CAAC,CAACC,OAAAA,GAAAA;QACpB,MAAMC,iBAAAA,GAAoBD,QAAQE,WAAW,EAAA;QAC7C,MAAMC,kBAAAA,GAAqBN,SAASK,WAAW,EAAA;QAE/C,IAAID,iBAAAA,CAAkBG,QAAQ,CAAC,GAAA,CAAA,EAAM;AACnC,YAAA,MAAMC,YAAAA,GAAeJ,iBAAAA,CAAkBK,OAAO,CAAC,KAAA,EAAO,IAAA,CAAA;YAEtD,MAAMC,KAAAA,GAAQ,IAAIC,MAAAA,CAAO,CAAC,CAAC,EAAEH,YAAAA,CAAa,CAAC,CAAC,CAAA;YAC5C,MAAMI,OAAAA,GAAUF,KAAAA,CAAMG,IAAI,CAACP,kBAAAA,CAAAA;YAC3B,OAAOM,OAAAA;AACT,QAAA;AAEA,QAAA,MAAME,aAAaV,iBAAAA,KAAsBE,kBAAAA;QACzC,OAAOQ,UAAAA;AACT,IAAA,CAAA,CAAA;AACF;AAkBA;;;IAIA,SAASC,qBAAAA,CACPC,QAAgB,EAChBC,QAAgB,EAChBC,YAAoB,EACpBC,YAAgC,EAChCC,MAAsB,EAAA;AAEtB,IAAA,IAAI,CAACJ,QAAAA,EAAU;QACb,OAAO;YACLK,OAAAA,EAAS,KAAA;YACThC,KAAAA,EAAO;gBACLiC,IAAAA,EAAM,uBAAA;gBACN/B,OAAAA,EAAS,0BAAA;gBACTgC,OAAAA,EAAS;AACPN,oBAAAA,QAAAA;oBACAO,MAAAA,EAAQ,0BAAA;AACRN,oBAAAA,YAAAA;AACAC,oBAAAA,YAAAA;AACAM,oBAAAA,YAAAA,EAAcL,OAAOK,YAAY;AACjCC,oBAAAA,WAAAA,EAAaN,OAAOM;AACtB;AACF;AACF,SAAA;AACF,IAAA;IACA,IAAIN,MAAAA,CAAOM,WAAW,EAAEjC,MAAAA,IAAUM,mBAAmBiB,QAAAA,EAAUI,MAAAA,CAAOM,WAAW,CAAA,EAAG;AAClF,QAAA,OAAOC,oBAAAA,CAAqBV,QAAAA,EAAUC,YAAAA,EAAcC,YAAAA,EAAcH,QAAAA,EAAUI,MAAAA,CAAAA;AAC9E,IAAA;AACA,IAAA,IAAI,CAACQ,KAAAA,CAAMC,OAAO,CAACT,MAAAA,CAAOK,YAAY,CAAA,EAAG;QACvC,OAAO;YAAEJ,OAAAA,EAAS,IAAA;YAAMS,YAAAA,EAAcd;AAAS,SAAA;AACjD,IAAA;AACA,IAAA,IAAII,MAAAA,CAAOK,YAAY,CAAChC,MAAM,KAAK,CAAA,EAAG;QACpC,OAAO;YACL4B,OAAAA,EAAS,KAAA;YACThC,KAAAA,EAAO;gBACLiC,IAAAA,EAAM,uBAAA;gBACN/B,OAAAA,EAAS,0BAAA;gBACTgC,OAAAA,EAAS;AACPN,oBAAAA,QAAAA;oBACAO,MAAAA,EAAQ,qBAAA;AACRN,oBAAAA,YAAAA;AACAC,oBAAAA,YAAAA;AACAM,oBAAAA,YAAAA,EAAcL,OAAOK,YAAY;AACjCC,oBAAAA,WAAAA,EAAaN,OAAOM;AACtB;AACF;AACF,SAAA;AACF,IAAA;AACA,IAAA,IAAI3B,kBAAAA,CAAmBiB,QAAAA,EAAUI,MAAAA,CAAOK,YAAY,CAAA,EAAG;QACrD,OAAO;YAAEJ,OAAAA,EAAS,IAAA;YAAMS,YAAAA,EAAcd;AAAS,SAAA;AACjD,IAAA;IACA,OAAO;QACLK,OAAAA,EAAS,KAAA;QACThC,KAAAA,EAAO;YACLiC,IAAAA,EAAM,uBAAA;AACN/B,YAAAA,OAAAA,EAAS,CAAC,WAAW,EAAEyB,QAAAA,CAAS,gBAAgB,CAAC;YACjDO,OAAAA,EAAS;AACPN,gBAAAA,QAAAA;AACAC,gBAAAA,YAAAA;AACAC,gBAAAA,YAAAA;gBACAY,SAAAA,EAAWf,QAAAA;AACXS,gBAAAA,YAAAA,EAAcL,OAAOK,YAAY;AACjCC,gBAAAA,WAAAA,EAAaN,OAAOM;AACtB;AACF;AACF,KAAA;AACF;AAEA,SAASM,kBAAkBC,gBAAwB,EAAA;IACjD,OAAO,CAACA,oBAAoBA,gBAAAA,KAAqB,0BAAA;AACnD;AAEO,SAASC,gBAAgB1D,IAAS,EAAA;AACvC,IAAA,MAAMyC,QAAAA,GACJzC,IAAAA,CAAK2D,gBAAgB,IACrB3D,KAAK4D,IAAI,IACT5D,IAAAA,CAAK6D,QAAQ,IACb7D,IAAAA,CAAK8D,WAAW,IAChB9D,IAAAA,CAAK+D,YAAY,IACjB,SAAA;AACF,IAAA,MAAMN,gBAAAA,GAAmBzD,IAAAA,CAAKwC,QAAQ,IAAIxC,IAAAA,CAAKgE,IAAI,IAAIhE,IAAAA,CAAKwB,QAAQ,IAAIxB,IAAAA,CAAKsB,IAAI,IAAI,EAAA;IAErF,OAAO;AAAEmB,QAAAA,QAAAA;AAAUgB,QAAAA;AAAiB,KAAA;AACtC;AAEO,eAAeQ,YAAAA,CACpBjE,IAAS,EACT4C,MAAsB,EACtBsB,MAAmB,EAAA;AAEnB,IAAA,MAAM,EAAEjB,YAAY,EAAEC,WAAW,EAAE,GAAGN,MAAAA;AAEtC,IAAA,MAAM,EAAEH,QAAQ,EAAEgB,gBAAgB,EAAE,GAAGC,eAAAA,CAAgB1D,IAAAA,CAAAA;IAEvD,MAAMmE,OAAAA,GAAUC,iBAAAA,CAAQ3B,QAAAA,CAAAA,CAAUZ,WAAW,EAAA;AAC7C,IAAA,MAAMwC,mBAAAA,GAAsBF,OAAAA,GAAUG,gBAAAA,CAAOH,OAAAA,CAAAA,IAAY,IAAA,GAAO,IAAA;;AAGhE,IAAA,IACE,CAACX,iBAAAA,CAAkBC,gBAAAA,CAAAA,IACnBP,aAAajC,MAAAA,IACbM,kBAAAA,CAAmBkC,kBAAkBP,WAAAA,CAAAA,EACrC;AACA,QAAA,OAAOC,oBAAAA,CAAqBV,QAAAA,EAAUgB,gBAAAA,EAAkBvC,SAAAA,EAAWuC,gBAAAA,EAAkBb,MAAAA,CAAAA;AACvF,IAAA;;AAGA,IAAA,IACEyB,mBAAAA,IACAnB,WAAAA,EAAajC,MAAAA,IACbM,kBAAAA,CAAmB8C,qBAAqBnB,WAAAA,CAAAA,EACxC;AACA,QAAA,OAAOC,oBAAAA,CAAqBV,QAAAA,EAAUgB,gBAAAA,EAAkBvC,SAAAA,EAAWmD,mBAAAA,EAAqBzB,MAAAA,CAAAA;AAC1F,IAAA;;IAGA,IAAIU,YAAAA;IACJ,IAAI;AACFA,QAAAA,YAAAA,GAAe,MAAM7C,cAAAA,CAAeT,IAAAA,CAAAA;AACtC,IAAA,CAAA,CAAE,OAAOa,KAAAA,EAAO;AACd,QAAA,MAAM0D,SAAS1D,KAAAA,YAAiBC,KAAAA,GAAQD,KAAAA,CAAME,OAAO,GAAGC,MAAAA,CAAOH,KAAAA,CAAAA;QAC/DqD,MAAAA,CAAOM,GAAG,CAACC,IAAI,CAAC,CAAC,sCAAsC,EAAEF,QAAQ,EAAE;AACjE9B,YAAAA,QAAAA;YACA5B,KAAAA,EAAO0D;AACT,SAAA,CAAA;AACF,IAAA;IAEA,MAAMG,wBAAAA,GACJ,CAAClB,iBAAAA,CAAkBC,gBAAAA,CAAAA,IACnBY,mBAAAA,KAAwB,QACxBA,mBAAAA,KAAwBnD,SAAAA,KACvBK,kBAAAA,CAAmBkC,gBAAAA,EAAkB;AAACY,QAAAA;AAAoB,KAAA,CAAA,IACzD9C,mBAAmB8C,mBAAAA,EAAqB;AAACZ,QAAAA;KAAiB,CAAA,CAAA;AAC9D,IAAA,MAAMkB,uBAAAA,GACJrB,YAAAA,IAAgBG,gBAAAA,IAAoBlC,kBAAAA,CAAmB+B,YAAAA,EAAc;AAACG,QAAAA;AAAiB,KAAA,CAAA;;AAGzF,IAAA,IAAIiB,4BAA4BC,uBAAAA,EAAyB;AACvD,QAAA,OAAOpC,qBAAAA,CACLkB,gBAAAA,EACAhB,QAAAA,EACAgB,gBAAAA,EACAH,YAAAA,EACAV,MAAAA,CAAAA;AAEJ,IAAA;;AAGA,IAAA,IAAIU,YAAAA,IAAgBJ,WAAAA,EAAajC,MAAAA,IAAUM,kBAAAA,CAAmB+B,cAAcJ,WAAAA,CAAAA,EAAc;AACxF,QAAA,OAAOC,oBAAAA,CAAqBV,QAAAA,EAAUgB,gBAAAA,EAAkBH,YAAAA,EAAcA,YAAAA,EAAcV,MAAAA,CAAAA;AACtF,IAAA;;;AAIA,IAAA,MAAMgC,mBAAAA,GACJtB,YAAAA,KAAiB,iBAAA,IACjBe,mBAAAA,IACAA,wBAAwB,iBAAA,IACxBjB,KAAAA,CAAMC,OAAO,CAACJ,iBACdA,YAAAA,CAAahC,MAAM,GAAG,CAAA,IACtBM,mBAAmB8C,mBAAAA,EAAqBpB,YAAAA,CAAAA;;AAE1C,IAAA,MAAM4B,yBACJvB,YAAAA,KAAiB,iBAAA,IACjBa,OAAAA,KAAY,MAAA,IACZE,wBAAwB,eAAA,IACxBjB,KAAAA,CAAMC,OAAO,CAACJ,iBACdA,YAAAA,CAAahC,MAAM,GAAG,CAAA,IACtBM,mBAAmB8C,mBAAAA,EAAqBpB,YAAAA,CAAAA;AAC1C,IAAA,IACEK,gBACAF,KAAAA,CAAMC,OAAO,CAACJ,YAAAA,CAAAA,IACdA,aAAahC,MAAM,GAAG,CAAA,IACtB,CAACM,mBAAmB+B,YAAAA,EAAcL,YAAAA,CAAAA,IAClC,CAAC2B,mBAAAA,IACD,CAACC,sBAAAA,EACD;QACA,OAAO;YACLhC,OAAAA,EAAS,KAAA;YACThC,KAAAA,EAAO;gBACLiC,IAAAA,EAAM,uBAAA;gBACN/B,OAAAA,EAAS,0BAAA;gBACTgC,OAAAA,EAAS;AACPN,oBAAAA,QAAAA;oBACAO,MAAAA,EACE,uGAAA;oBACFN,YAAAA,EAAce,gBAAAA;oBACdd,YAAAA,EAAcW,YAAAA;oBACdwB,yBAAAA,EAA2BT,mBAAAA;AAC3BpB,oBAAAA,YAAAA;AACAC,oBAAAA;AACF;AACF;AACF,SAAA;AACF,IAAA;;AAGA,IAAA,MAAM6B,2BACJzB,YAAAA,IACAe,mBAAAA,KAAwB,QACxBA,mBAAAA,KAAwBnD,SAAAA,IACxBK,mBAAmB+B,YAAAA,EAAc;AAACe,QAAAA;AAAoB,KAAA,CAAA;AACxD,IAAA,IACEf,iBACC,CAACe,uBAAuBU,wBAAAA,IAA4BvB,iBAAAA,CAAkBC,iBAAgB,CAAA,EACvF;;AAEA,QAAA,IACEH,YAAAA,KAAiB,iBAAA,IACjBe,mBAAAA,IACAA,mBAAAA,KAAwB,iBAAA,EACxB;AACA,YAAA,MAAMW,SAAAA,GAAYzC,qBAAAA,CAChB8B,mBAAAA,EACA5B,QAAAA,EACAgB,kBACAH,YAAAA,EACAV,MAAAA,CAAAA;YAEF,IAAIoC,SAAAA,CAAUnC,OAAO,EAAE;AACrBqB,gBAAAA,MAAAA,CAAOM,GAAG,CAACC,IAAI,CACb,iFAAA,EACA;AAAEhC,oBAAAA,QAAAA;oBAAUwC,aAAAA,EAAed,OAAAA;oBAASW,yBAAAA,EAA2BT;AAAoB,iBAAA,CAAA;gBAErF,OAAOW,SAAAA;AACT,YAAA;AACF,QAAA;AACA,QAAA,OAAOzC,qBAAAA,CAAsBe,YAAAA,EAAcb,QAAAA,EAAUgB,gBAAAA,EAAkBH,YAAAA,EAAcV,MAAAA,CAAAA;AACvF,IAAA;;AAGA,IAAA,IAAIyB,mBAAAA,EAAqB;AACvB,QAAA,OAAO9B,qBAAAA,CACL8B,mBAAAA,EACA5B,QAAAA,EACAgB,gBAAAA,EACAH,YAAAA,EACAV,MAAAA,CAAAA;AAEJ,IAAA;;AAGA,IAAA,IAAIa,gBAAAA,EAAkB;AACpB,QAAA,OAAOlB,qBAAAA,CACLkB,gBAAAA,EACAhB,QAAAA,EACAgB,gBAAAA,EACAH,YAAAA,EACAV,MAAAA,CAAAA;AAEJ,IAAA;;IAGA,OAAO;QACLC,OAAAA,EAAS,KAAA;QACThC,KAAAA,EAAO;YACLiC,IAAAA,EAAM,uBAAA;YACN/B,OAAAA,EAAS,8CAAA;YACTgC,OAAAA,EAAS;AACPN,gBAAAA,QAAAA;gBACAO,MAAAA,EAAQ,yEAAA;gBACRN,YAAAA,EAAce,gBAAAA;gBACdd,YAAAA,EAAcW,YAAAA;AACdL,gBAAAA,YAAAA;AACAC,gBAAAA;AACF;AACF;AACF,KAAA;AACF;AAEA,SAASC,oBAAAA,CACPV,QAAgB,EAChBC,YAAoB,EACpBC,YAAgC,EAChCuC,YAAoB,EACpBtC,MAAsB,EAAA;IAEtB,OAAO;QACLC,OAAAA,EAAS,KAAA;QACThC,KAAAA,EAAO;YACLiC,IAAAA,EAAM,uBAAA;AACN/B,YAAAA,OAAAA,EAAS,CAAC,WAAW,EAAEmE,YAAAA,CAAa,gBAAgB,CAAC;YACrDnC,OAAAA,EAAS;AACPN,gBAAAA,QAAAA;AACAC,gBAAAA,YAAAA;AACAC,gBAAAA,YAAAA;gBACAY,SAAAA,EAAW2B,YAAAA;AACXjC,gBAAAA,YAAAA,EAAcL,OAAOK,YAAY;AACjCC,gBAAAA,WAAAA,EAAaN,OAAOM,WAAW;gBAC/BF,MAAAA,EAAQ;AACV;AACF;AACF,KAAA;AACF;AAEO,eAAemC,aAAAA,CAAcC,KAAU,EAAElB,MAAmB,EAAA;AACjE,IAAA,MAAMmB,UAAAA,GAAajC,KAAAA,CAAMC,OAAO,CAAC+B,SAASA,KAAAA,GAAQ;AAACA,QAAAA;AAAM,KAAA;IAEzD,IAAI,CAACC,UAAAA,CAAWpE,MAAM,EAAE;AACtB,QAAA,OAAO,EAAE;AACX,IAAA;;AAGA,IAAA,IAAI2B,MAAAA,GAAyBsB,MAAAA,CAAOtB,MAAM,CAAC0C,GAAG,CAC5C;AAAC,QAAA,gBAAA;AAAkB,QAAA;AAAW,KAAA,EAC9B,EAAC,CAAA;AAEH,IAAA,IAAI,CAAC1C,MAAAA,IAAU,OAAOA,MAAAA,KAAW,QAAA,EAAU;AACzCA,QAAAA,MAAAA,GAAS,EAAC;AACZ,IAAA;IACA,IACEA,MAAAA,CAAOK,YAAY,KAClB,CAACG,KAAAA,CAAMC,OAAO,CAACT,MAAAA,CAAOK,YAAY,CAAA,IACjC,CAACL,MAAAA,CAAOK,YAAY,CAACsC,KAAK,CAAC,CAACC,IAAAA,GAAS,OAAOA,IAAAA,KAAS,QAAA,CAAQ,CAAA,EAC/D;QACA,MAAM,IAAIC,YAAAA,CAAOC,gBAAgB,CAC/B,kEAAA,CAAA;AAEJ,IAAA;IAEA,IACE9C,MAAAA,CAAOM,WAAW,KACjB,CAACE,KAAAA,CAAMC,OAAO,CAACT,MAAAA,CAAOM,WAAW,CAAA,IAChC,CAACN,MAAAA,CAAOM,WAAW,CAACqC,KAAK,CAAC,CAACC,IAAAA,GAAS,OAAOA,IAAAA,KAAS,QAAA,CAAQ,CAAA,EAC9D;QACA,MAAM,IAAIC,YAAAA,CAAOC,gBAAgB,CAC/B,iEAAA,CAAA;AAEJ,IAAA;AAEA,IAAA,IAAI,CAAC9C,MAAAA,CAAOK,YAAY,IAAI,CAACL,MAAAA,CAAOM,WAAW,EAAE;QAC/CgB,MAAAA,CAAOM,GAAG,CAACC,IAAI,CACb,mHAAA,CAAA;;AAGJ,IAAA;AAEA,IAAA,MAAMkB,kBAAAA,GAAqBN,UAAAA,CAAWO,GAAG,CAAC,OAAO5F,IAAAA,EAAM6F,KAAAA,GAAAA;QACrD,IAAI;YACF,OAAO,MAAM5B,YAAAA,CAAajE,IAAAA,EAAM4C,MAAAA,EAAQsB,MAAAA,CAAAA;AAC1C,QAAA,CAAA,CAAE,OAAOrD,KAAAA,EAAO;AACdqD,YAAAA,MAAAA,CAAOM,GAAG,CAAC3D,KAAK,CAAC,yCAAA,EAA2C;gBAC1DiF,SAAAA,EAAWD,KAAAA;gBACXpD,QAAAA,EAAUzC,IAAAA,EAAM4D,QAAQ5D,IAAAA,EAAM+D,YAAAA;AAC9BlD,gBAAAA,KAAAA,EAAOA,KAAAA,YAAiBC,KAAAA,GAAQD,KAAAA,CAAME,OAAO,GAAGC,MAAAA,CAAOH,KAAAA;AACzD,aAAA,CAAA;YAEA,OAAO;gBACLgC,OAAAA,EAAS,KAAA;gBACThC,KAAAA,EAAO;oBACLiC,IAAAA,EAAM,kBAAA;oBACN/B,OAAAA,EAAS,CAAC,oCAAoC,EAAE8E,KAAAA,CAAAA,CAAO;oBACvD9C,OAAAA,EAAS;AACP8C,wBAAAA,KAAAA;wBACApD,QAAAA,EAAUzC,IAAAA,EAAM4D,QAAQ5D,IAAAA,EAAM+D,YAAAA;AAC9BgC,wBAAAA,aAAAA,EAAelF,KAAAA,YAAiBC,KAAAA,GAAQD,KAAAA,CAAME,OAAO,GAAGC,MAAAA,CAAOH,KAAAA;AACjE;AACF;AACF,aAAA;AACF,QAAA;AACF,IAAA,CAAA,CAAA;IAEA,OAAOmF,OAAAA,CAAQC,GAAG,CAACN,kBAAAA,CAAAA;AACrB;AAEO,eAAeO,qBAAAA,CACpBd,KAAU,EACVlB,MAAmB,EAAA;IAMnB,MAAMiC,iBAAAA,GAAoB,MAAMhB,aAAAA,CAAcC,KAAAA,EAAOlB,MAAAA,CAAAA;AACrD,IAAA,MAAMmB,UAAAA,GAAajC,KAAAA,CAAMC,OAAO,CAAC+B,SAASA,KAAAA,GAAQ;AAACA,QAAAA;AAAM,KAAA;AAEzD,IAAA,MAAMgB,aAAoB,EAAE;AAC5B,IAAA,MAAMC,iBAA2B,EAAE;AACnC,IAAA,MAAMZ,SAA6B,EAAE;AAErC,IAAA,KAAK,MAAM,CAACI,KAAAA,EAAOzE,OAAO,IAAI+E,iBAAAA,CAAkBG,OAAO,EAAA,CAAI;QACzD,IAAIlF,MAAAA,CAAOyB,OAAO,EAAE;YAClB,MAAM7C,IAAAA,GAAOqF,UAAU,CAACQ,KAAAA,CAAM;;YAE9B,IAAIzE,MAAAA,CAAOkC,YAAY,EAAE;gBACvBtD,IAAAA,CAAKuG,gBAAgB,GAAGnF,MAAAA,CAAOkC,YAAY;AAC7C,YAAA;AACA8C,YAAAA,UAAAA,CAAWI,IAAI,CAACxG,IAAAA,CAAAA;AAChBqG,YAAAA,cAAAA,CAAeG,IAAI,CAACxG,IAAAA,CAAK2D,gBAAgB,IAAI3D,KAAK4D,IAAI,CAAA;QACxD,CAAA,MAAO,IAAIxC,MAAAA,CAAOP,KAAK,EAAE;AACvB4E,YAAAA,MAAAA,CAAOe,IAAI,CAAC;gBACVxG,IAAAA,EAAMqF,UAAU,CAACQ,KAAAA,CAAM;gBACvBY,aAAAA,EAAeZ,KAAAA;AACfhF,gBAAAA,KAAAA,EAAOO,OAAOP;AAChB,aAAA,CAAA;QACF,CAAA,MAAO;;AAEL4E,YAAAA,MAAAA,CAAOe,IAAI,CAAC;gBACVxG,IAAAA,EAAMqF,UAAU,CAACQ,KAAAA,CAAM;gBACvBY,aAAAA,EAAeZ,KAAAA;gBACfhF,KAAAA,EAAO;oBACLiC,IAAAA,EAAM,eAAA;oBACN/B,OAAAA,EAAS,2CAAA;oBACTgC,OAAAA,EAAS;AACP8C,wBAAAA,KAAAA;wBACApD,QAAAA,EAAU4C,UAAU,CAACQ,KAAAA,CAAM,EAAEjC,QAAQyB,UAAU,CAACQ,MAAM,EAAE9B;AAC1D;AACF;AACF,aAAA,CAAA;AACF,QAAA;AACF,IAAA;IAEA,OAAO;AAAEqC,QAAAA,UAAAA;AAAYC,QAAAA,cAAAA;AAAgBZ,QAAAA;AAAO,KAAA;AAC9C;AAaA;;AAEC,IACM,eAAeiB,oBAAAA,CACpBC,UAAe,EACfC,IAAS,EACT1C,MAAmB,EAAA;IAEnB,MAAM2C,eAAAA,GAAkB,MAAMX,qBAAAA,CAAsBS,UAAAA,EAAYzC,MAAAA,CAAAA;AAEhE,IAAA,IAAI4C,YAAAA,GAAeF,IAAAA;AACnB,IAAA,IAAIA,MAAMG,QAAAA,EAAU;;QAElB,IAAIC,cAAAA,GAAiBJ,KAAKG,QAAQ;AAClC,QAAA,IAAI3D,KAAAA,CAAMC,OAAO,CAACuD,IAAAA,CAAKG,QAAQ,CAAA,EAAG;AAChCC,YAAAA,cAAAA,GAAiBJ,IAAAA,CAAKG,QAAQ,CAACnB,GAAG,CAAC,CAACqB,EAAAA,GAClC,OAAOA,EAAAA,KAAO,QAAA,GAAWC,IAAAA,CAAKC,KAAK,CAACF,EAAAA,CAAAA,GAAMA,EAAAA,CAAAA;AAE9C,QAAA,CAAA,MAAO,IAAI,OAAOL,IAAAA,CAAKG,QAAQ,KAAK,QAAA,EAAU;AAC5CC,YAAAA,cAAAA,GAAiBE,IAAAA,CAAKC,KAAK,CAACP,IAAAA,CAAKG,QAAQ,CAAA;AAC3C,QAAA;;QAGA,IAAI3D,KAAAA,CAAMC,OAAO,CAAC2D,cAAAA,CAAAA,EAAiB;YACjC,MAAMI,cAAAA,GAAiB,IAAIC,GAAAA,CAAIR,eAAAA,CAAgBpB,MAAM,CAACG,GAAG,CAAC,CAAC0B,CAAAA,GAAMA,CAAAA,CAAEb,aAAa,CAAA,CAAA;YAChF,MAAMc,gBAAAA,GAAmBP,cAAAA,CAAeQ,MAAM,CAC5C,CAACC,GAAQ5B,KAAAA,GAAkB,CAACuB,cAAAA,CAAeM,GAAG,CAAC7B,KAAAA,CAAAA,CAAAA;YAGjD,IAAI0B,gBAAAA,CAAiBtG,MAAM,KAAK,CAAA,EAAG;gBACjC6F,YAAAA,GAAe;AACb,oBAAA,GAAGF,IAAI;oBACPG,QAAAA,EAAUQ,gBAAgB,CAAC,CAAA;AAC7B,iBAAA;YACF,CAAA,MAAO;gBACLT,YAAAA,GAAe;AACb,oBAAA,GAAGF,IAAI;oBACPG,QAAAA,EAAUQ;AACZ,iBAAA;AACF,YAAA;QACF,CAAA,MAAO;YACLT,YAAAA,GAAe;AACb,gBAAA,GAAGF,IAAI;gBACPG,QAAAA,EAAUC;AACZ,aAAA;AACF,QAAA;AACF,IAAA;;IAGA,MAAMW,YAAAA,GAAkCd,gBAAgBpB,MAAM,CAACG,GAAG,CAAC,CAAC0B,KAAO;AACzE1D,YAAAA,IAAAA,EAAM0D,EAAEtH,IAAI,EAAE2D,oBAAoB2D,CAAAA,CAAEtH,IAAI,EAAE4D,IAAAA,IAAQ,SAAA;YAClD7C,OAAAA,EAASuG,CAAAA,CAAEzG,KAAK,CAACE;SACnB,CAAA,CAAA;IAEA,OAAO;AACLqF,QAAAA,UAAAA,EAAYS,gBAAgBT,UAAU;AACtCU,QAAAA,YAAAA;QACArB,MAAAA,EAAQkC;AACV,KAAA;AACF;;;;;;;;;"}

package/dist/server/utils/mime-validation.mjs

@@ -179,7 +179,9 @@ async function validateFile(file, config, strapi) {
     // Reject if detected is not in allow list (extension/declared cannot override).
     // Exception: file-type often returns application/zip for Office formats (docx, xlsx); skip so the next block can allow via extension type.
     const isZipWithAllowedExt = detectedMime === 'application/zip' && expectedMimeFromExt && expectedMimeFromExt !== 'application/zip' && Array.isArray(allowedTypes) && allowedTypes.length > 0 && matchesMimePattern(expectedMimeFromExt, allowedTypes);
-    if (detectedMime && Array.isArray(allowedTypes) && allowedTypes.length > 0 && !matchesMimePattern(detectedMime, allowedTypes) && !isZipWithAllowedExt) {
+    // Exception: file-type often returns application/xml for SVG; trust .svg extension when image/svg+xml is allowed.
+    const isSvgXmlWithAllowedExt = detectedMime === 'application/xml' && fileExt === '.svg' && expectedMimeFromExt === 'image/svg+xml' && Array.isArray(allowedTypes) && allowedTypes.length > 0 && matchesMimePattern(expectedMimeFromExt, allowedTypes);
+    if (detectedMime && Array.isArray(allowedTypes) && allowedTypes.length > 0 && !matchesMimePattern(detectedMime, allowedTypes) && !isZipWithAllowedExt && !isSvgXmlWithAllowedExt) {
         return {
             isValid: false,
             error: {

package/dist/server/utils/mime-validation.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"mime-validation.mjs","sources":["../../../server/src/utils/mime-validation.ts"],"sourcesContent":["import { open } from 'node:fs/promises';\nimport { extname } from 'node:path';\nimport { lookup } from 'mime-types';\nimport type { Core } from '@strapi/types';\nimport { errors } from '@strapi/utils';\n\nexport type SecurityConfig = {\n  allowedTypes?: string[];\n  deniedTypes?: string[];\n};\ntype UploadValidationError = {\n  code: 'MIME_TYPE_NOT_ALLOWED' | 'VALIDATION_ERROR' | 'UNKNOWN_ERROR';\n  message: string;\n  details: Record<string, any>;\n};\n\ntype ValidationResult = {\n  isValid: boolean;\n  error?: UploadValidationError;\n  detectedMime?: string;\n};\n\ntype ErrorDetail = {\n  file: any;\n  originalIndex: number;\n  error: UploadValidationError;\n};\n\nasync function readFileChunk(filePath: string, chunkSize: number = 4100): Promise<Buffer> {\n  const file = await open(filePath, 'r');\n\n  try {\n    const buffer = Buffer.alloc(chunkSize);\n    const { bytesRead } = await file.read(buffer, 0, chunkSize, 0);\n\n    return buffer.subarray(0, bytesRead);\n  } finally {\n    await file.close();\n  }\n}\n\nexport async function detectMimeType(file: any): Promise<string | undefined> {\n  let buffer: Buffer;\n\n  // Support multiple property names used by different multipart parsers (formidable uses filepath)\n  const filePath = file.filepath ?? file.path ?? file.tempFilePath ?? file.filePath;\n\n  if (filePath) {\n    try {\n      buffer = await readFileChunk(filePath, 4100);\n    } catch (error) {\n      throw new Error(\n        `Failed to read file: ${error instanceof Error ? error.message : String(error)}`\n      );\n    }\n  } else if (file.buffer) {\n    buffer = file.buffer.length > 4100 ? file.buffer.subarray(0, 4100) : file.buffer;\n  } else {\n    // No file path or buffer; cannot detect MIME. Validation will use declared/extension or reject.\n    return undefined;\n  }\n\n  try {\n    /**\n     * Use dynamic import to support file-type which is ESM-only\n     * Static imports fail during CommonJS build since bundler can't transform ESM-only packages\n     * @see https://gist.github.com/sindresorhus/a39789f98801d908bbc7ff3ecc99d99c\n     */\n    const { fileTypeFromBuffer } = await import('file-type');\n\n    const result = await fileTypeFromBuffer(new Uint8Array(buffer));\n    return result?.mime;\n  } catch (error) {\n    throw new Error(\n      `Failed to detect MIME type: ${error instanceof Error ? error.message : String(error)}`\n    );\n  }\n}\n\nfunction matchesMimePattern(mimeType: string, patterns: string[]): boolean {\n  if (!patterns?.length) return false;\n\n  return patterns.some((pattern) => {\n    const normalizedPattern = pattern.toLowerCase();\n    const normalizedMimeType = mimeType.toLowerCase();\n\n    if (normalizedPattern.includes('*')) {\n      const regexPattern = normalizedPattern.replace(/\\*/g, '.*');\n\n      const regex = new RegExp(`^${regexPattern}$`);\n      const matches = regex.test(normalizedMimeType);\n      return matches;\n    }\n\n    const exactMatch = normalizedPattern === normalizedMimeType;\n    return exactMatch;\n  });\n}\n\nexport function isMimeTypeAllowed(mimeType: string, config: SecurityConfig): boolean {\n  const { allowedTypes, deniedTypes } = config;\n\n  if (!mimeType) return false;\n\n  if (deniedTypes?.length && matchesMimePattern(mimeType, deniedTypes)) {\n    return false;\n  }\n\n  if (Array.isArray(allowedTypes)) {\n    return allowedTypes.length > 0 && matchesMimePattern(mimeType, allowedTypes);\n  }\n\n  return true;\n}\n\n/**\n * Single gate for allow/deny. Returns ValidationResult.\n * Doc: docs/docs/01-core/upload/01-backend/01-mime-validation.md\n */\nfunction validateAllowBanLists(\n  mimetype: string,\n  fileName: string,\n  declaredType: string,\n  detectedType: string | undefined,\n  config: SecurityConfig\n): ValidationResult {\n  if (!mimetype) {\n    return {\n      isValid: false,\n      error: {\n        code: 'MIME_TYPE_NOT_ALLOWED',\n        message: 'MIME type is not allowed',\n        details: {\n          fileName,\n          reason: 'No MIME type to validate',\n          declaredType,\n          detectedType,\n          allowedTypes: config.allowedTypes,\n          deniedTypes: config.deniedTypes,\n        },\n      },\n    };\n  }\n  if (config.deniedTypes?.length && matchesMimePattern(mimetype, config.deniedTypes)) {\n    return buildNotAllowedError(fileName, declaredType, detectedType, mimetype, config);\n  }\n  if (!Array.isArray(config.allowedTypes)) {\n    return { isValid: true, detectedMime: mimetype };\n  }\n  if (config.allowedTypes.length === 0) {\n    return {\n      isValid: false,\n      error: {\n        code: 'MIME_TYPE_NOT_ALLOWED',\n        message: 'MIME type is not allowed',\n        details: {\n          fileName,\n          reason: 'Allow list is empty',\n          declaredType,\n          detectedType,\n          allowedTypes: config.allowedTypes,\n          deniedTypes: config.deniedTypes,\n        },\n      },\n    };\n  }\n  if (matchesMimePattern(mimetype, config.allowedTypes)) {\n    return { isValid: true, detectedMime: mimetype };\n  }\n  return {\n    isValid: false,\n    error: {\n      code: 'MIME_TYPE_NOT_ALLOWED',\n      message: `File type '${mimetype}' is not allowed`,\n      details: {\n        fileName,\n        declaredType,\n        detectedType,\n        finalType: mimetype,\n        allowedTypes: config.allowedTypes,\n        deniedTypes: config.deniedTypes,\n      },\n    },\n  };\n}\n\nfunction isDeclaredGeneric(declaredMimeType: string): boolean {\n  return !declaredMimeType || declaredMimeType === 'application/octet-stream';\n}\n\nexport function extractFileInfo(file: any) {\n  const fileName =\n    file.originalFilename ||\n    file.name ||\n    file.filename ||\n    file.newFilename ||\n    file.originalname ||\n    'unknown';\n  const declaredMimeType = file.mimetype || file.type || file.mimeType || file.mime || '';\n\n  return { fileName, declaredMimeType };\n}\n\nexport async function validateFile(\n  file: any,\n  config: SecurityConfig,\n  strapi: Core.Strapi\n): Promise<ValidationResult> {\n  const { allowedTypes, deniedTypes } = config;\n\n  const { fileName, declaredMimeType } = extractFileInfo(file);\n\n  const fileExt = extname(fileName).toLowerCase();\n  const expectedMimeFromExt = fileExt ? lookup(fileExt) || null : null;\n\n  // Reject if declared type is denied.\n  if (\n    !isDeclaredGeneric(declaredMimeType) &&\n    deniedTypes?.length &&\n    matchesMimePattern(declaredMimeType, deniedTypes)\n  ) {\n    return buildNotAllowedError(fileName, declaredMimeType, undefined, declaredMimeType, config);\n  }\n\n  // Reject if extension's type is denied.\n  if (\n    expectedMimeFromExt &&\n    deniedTypes?.length &&\n    matchesMimePattern(expectedMimeFromExt, deniedTypes)\n  ) {\n    return buildNotAllowedError(fileName, declaredMimeType, undefined, expectedMimeFromExt, config);\n  }\n\n  // Run content detection.\n  let detectedMime: string | undefined;\n  try {\n    detectedMime = await detectMimeType(file);\n  } catch (error) {\n    const errMsg = error instanceof Error ? error.message : String(error);\n    strapi.log.warn(`Failed to detect MIME type from file: ${errMsg}`, {\n      fileName,\n      error: errMsg,\n    });\n  }\n\n  const declaredMatchesExtension =\n    !isDeclaredGeneric(declaredMimeType) &&\n    expectedMimeFromExt !== null &&\n    expectedMimeFromExt !== undefined &&\n    (matchesMimePattern(declaredMimeType, [expectedMimeFromExt]) ||\n      matchesMimePattern(expectedMimeFromExt, [declaredMimeType]));\n  const detectedMatchesDeclared =\n    detectedMime && declaredMimeType && matchesMimePattern(detectedMime, [declaredMimeType]);\n\n  // Trusted declaration: declared matches extension and detection confirms.\n  if (declaredMatchesExtension && detectedMatchesDeclared) {\n    return validateAllowBanLists(\n      declaredMimeType,\n      fileName,\n      declaredMimeType,\n      detectedMime,\n      config\n    );\n  }\n\n  // Reject if detected type is denied.\n  if (detectedMime && deniedTypes?.length && matchesMimePattern(detectedMime, deniedTypes)) {\n    return buildNotAllowedError(fileName, declaredMimeType, detectedMime, detectedMime, config);\n  }\n\n  // Reject if detected is not in allow list (extension/declared cannot override).\n  // Exception: file-type often returns application/zip for Office formats (docx, xlsx); skip so the next block can allow via extension type.\n  const isZipWithAllowedExt =\n    detectedMime === 'application/zip' &&\n    expectedMimeFromExt &&\n    expectedMimeFromExt !== 'application/zip' &&\n    Array.isArray(allowedTypes) &&\n    allowedTypes.length > 0 &&\n    matchesMimePattern(expectedMimeFromExt, allowedTypes);\n  if (\n    detectedMime &&\n    Array.isArray(allowedTypes) &&\n    allowedTypes.length > 0 &&\n    !matchesMimePattern(detectedMime, allowedTypes) &&\n    !isZipWithAllowedExt\n  ) {\n    return {\n      isValid: false,\n      error: {\n        code: 'MIME_TYPE_NOT_ALLOWED',\n        message: 'MIME type is not allowed',\n        details: {\n          fileName,\n          reason:\n            'File content was detected as a type not in the allow list; extension or declared type cannot override',\n          declaredType: declaredMimeType,\n          detectedType: detectedMime,\n          expectedMimeFromExtension: expectedMimeFromExt,\n          allowedTypes,\n          deniedTypes,\n        },\n      },\n    };\n  }\n\n  // Use detected type when defined and (no extension, or detected matches extension, or declared is generic).\n  const detectedMatchesExtension =\n    detectedMime &&\n    expectedMimeFromExt !== null &&\n    expectedMimeFromExt !== undefined &&\n    matchesMimePattern(detectedMime, [expectedMimeFromExt]);\n  if (\n    detectedMime &&\n    (!expectedMimeFromExt || detectedMatchesExtension || isDeclaredGeneric(declaredMimeType))\n  ) {\n    // Office/zip exception: use extension type when detection returned application/zip and extension is in allow list.\n    if (\n      detectedMime === 'application/zip' &&\n      expectedMimeFromExt &&\n      expectedMimeFromExt !== 'application/zip'\n    ) {\n      const extResult = validateAllowBanLists(\n        expectedMimeFromExt,\n        fileName,\n        declaredMimeType,\n        detectedMime,\n        config\n      );\n      if (extResult.isValid) {\n        strapi.log.warn(\n          'MIME type detection returned application/zip; trusting extension for allow list',\n          { fileName, fileExtension: fileExt, expectedMimeFromExtension: expectedMimeFromExt }\n        );\n        return extResult;\n      }\n    }\n    return validateAllowBanLists(detectedMime, fileName, declaredMimeType, detectedMime, config);\n  }\n\n  // Use extension's type when present.\n  if (expectedMimeFromExt) {\n    return validateAllowBanLists(\n      expectedMimeFromExt,\n      fileName,\n      declaredMimeType,\n      detectedMime,\n      config\n    );\n  }\n\n  // Use declared type as last resort.\n  if (declaredMimeType) {\n    return validateAllowBanLists(\n      declaredMimeType,\n      fileName,\n      declaredMimeType,\n      detectedMime,\n      config\n    );\n  }\n\n  // Reject when no type can be chosen.\n  return {\n    isValid: false,\n    error: {\n      code: 'MIME_TYPE_NOT_ALLOWED',\n      message: 'Cannot verify file type for security reasons',\n      details: {\n        fileName,\n        reason: 'No MIME type to validate (no declared type, no extension, no detection)',\n        declaredType: declaredMimeType,\n        detectedType: detectedMime,\n        allowedTypes,\n        deniedTypes,\n      },\n    },\n  };\n}\n\nfunction buildNotAllowedError(\n  fileName: string,\n  declaredType: string,\n  detectedType: string | undefined,\n  rejectedType: string,\n  config: SecurityConfig\n): ValidationResult {\n  return {\n    isValid: false,\n    error: {\n      code: 'MIME_TYPE_NOT_ALLOWED',\n      message: `File type '${rejectedType}' is not allowed`,\n      details: {\n        fileName,\n        declaredType,\n        detectedType,\n        finalType: rejectedType,\n        allowedTypes: config.allowedTypes,\n        deniedTypes: config.deniedTypes,\n        reason: 'MIME type is in the denied list',\n      },\n    },\n  };\n}\n\nexport async function validateFiles(files: any, strapi: Core.Strapi): Promise<ValidationResult[]> {\n  const filesArray = Array.isArray(files) ? files : [files];\n\n  if (!filesArray.length) {\n    return [];\n  }\n\n  // Use array path so 'plugin::upload' is a single key (lodash string path splits on '.')\n  let config: SecurityConfig = strapi.config.get(\n    ['plugin::upload', 'security'],\n    {}\n  ) as SecurityConfig;\n  if (!config || typeof config !== 'object') {\n    config = {};\n  }\n  if (\n    config.allowedTypes &&\n    (!Array.isArray(config.allowedTypes) ||\n      !config.allowedTypes.every((item) => typeof item === 'string'))\n  ) {\n    throw new errors.ApplicationError(\n      'Invalid configuration: allowedTypes must be an array of strings.'\n    );\n  }\n\n  if (\n    config.deniedTypes &&\n    (!Array.isArray(config.deniedTypes) ||\n      !config.deniedTypes.every((item) => typeof item === 'string'))\n  ) {\n    throw new errors.ApplicationError(\n      'Invalid configuration: deniedTypes must be an array of strings.'\n    );\n  }\n\n  if (!config.allowedTypes && !config.deniedTypes) {\n    strapi.log.warn(\n      'No upload security configuration found. Consider configuring plugin.upload.security for enhanced file validation.'\n    );\n    // Do not return; we still run validation so MIME detection runs and stored file gets detected type when possible\n  }\n\n  const validationPromises = filesArray.map(async (file, index) => {\n    try {\n      return await validateFile(file, config, strapi);\n    } catch (error) {\n      strapi.log.error('Unexpected error during file validation', {\n        fileIndex: index,\n        fileName: file?.name || file?.originalname,\n        error: error instanceof Error ? error.message : String(error),\n      });\n\n      return {\n        isValid: false,\n        error: {\n          code: 'VALIDATION_ERROR' as const,\n          message: `Validation failed for file at index ${index}`,\n          details: {\n            index,\n            fileName: file?.name || file?.originalname,\n            originalError: error instanceof Error ? error.message : String(error),\n          },\n        },\n      };\n    }\n  });\n\n  return Promise.all(validationPromises);\n}\n\nexport async function enforceUploadSecurity(\n  files: any,\n  strapi: Core.Strapi\n): Promise<{\n  validFiles: any[];\n  validFileNames: string[];\n  errors: Array<ErrorDetail>;\n}> {\n  const validationResults = await validateFiles(files, strapi);\n  const filesArray = Array.isArray(files) ? files : [files];\n\n  const validFiles: any[] = [];\n  const validFileNames: string[] = [];\n  const errors: Array<ErrorDetail> = [];\n\n  for (const [index, result] of validationResults.entries()) {\n    if (result.isValid) {\n      const file = filesArray[index];\n      // Enrich file with detected MIME type for use in storage\n      if (result.detectedMime) {\n        file.detectedMimeType = result.detectedMime;\n      }\n      validFiles.push(file);\n      validFileNames.push(file.originalFilename || file.name);\n    } else if (result.error) {\n      errors.push({\n        file: filesArray[index],\n        originalIndex: index,\n        error: result.error,\n      });\n    } else {\n      // Handle case where validation failed but no error details are provided\n      errors.push({\n        file: filesArray[index],\n        originalIndex: index,\n        error: {\n          code: 'UNKNOWN_ERROR' as const,\n          message: 'File validation failed for unknown reason',\n          details: {\n            index,\n            fileName: filesArray[index]?.name || filesArray[index]?.originalname,\n          },\n        },\n      });\n    }\n  }\n\n  return { validFiles, validFileNames, errors };\n}\n\nexport type FileUploadError = {\n  name: string;\n  message: string;\n};\n\nexport type PrepareUploadResult = {\n  validFiles: any[];\n  filteredBody: any;\n  errors: FileUploadError[];\n};\n\n/**\n * Prepare files and body for upload by enforcing security and parsing fileInfo\n */\nexport async function prepareUploadRequest(\n  filesInput: any,\n  body: any,\n  strapi: Core.Strapi\n): Promise<PrepareUploadResult> {\n  const securityResults = await enforceUploadSecurity(filesInput, strapi);\n\n  let filteredBody = body;\n  if (body?.fileInfo) {\n    // Parse JSON strings in fileInfo\n    let parsedFileInfo = body.fileInfo;\n    if (Array.isArray(body.fileInfo)) {\n      parsedFileInfo = body.fileInfo.map((fi: any) =>\n        typeof fi === 'string' ? JSON.parse(fi) : fi\n      );\n    } else if (typeof body.fileInfo === 'string') {\n      parsedFileInfo = JSON.parse(body.fileInfo);\n    }\n\n    // Filter fileInfo by index - only keep entries for files that passed validation\n    if (Array.isArray(parsedFileInfo)) {\n      const invalidIndices = new Set(securityResults.errors.map((e) => e.originalIndex));\n      const filteredFileInfo = parsedFileInfo.filter(\n        (_: any, index: number) => !invalidIndices.has(index)\n      );\n\n      if (filteredFileInfo.length === 1) {\n        filteredBody = {\n          ...body,\n          fileInfo: filteredFileInfo[0],\n        };\n      } else {\n        filteredBody = {\n          ...body,\n          fileInfo: filteredFileInfo,\n        };\n      }\n    } else {\n      filteredBody = {\n        ...body,\n        fileInfo: parsedFileInfo,\n      };\n    }\n  }\n\n  // Map errors to simplified format\n  const uploadErrors: FileUploadError[] = securityResults.errors.map((e) => ({\n    name: e.file?.originalFilename || e.file?.name || 'unknown',\n    message: e.error.message,\n  }));\n\n  return {\n    validFiles: securityResults.validFiles,\n    filteredBody,\n    errors: uploadErrors,\n  };\n}\n"],"names":["readFileChunk","filePath","chunkSize","file","open","buffer","Buffer","alloc","bytesRead","read","subarray","close","detectMimeType","filepath","path","tempFilePath","error","Error","message","String","length","undefined","fileTypeFromBuffer","result","Uint8Array","mime","matchesMimePattern","mimeType","patterns","some","pattern","normalizedPattern","toLowerCase","normalizedMimeType","includes","regexPattern","replace","regex","RegExp","matches","test","exactMatch","validateAllowBanLists","mimetype","fileName","declaredType","detectedType","config","isValid","code","details","reason","allowedTypes","deniedTypes","buildNotAllowedError","Array","isArray","detectedMime","finalType","isDeclaredGeneric","declaredMimeType","extractFileInfo","originalFilename","name","filename","newFilename","originalname","type","validateFile","strapi","fileExt","extname","expectedMimeFromExt","lookup","errMsg","log","warn","declaredMatchesExtension","detectedMatchesDeclared","isZipWithAllowedExt","expectedMimeFromExtension","detectedMatchesExtension","extResult","fileExtension","rejectedType","validateFiles","files","filesArray","get","every","item","errors","ApplicationError","validationPromises","map","index","fileIndex","originalError","Promise","all","enforceUploadSecurity","validationResults","validFiles","validFileNames","entries","detectedMimeType","push","originalIndex","prepareUploadRequest","filesInput","body","securityResults","filteredBody","fileInfo","parsedFileInfo","fi","JSON","parse","invalidIndices","Set","e","filteredFileInfo","filter","_","has","uploadErrors"],"mappings":";;;;;AA4BA,eAAeA,aAAAA,CAAcC,QAAgB,EAAEC,SAAAA,GAAoB,IAAI,EAAA;IACrE,MAAMC,IAAAA,GAAO,MAAMC,IAAAA,CAAKH,QAAAA,EAAU,GAAA,CAAA;IAElC,IAAI;QACF,MAAMI,MAAAA,GAASC,MAAAA,CAAOC,KAAK,CAACL,SAAAA,CAAAA;QAC5B,MAAM,EAAEM,SAAS,EAAE,GAAG,MAAML,KAAKM,IAAI,CAACJ,MAAAA,EAAQ,CAAA,EAAGH,SAAAA,EAAW,CAAA,CAAA;QAE5D,OAAOG,MAAAA,CAAOK,QAAQ,CAAC,CAAA,EAAGF,SAAAA,CAAAA;IAC5B,CAAA,QAAU;AACR,QAAA,MAAML,KAAKQ,KAAK,EAAA;AAClB,IAAA;AACF;AAEO,eAAeC,eAAeT,IAAS,EAAA;IAC5C,IAAIE,MAAAA;;IAGJ,MAAMJ,QAAAA,GAAWE,IAAAA,CAAKU,QAAQ,IAAIV,IAAAA,CAAKW,IAAI,IAAIX,IAAAA,CAAKY,YAAY,IAAIZ,IAAAA,CAAKF,QAAQ;AAEjF,IAAA,IAAIA,QAAAA,EAAU;QACZ,IAAI;YACFI,MAAAA,GAAS,MAAML,cAAcC,QAAAA,EAAU,IAAA,CAAA;AACzC,QAAA,CAAA,CAAE,OAAOe,KAAAA,EAAO;YACd,MAAM,IAAIC,KAAAA,CACR,CAAC,qBAAqB,EAAED,KAAAA,YAAiBC,KAAAA,GAAQD,KAAAA,CAAME,OAAO,GAAGC,MAAAA,CAAOH,KAAAA,CAAAA,CAAAA,CAAQ,CAAA;AAEpF,QAAA;IACF,CAAA,MAAO,IAAIb,IAAAA,CAAKE,MAAM,EAAE;AACtBA,QAAAA,MAAAA,GAASF,IAAAA,CAAKE,MAAM,CAACe,MAAM,GAAG,IAAA,GAAOjB,IAAAA,CAAKE,MAAM,CAACK,QAAQ,CAAC,CAAA,EAAG,IAAA,CAAA,GAAQP,KAAKE,MAAM;IAClF,CAAA,MAAO;;QAEL,OAAOgB,SAAAA;AACT,IAAA;IAEA,IAAI;AACF;;;;AAIC,QACD,MAAM,EAAEC,kBAAkB,EAAE,GAAG,MAAM,OAAO,WAAA,CAAA;AAE5C,QAAA,MAAMC,MAAAA,GAAS,MAAMD,kBAAAA,CAAmB,IAAIE,UAAAA,CAAWnB,MAAAA,CAAAA,CAAAA;AACvD,QAAA,OAAOkB,MAAAA,EAAQE,IAAAA;AACjB,IAAA,CAAA,CAAE,OAAOT,KAAAA,EAAO;QACd,MAAM,IAAIC,KAAAA,CACR,CAAC,4BAA4B,EAAED,KAAAA,YAAiBC,KAAAA,GAAQD,KAAAA,CAAME,OAAO,GAAGC,MAAAA,CAAOH,KAAAA,CAAAA,CAAAA,CAAQ,CAAA;AAE3F,IAAA;AACF;AAEA,SAASU,kBAAAA,CAAmBC,QAAgB,EAAEC,QAAkB,EAAA;IAC9D,IAAI,CAACA,QAAAA,EAAUR,MAAAA,EAAQ,OAAO,KAAA;IAE9B,OAAOQ,QAAAA,CAASC,IAAI,CAAC,CAACC,OAAAA,GAAAA;QACpB,MAAMC,iBAAAA,GAAoBD,QAAQE,WAAW,EAAA;QAC7C,MAAMC,kBAAAA,GAAqBN,SAASK,WAAW,EAAA;QAE/C,IAAID,iBAAAA,CAAkBG,QAAQ,CAAC,GAAA,CAAA,EAAM;AACnC,YAAA,MAAMC,YAAAA,GAAeJ,iBAAAA,CAAkBK,OAAO,CAAC,KAAA,EAAO,IAAA,CAAA;YAEtD,MAAMC,KAAAA,GAAQ,IAAIC,MAAAA,CAAO,CAAC,CAAC,EAAEH,YAAAA,CAAa,CAAC,CAAC,CAAA;YAC5C,MAAMI,OAAAA,GAAUF,KAAAA,CAAMG,IAAI,CAACP,kBAAAA,CAAAA;YAC3B,OAAOM,OAAAA;AACT,QAAA;AAEA,QAAA,MAAME,aAAaV,iBAAAA,KAAsBE,kBAAAA;QACzC,OAAOQ,UAAAA;AACT,IAAA,CAAA,CAAA;AACF;AAkBA;;;IAIA,SAASC,qBAAAA,CACPC,QAAgB,EAChBC,QAAgB,EAChBC,YAAoB,EACpBC,YAAgC,EAChCC,MAAsB,EAAA;AAEtB,IAAA,IAAI,CAACJ,QAAAA,EAAU;QACb,OAAO;YACLK,OAAAA,EAAS,KAAA;YACThC,KAAAA,EAAO;gBACLiC,IAAAA,EAAM,uBAAA;gBACN/B,OAAAA,EAAS,0BAAA;gBACTgC,OAAAA,EAAS;AACPN,oBAAAA,QAAAA;oBACAO,MAAAA,EAAQ,0BAAA;AACRN,oBAAAA,YAAAA;AACAC,oBAAAA,YAAAA;AACAM,oBAAAA,YAAAA,EAAcL,OAAOK,YAAY;AACjCC,oBAAAA,WAAAA,EAAaN,OAAOM;AACtB;AACF;AACF,SAAA;AACF,IAAA;IACA,IAAIN,MAAAA,CAAOM,WAAW,EAAEjC,MAAAA,IAAUM,mBAAmBiB,QAAAA,EAAUI,MAAAA,CAAOM,WAAW,CAAA,EAAG;AAClF,QAAA,OAAOC,oBAAAA,CAAqBV,QAAAA,EAAUC,YAAAA,EAAcC,YAAAA,EAAcH,QAAAA,EAAUI,MAAAA,CAAAA;AAC9E,IAAA;AACA,IAAA,IAAI,CAACQ,KAAAA,CAAMC,OAAO,CAACT,MAAAA,CAAOK,YAAY,CAAA,EAAG;QACvC,OAAO;YAAEJ,OAAAA,EAAS,IAAA;YAAMS,YAAAA,EAAcd;AAAS,SAAA;AACjD,IAAA;AACA,IAAA,IAAII,MAAAA,CAAOK,YAAY,CAAChC,MAAM,KAAK,CAAA,EAAG;QACpC,OAAO;YACL4B,OAAAA,EAAS,KAAA;YACThC,KAAAA,EAAO;gBACLiC,IAAAA,EAAM,uBAAA;gBACN/B,OAAAA,EAAS,0BAAA;gBACTgC,OAAAA,EAAS;AACPN,oBAAAA,QAAAA;oBACAO,MAAAA,EAAQ,qBAAA;AACRN,oBAAAA,YAAAA;AACAC,oBAAAA,YAAAA;AACAM,oBAAAA,YAAAA,EAAcL,OAAOK,YAAY;AACjCC,oBAAAA,WAAAA,EAAaN,OAAOM;AACtB;AACF;AACF,SAAA;AACF,IAAA;AACA,IAAA,IAAI3B,kBAAAA,CAAmBiB,QAAAA,EAAUI,MAAAA,CAAOK,YAAY,CAAA,EAAG;QACrD,OAAO;YAAEJ,OAAAA,EAAS,IAAA;YAAMS,YAAAA,EAAcd;AAAS,SAAA;AACjD,IAAA;IACA,OAAO;QACLK,OAAAA,EAAS,KAAA;QACThC,KAAAA,EAAO;YACLiC,IAAAA,EAAM,uBAAA;AACN/B,YAAAA,OAAAA,EAAS,CAAC,WAAW,EAAEyB,QAAAA,CAAS,gBAAgB,CAAC;YACjDO,OAAAA,EAAS;AACPN,gBAAAA,QAAAA;AACAC,gBAAAA,YAAAA;AACAC,gBAAAA,YAAAA;gBACAY,SAAAA,EAAWf,QAAAA;AACXS,gBAAAA,YAAAA,EAAcL,OAAOK,YAAY;AACjCC,gBAAAA,WAAAA,EAAaN,OAAOM;AACtB;AACF;AACF,KAAA;AACF;AAEA,SAASM,kBAAkBC,gBAAwB,EAAA;IACjD,OAAO,CAACA,oBAAoBA,gBAAAA,KAAqB,0BAAA;AACnD;AAEO,SAASC,gBAAgB1D,IAAS,EAAA;AACvC,IAAA,MAAMyC,QAAAA,GACJzC,IAAAA,CAAK2D,gBAAgB,IACrB3D,KAAK4D,IAAI,IACT5D,IAAAA,CAAK6D,QAAQ,IACb7D,IAAAA,CAAK8D,WAAW,IAChB9D,IAAAA,CAAK+D,YAAY,IACjB,SAAA;AACF,IAAA,MAAMN,gBAAAA,GAAmBzD,IAAAA,CAAKwC,QAAQ,IAAIxC,IAAAA,CAAKgE,IAAI,IAAIhE,IAAAA,CAAKwB,QAAQ,IAAIxB,IAAAA,CAAKsB,IAAI,IAAI,EAAA;IAErF,OAAO;AAAEmB,QAAAA,QAAAA;AAAUgB,QAAAA;AAAiB,KAAA;AACtC;AAEO,eAAeQ,YAAAA,CACpBjE,IAAS,EACT4C,MAAsB,EACtBsB,MAAmB,EAAA;AAEnB,IAAA,MAAM,EAAEjB,YAAY,EAAEC,WAAW,EAAE,GAAGN,MAAAA;AAEtC,IAAA,MAAM,EAAEH,QAAQ,EAAEgB,gBAAgB,EAAE,GAAGC,eAAAA,CAAgB1D,IAAAA,CAAAA;IAEvD,MAAMmE,OAAAA,GAAUC,OAAAA,CAAQ3B,QAAAA,CAAAA,CAAUZ,WAAW,EAAA;AAC7C,IAAA,MAAMwC,mBAAAA,GAAsBF,OAAAA,GAAUG,MAAAA,CAAOH,OAAAA,CAAAA,IAAY,IAAA,GAAO,IAAA;;AAGhE,IAAA,IACE,CAACX,iBAAAA,CAAkBC,gBAAAA,CAAAA,IACnBP,aAAajC,MAAAA,IACbM,kBAAAA,CAAmBkC,kBAAkBP,WAAAA,CAAAA,EACrC;AACA,QAAA,OAAOC,oBAAAA,CAAqBV,QAAAA,EAAUgB,gBAAAA,EAAkBvC,SAAAA,EAAWuC,gBAAAA,EAAkBb,MAAAA,CAAAA;AACvF,IAAA;;AAGA,IAAA,IACEyB,mBAAAA,IACAnB,WAAAA,EAAajC,MAAAA,IACbM,kBAAAA,CAAmB8C,qBAAqBnB,WAAAA,CAAAA,EACxC;AACA,QAAA,OAAOC,oBAAAA,CAAqBV,QAAAA,EAAUgB,gBAAAA,EAAkBvC,SAAAA,EAAWmD,mBAAAA,EAAqBzB,MAAAA,CAAAA;AAC1F,IAAA;;IAGA,IAAIU,YAAAA;IACJ,IAAI;AACFA,QAAAA,YAAAA,GAAe,MAAM7C,cAAAA,CAAeT,IAAAA,CAAAA;AACtC,IAAA,CAAA,CAAE,OAAOa,KAAAA,EAAO;AACd,QAAA,MAAM0D,SAAS1D,KAAAA,YAAiBC,KAAAA,GAAQD,KAAAA,CAAME,OAAO,GAAGC,MAAAA,CAAOH,KAAAA,CAAAA;QAC/DqD,MAAAA,CAAOM,GAAG,CAACC,IAAI,CAAC,CAAC,sCAAsC,EAAEF,QAAQ,EAAE;AACjE9B,YAAAA,QAAAA;YACA5B,KAAAA,EAAO0D;AACT,SAAA,CAAA;AACF,IAAA;IAEA,MAAMG,wBAAAA,GACJ,CAAClB,iBAAAA,CAAkBC,gBAAAA,CAAAA,IACnBY,mBAAAA,KAAwB,QACxBA,mBAAAA,KAAwBnD,SAAAA,KACvBK,kBAAAA,CAAmBkC,gBAAAA,EAAkB;AAACY,QAAAA;AAAoB,KAAA,CAAA,IACzD9C,mBAAmB8C,mBAAAA,EAAqB;AAACZ,QAAAA;KAAiB,CAAA,CAAA;AAC9D,IAAA,MAAMkB,uBAAAA,GACJrB,YAAAA,IAAgBG,gBAAAA,IAAoBlC,kBAAAA,CAAmB+B,YAAAA,EAAc;AAACG,QAAAA;AAAiB,KAAA,CAAA;;AAGzF,IAAA,IAAIiB,4BAA4BC,uBAAAA,EAAyB;AACvD,QAAA,OAAOpC,qBAAAA,CACLkB,gBAAAA,EACAhB,QAAAA,EACAgB,gBAAAA,EACAH,YAAAA,EACAV,MAAAA,CAAAA;AAEJ,IAAA;;AAGA,IAAA,IAAIU,YAAAA,IAAgBJ,WAAAA,EAAajC,MAAAA,IAAUM,kBAAAA,CAAmB+B,cAAcJ,WAAAA,CAAAA,EAAc;AACxF,QAAA,OAAOC,oBAAAA,CAAqBV,QAAAA,EAAUgB,gBAAAA,EAAkBH,YAAAA,EAAcA,YAAAA,EAAcV,MAAAA,CAAAA;AACtF,IAAA;;;AAIA,IAAA,MAAMgC,mBAAAA,GACJtB,YAAAA,KAAiB,iBAAA,IACjBe,mBAAAA,IACAA,wBAAwB,iBAAA,IACxBjB,KAAAA,CAAMC,OAAO,CAACJ,iBACdA,YAAAA,CAAahC,MAAM,GAAG,CAAA,IACtBM,mBAAmB8C,mBAAAA,EAAqBpB,YAAAA,CAAAA;AAC1C,IAAA,IACEK,YAAAA,IACAF,KAAAA,CAAMC,OAAO,CAACJ,iBACdA,YAAAA,CAAahC,MAAM,GAAG,CAAA,IACtB,CAACM,kBAAAA,CAAmB+B,YAAAA,EAAcL,YAAAA,CAAAA,IAClC,CAAC2B,mBAAAA,EACD;QACA,OAAO;YACL/B,OAAAA,EAAS,KAAA;YACThC,KAAAA,EAAO;gBACLiC,IAAAA,EAAM,uBAAA;gBACN/B,OAAAA,EAAS,0BAAA;gBACTgC,OAAAA,EAAS;AACPN,oBAAAA,QAAAA;oBACAO,MAAAA,EACE,uGAAA;oBACFN,YAAAA,EAAce,gBAAAA;oBACdd,YAAAA,EAAcW,YAAAA;oBACduB,yBAAAA,EAA2BR,mBAAAA;AAC3BpB,oBAAAA,YAAAA;AACAC,oBAAAA;AACF;AACF;AACF,SAAA;AACF,IAAA;;AAGA,IAAA,MAAM4B,2BACJxB,YAAAA,IACAe,mBAAAA,KAAwB,QACxBA,mBAAAA,KAAwBnD,SAAAA,IACxBK,mBAAmB+B,YAAAA,EAAc;AAACe,QAAAA;AAAoB,KAAA,CAAA;AACxD,IAAA,IACEf,iBACC,CAACe,uBAAuBS,wBAAAA,IAA4BtB,iBAAAA,CAAkBC,iBAAgB,CAAA,EACvF;;AAEA,QAAA,IACEH,YAAAA,KAAiB,iBAAA,IACjBe,mBAAAA,IACAA,mBAAAA,KAAwB,iBAAA,EACxB;AACA,YAAA,MAAMU,SAAAA,GAAYxC,qBAAAA,CAChB8B,mBAAAA,EACA5B,QAAAA,EACAgB,kBACAH,YAAAA,EACAV,MAAAA,CAAAA;YAEF,IAAImC,SAAAA,CAAUlC,OAAO,EAAE;AACrBqB,gBAAAA,MAAAA,CAAOM,GAAG,CAACC,IAAI,CACb,iFAAA,EACA;AAAEhC,oBAAAA,QAAAA;oBAAUuC,aAAAA,EAAeb,OAAAA;oBAASU,yBAAAA,EAA2BR;AAAoB,iBAAA,CAAA;gBAErF,OAAOU,SAAAA;AACT,YAAA;AACF,QAAA;AACA,QAAA,OAAOxC,qBAAAA,CAAsBe,YAAAA,EAAcb,QAAAA,EAAUgB,gBAAAA,EAAkBH,YAAAA,EAAcV,MAAAA,CAAAA;AACvF,IAAA;;AAGA,IAAA,IAAIyB,mBAAAA,EAAqB;AACvB,QAAA,OAAO9B,qBAAAA,CACL8B,mBAAAA,EACA5B,QAAAA,EACAgB,gBAAAA,EACAH,YAAAA,EACAV,MAAAA,CAAAA;AAEJ,IAAA;;AAGA,IAAA,IAAIa,gBAAAA,EAAkB;AACpB,QAAA,OAAOlB,qBAAAA,CACLkB,gBAAAA,EACAhB,QAAAA,EACAgB,gBAAAA,EACAH,YAAAA,EACAV,MAAAA,CAAAA;AAEJ,IAAA;;IAGA,OAAO;QACLC,OAAAA,EAAS,KAAA;QACThC,KAAAA,EAAO;YACLiC,IAAAA,EAAM,uBAAA;YACN/B,OAAAA,EAAS,8CAAA;YACTgC,OAAAA,EAAS;AACPN,gBAAAA,QAAAA;gBACAO,MAAAA,EAAQ,yEAAA;gBACRN,YAAAA,EAAce,gBAAAA;gBACdd,YAAAA,EAAcW,YAAAA;AACdL,gBAAAA,YAAAA;AACAC,gBAAAA;AACF;AACF;AACF,KAAA;AACF;AAEA,SAASC,oBAAAA,CACPV,QAAgB,EAChBC,YAAoB,EACpBC,YAAgC,EAChCsC,YAAoB,EACpBrC,MAAsB,EAAA;IAEtB,OAAO;QACLC,OAAAA,EAAS,KAAA;QACThC,KAAAA,EAAO;YACLiC,IAAAA,EAAM,uBAAA;AACN/B,YAAAA,OAAAA,EAAS,CAAC,WAAW,EAAEkE,YAAAA,CAAa,gBAAgB,CAAC;YACrDlC,OAAAA,EAAS;AACPN,gBAAAA,QAAAA;AACAC,gBAAAA,YAAAA;AACAC,gBAAAA,YAAAA;gBACAY,SAAAA,EAAW0B,YAAAA;AACXhC,gBAAAA,YAAAA,EAAcL,OAAOK,YAAY;AACjCC,gBAAAA,WAAAA,EAAaN,OAAOM,WAAW;gBAC/BF,MAAAA,EAAQ;AACV;AACF;AACF,KAAA;AACF;AAEO,eAAekC,aAAAA,CAAcC,KAAU,EAAEjB,MAAmB,EAAA;AACjE,IAAA,MAAMkB,UAAAA,GAAahC,KAAAA,CAAMC,OAAO,CAAC8B,SAASA,KAAAA,GAAQ;AAACA,QAAAA;AAAM,KAAA;IAEzD,IAAI,CAACC,UAAAA,CAAWnE,MAAM,EAAE;AACtB,QAAA,OAAO,EAAE;AACX,IAAA;;AAGA,IAAA,IAAI2B,MAAAA,GAAyBsB,MAAAA,CAAOtB,MAAM,CAACyC,GAAG,CAC5C;AAAC,QAAA,gBAAA;AAAkB,QAAA;AAAW,KAAA,EAC9B,EAAC,CAAA;AAEH,IAAA,IAAI,CAACzC,MAAAA,IAAU,OAAOA,MAAAA,KAAW,QAAA,EAAU;AACzCA,QAAAA,MAAAA,GAAS,EAAC;AACZ,IAAA;IACA,IACEA,MAAAA,CAAOK,YAAY,KAClB,CAACG,KAAAA,CAAMC,OAAO,CAACT,MAAAA,CAAOK,YAAY,CAAA,IACjC,CAACL,MAAAA,CAAOK,YAAY,CAACqC,KAAK,CAAC,CAACC,IAAAA,GAAS,OAAOA,IAAAA,KAAS,QAAA,CAAQ,CAAA,EAC/D;QACA,MAAM,IAAIC,MAAAA,CAAOC,gBAAgB,CAC/B,kEAAA,CAAA;AAEJ,IAAA;IAEA,IACE7C,MAAAA,CAAOM,WAAW,KACjB,CAACE,KAAAA,CAAMC,OAAO,CAACT,MAAAA,CAAOM,WAAW,CAAA,IAChC,CAACN,MAAAA,CAAOM,WAAW,CAACoC,KAAK,CAAC,CAACC,IAAAA,GAAS,OAAOA,IAAAA,KAAS,QAAA,CAAQ,CAAA,EAC9D;QACA,MAAM,IAAIC,MAAAA,CAAOC,gBAAgB,CAC/B,iEAAA,CAAA;AAEJ,IAAA;AAEA,IAAA,IAAI,CAAC7C,MAAAA,CAAOK,YAAY,IAAI,CAACL,MAAAA,CAAOM,WAAW,EAAE;QAC/CgB,MAAAA,CAAOM,GAAG,CAACC,IAAI,CACb,mHAAA,CAAA;;AAGJ,IAAA;AAEA,IAAA,MAAMiB,kBAAAA,GAAqBN,UAAAA,CAAWO,GAAG,CAAC,OAAO3F,IAAAA,EAAM4F,KAAAA,GAAAA;QACrD,IAAI;YACF,OAAO,MAAM3B,YAAAA,CAAajE,IAAAA,EAAM4C,MAAAA,EAAQsB,MAAAA,CAAAA;AAC1C,QAAA,CAAA,CAAE,OAAOrD,KAAAA,EAAO;AACdqD,YAAAA,MAAAA,CAAOM,GAAG,CAAC3D,KAAK,CAAC,yCAAA,EAA2C;gBAC1DgF,SAAAA,EAAWD,KAAAA;gBACXnD,QAAAA,EAAUzC,IAAAA,EAAM4D,QAAQ5D,IAAAA,EAAM+D,YAAAA;AAC9BlD,gBAAAA,KAAAA,EAAOA,KAAAA,YAAiBC,KAAAA,GAAQD,KAAAA,CAAME,OAAO,GAAGC,MAAAA,CAAOH,KAAAA;AACzD,aAAA,CAAA;YAEA,OAAO;gBACLgC,OAAAA,EAAS,KAAA;gBACThC,KAAAA,EAAO;oBACLiC,IAAAA,EAAM,kBAAA;oBACN/B,OAAAA,EAAS,CAAC,oCAAoC,EAAE6E,KAAAA,CAAAA,CAAO;oBACvD7C,OAAAA,EAAS;AACP6C,wBAAAA,KAAAA;wBACAnD,QAAAA,EAAUzC,IAAAA,EAAM4D,QAAQ5D,IAAAA,EAAM+D,YAAAA;AAC9B+B,wBAAAA,aAAAA,EAAejF,KAAAA,YAAiBC,KAAAA,GAAQD,KAAAA,CAAME,OAAO,GAAGC,MAAAA,CAAOH,KAAAA;AACjE;AACF;AACF,aAAA;AACF,QAAA;AACF,IAAA,CAAA,CAAA;IAEA,OAAOkF,OAAAA,CAAQC,GAAG,CAACN,kBAAAA,CAAAA;AACrB;AAEO,eAAeO,qBAAAA,CACpBd,KAAU,EACVjB,MAAmB,EAAA;IAMnB,MAAMgC,iBAAAA,GAAoB,MAAMhB,aAAAA,CAAcC,KAAAA,EAAOjB,MAAAA,CAAAA;AACrD,IAAA,MAAMkB,UAAAA,GAAahC,KAAAA,CAAMC,OAAO,CAAC8B,SAASA,KAAAA,GAAQ;AAACA,QAAAA;AAAM,KAAA;AAEzD,IAAA,MAAMgB,aAAoB,EAAE;AAC5B,IAAA,MAAMC,iBAA2B,EAAE;AACnC,IAAA,MAAMZ,SAA6B,EAAE;AAErC,IAAA,KAAK,MAAM,CAACI,KAAAA,EAAOxE,OAAO,IAAI8E,iBAAAA,CAAkBG,OAAO,EAAA,CAAI;QACzD,IAAIjF,MAAAA,CAAOyB,OAAO,EAAE;YAClB,MAAM7C,IAAAA,GAAOoF,UAAU,CAACQ,KAAAA,CAAM;;YAE9B,IAAIxE,MAAAA,CAAOkC,YAAY,EAAE;gBACvBtD,IAAAA,CAAKsG,gBAAgB,GAAGlF,MAAAA,CAAOkC,YAAY;AAC7C,YAAA;AACA6C,YAAAA,UAAAA,CAAWI,IAAI,CAACvG,IAAAA,CAAAA;AAChBoG,YAAAA,cAAAA,CAAeG,IAAI,CAACvG,IAAAA,CAAK2D,gBAAgB,IAAI3D,KAAK4D,IAAI,CAAA;QACxD,CAAA,MAAO,IAAIxC,MAAAA,CAAOP,KAAK,EAAE;AACvB2E,YAAAA,MAAAA,CAAOe,IAAI,CAAC;gBACVvG,IAAAA,EAAMoF,UAAU,CAACQ,KAAAA,CAAM;gBACvBY,aAAAA,EAAeZ,KAAAA;AACf/E,gBAAAA,KAAAA,EAAOO,OAAOP;AAChB,aAAA,CAAA;QACF,CAAA,MAAO;;AAEL2E,YAAAA,MAAAA,CAAOe,IAAI,CAAC;gBACVvG,IAAAA,EAAMoF,UAAU,CAACQ,KAAAA,CAAM;gBACvBY,aAAAA,EAAeZ,KAAAA;gBACf/E,KAAAA,EAAO;oBACLiC,IAAAA,EAAM,eAAA;oBACN/B,OAAAA,EAAS,2CAAA;oBACTgC,OAAAA,EAAS;AACP6C,wBAAAA,KAAAA;wBACAnD,QAAAA,EAAU2C,UAAU,CAACQ,KAAAA,CAAM,EAAEhC,QAAQwB,UAAU,CAACQ,MAAM,EAAE7B;AAC1D;AACF;AACF,aAAA,CAAA;AACF,QAAA;AACF,IAAA;IAEA,OAAO;AAAEoC,QAAAA,UAAAA;AAAYC,QAAAA,cAAAA;AAAgBZ,QAAAA;AAAO,KAAA;AAC9C;AAaA;;AAEC,IACM,eAAeiB,oBAAAA,CACpBC,UAAe,EACfC,IAAS,EACTzC,MAAmB,EAAA;IAEnB,MAAM0C,eAAAA,GAAkB,MAAMX,qBAAAA,CAAsBS,UAAAA,EAAYxC,MAAAA,CAAAA;AAEhE,IAAA,IAAI2C,YAAAA,GAAeF,IAAAA;AACnB,IAAA,IAAIA,MAAMG,QAAAA,EAAU;;QAElB,IAAIC,cAAAA,GAAiBJ,KAAKG,QAAQ;AAClC,QAAA,IAAI1D,KAAAA,CAAMC,OAAO,CAACsD,IAAAA,CAAKG,QAAQ,CAAA,EAAG;AAChCC,YAAAA,cAAAA,GAAiBJ,IAAAA,CAAKG,QAAQ,CAACnB,GAAG,CAAC,CAACqB,EAAAA,GAClC,OAAOA,EAAAA,KAAO,QAAA,GAAWC,IAAAA,CAAKC,KAAK,CAACF,EAAAA,CAAAA,GAAMA,EAAAA,CAAAA;AAE9C,QAAA,CAAA,MAAO,IAAI,OAAOL,IAAAA,CAAKG,QAAQ,KAAK,QAAA,EAAU;AAC5CC,YAAAA,cAAAA,GAAiBE,IAAAA,CAAKC,KAAK,CAACP,IAAAA,CAAKG,QAAQ,CAAA;AAC3C,QAAA;;QAGA,IAAI1D,KAAAA,CAAMC,OAAO,CAAC0D,cAAAA,CAAAA,EAAiB;YACjC,MAAMI,cAAAA,GAAiB,IAAIC,GAAAA,CAAIR,eAAAA,CAAgBpB,MAAM,CAACG,GAAG,CAAC,CAAC0B,CAAAA,GAAMA,CAAAA,CAAEb,aAAa,CAAA,CAAA;YAChF,MAAMc,gBAAAA,GAAmBP,cAAAA,CAAeQ,MAAM,CAC5C,CAACC,GAAQ5B,KAAAA,GAAkB,CAACuB,cAAAA,CAAeM,GAAG,CAAC7B,KAAAA,CAAAA,CAAAA;YAGjD,IAAI0B,gBAAAA,CAAiBrG,MAAM,KAAK,CAAA,EAAG;gBACjC4F,YAAAA,GAAe;AACb,oBAAA,GAAGF,IAAI;oBACPG,QAAAA,EAAUQ,gBAAgB,CAAC,CAAA;AAC7B,iBAAA;YACF,CAAA,MAAO;gBACLT,YAAAA,GAAe;AACb,oBAAA,GAAGF,IAAI;oBACPG,QAAAA,EAAUQ;AACZ,iBAAA;AACF,YAAA;QACF,CAAA,MAAO;YACLT,YAAAA,GAAe;AACb,gBAAA,GAAGF,IAAI;gBACPG,QAAAA,EAAUC;AACZ,aAAA;AACF,QAAA;AACF,IAAA;;IAGA,MAAMW,YAAAA,GAAkCd,gBAAgBpB,MAAM,CAACG,GAAG,CAAC,CAAC0B,KAAO;AACzEzD,YAAAA,IAAAA,EAAMyD,EAAErH,IAAI,EAAE2D,oBAAoB0D,CAAAA,CAAErH,IAAI,EAAE4D,IAAAA,IAAQ,SAAA;YAClD7C,OAAAA,EAASsG,CAAAA,CAAExG,KAAK,CAACE;SACnB,CAAA,CAAA;IAEA,OAAO;AACLoF,QAAAA,UAAAA,EAAYS,gBAAgBT,UAAU;AACtCU,QAAAA,YAAAA;QACArB,MAAAA,EAAQkC;AACV,KAAA;AACF;;;;"}
+{"version":3,"file":"mime-validation.mjs","sources":["../../../server/src/utils/mime-validation.ts"],"sourcesContent":["import { open } from 'node:fs/promises';\nimport { extname } from 'node:path';\nimport { lookup } from 'mime-types';\nimport type { Core } from '@strapi/types';\nimport { errors } from '@strapi/utils';\n\nexport type SecurityConfig = {\n  allowedTypes?: string[];\n  deniedTypes?: string[];\n};\ntype UploadValidationError = {\n  code: 'MIME_TYPE_NOT_ALLOWED' | 'VALIDATION_ERROR' | 'UNKNOWN_ERROR';\n  message: string;\n  details: Record<string, any>;\n};\n\ntype ValidationResult = {\n  isValid: boolean;\n  error?: UploadValidationError;\n  detectedMime?: string;\n};\n\ntype ErrorDetail = {\n  file: any;\n  originalIndex: number;\n  error: UploadValidationError;\n};\n\nasync function readFileChunk(filePath: string, chunkSize: number = 4100): Promise<Buffer> {\n  const file = await open(filePath, 'r');\n\n  try {\n    const buffer = Buffer.alloc(chunkSize);\n    const { bytesRead } = await file.read(buffer, 0, chunkSize, 0);\n\n    return buffer.subarray(0, bytesRead);\n  } finally {\n    await file.close();\n  }\n}\n\nexport async function detectMimeType(file: any): Promise<string | undefined> {\n  let buffer: Buffer;\n\n  // Support multiple property names used by different multipart parsers (formidable uses filepath)\n  const filePath = file.filepath ?? file.path ?? file.tempFilePath ?? file.filePath;\n\n  if (filePath) {\n    try {\n      buffer = await readFileChunk(filePath, 4100);\n    } catch (error) {\n      throw new Error(\n        `Failed to read file: ${error instanceof Error ? error.message : String(error)}`\n      );\n    }\n  } else if (file.buffer) {\n    buffer = file.buffer.length > 4100 ? file.buffer.subarray(0, 4100) : file.buffer;\n  } else {\n    // No file path or buffer; cannot detect MIME. Validation will use declared/extension or reject.\n    return undefined;\n  }\n\n  try {\n    /**\n     * Use dynamic import to support file-type which is ESM-only\n     * Static imports fail during CommonJS build since bundler can't transform ESM-only packages\n     * @see https://gist.github.com/sindresorhus/a39789f98801d908bbc7ff3ecc99d99c\n     */\n    const { fileTypeFromBuffer } = await import('file-type');\n\n    const result = await fileTypeFromBuffer(new Uint8Array(buffer));\n    return result?.mime;\n  } catch (error) {\n    throw new Error(\n      `Failed to detect MIME type: ${error instanceof Error ? error.message : String(error)}`\n    );\n  }\n}\n\nfunction matchesMimePattern(mimeType: string, patterns: string[]): boolean {\n  if (!patterns?.length) return false;\n\n  return patterns.some((pattern) => {\n    const normalizedPattern = pattern.toLowerCase();\n    const normalizedMimeType = mimeType.toLowerCase();\n\n    if (normalizedPattern.includes('*')) {\n      const regexPattern = normalizedPattern.replace(/\\*/g, '.*');\n\n      const regex = new RegExp(`^${regexPattern}$`);\n      const matches = regex.test(normalizedMimeType);\n      return matches;\n    }\n\n    const exactMatch = normalizedPattern === normalizedMimeType;\n    return exactMatch;\n  });\n}\n\nexport function isMimeTypeAllowed(mimeType: string, config: SecurityConfig): boolean {\n  const { allowedTypes, deniedTypes } = config;\n\n  if (!mimeType) return false;\n\n  if (deniedTypes?.length && matchesMimePattern(mimeType, deniedTypes)) {\n    return false;\n  }\n\n  if (Array.isArray(allowedTypes)) {\n    return allowedTypes.length > 0 && matchesMimePattern(mimeType, allowedTypes);\n  }\n\n  return true;\n}\n\n/**\n * Single gate for allow/deny. Returns ValidationResult.\n * Doc: docs/docs/01-core/upload/01-backend/01-mime-validation.md\n */\nfunction validateAllowBanLists(\n  mimetype: string,\n  fileName: string,\n  declaredType: string,\n  detectedType: string | undefined,\n  config: SecurityConfig\n): ValidationResult {\n  if (!mimetype) {\n    return {\n      isValid: false,\n      error: {\n        code: 'MIME_TYPE_NOT_ALLOWED',\n        message: 'MIME type is not allowed',\n        details: {\n          fileName,\n          reason: 'No MIME type to validate',\n          declaredType,\n          detectedType,\n          allowedTypes: config.allowedTypes,\n          deniedTypes: config.deniedTypes,\n        },\n      },\n    };\n  }\n  if (config.deniedTypes?.length && matchesMimePattern(mimetype, config.deniedTypes)) {\n    return buildNotAllowedError(fileName, declaredType, detectedType, mimetype, config);\n  }\n  if (!Array.isArray(config.allowedTypes)) {\n    return { isValid: true, detectedMime: mimetype };\n  }\n  if (config.allowedTypes.length === 0) {\n    return {\n      isValid: false,\n      error: {\n        code: 'MIME_TYPE_NOT_ALLOWED',\n        message: 'MIME type is not allowed',\n        details: {\n          fileName,\n          reason: 'Allow list is empty',\n          declaredType,\n          detectedType,\n          allowedTypes: config.allowedTypes,\n          deniedTypes: config.deniedTypes,\n        },\n      },\n    };\n  }\n  if (matchesMimePattern(mimetype, config.allowedTypes)) {\n    return { isValid: true, detectedMime: mimetype };\n  }\n  return {\n    isValid: false,\n    error: {\n      code: 'MIME_TYPE_NOT_ALLOWED',\n      message: `File type '${mimetype}' is not allowed`,\n      details: {\n        fileName,\n        declaredType,\n        detectedType,\n        finalType: mimetype,\n        allowedTypes: config.allowedTypes,\n        deniedTypes: config.deniedTypes,\n      },\n    },\n  };\n}\n\nfunction isDeclaredGeneric(declaredMimeType: string): boolean {\n  return !declaredMimeType || declaredMimeType === 'application/octet-stream';\n}\n\nexport function extractFileInfo(file: any) {\n  const fileName =\n    file.originalFilename ||\n    file.name ||\n    file.filename ||\n    file.newFilename ||\n    file.originalname ||\n    'unknown';\n  const declaredMimeType = file.mimetype || file.type || file.mimeType || file.mime || '';\n\n  return { fileName, declaredMimeType };\n}\n\nexport async function validateFile(\n  file: any,\n  config: SecurityConfig,\n  strapi: Core.Strapi\n): Promise<ValidationResult> {\n  const { allowedTypes, deniedTypes } = config;\n\n  const { fileName, declaredMimeType } = extractFileInfo(file);\n\n  const fileExt = extname(fileName).toLowerCase();\n  const expectedMimeFromExt = fileExt ? lookup(fileExt) || null : null;\n\n  // Reject if declared type is denied.\n  if (\n    !isDeclaredGeneric(declaredMimeType) &&\n    deniedTypes?.length &&\n    matchesMimePattern(declaredMimeType, deniedTypes)\n  ) {\n    return buildNotAllowedError(fileName, declaredMimeType, undefined, declaredMimeType, config);\n  }\n\n  // Reject if extension's type is denied.\n  if (\n    expectedMimeFromExt &&\n    deniedTypes?.length &&\n    matchesMimePattern(expectedMimeFromExt, deniedTypes)\n  ) {\n    return buildNotAllowedError(fileName, declaredMimeType, undefined, expectedMimeFromExt, config);\n  }\n\n  // Run content detection.\n  let detectedMime: string | undefined;\n  try {\n    detectedMime = await detectMimeType(file);\n  } catch (error) {\n    const errMsg = error instanceof Error ? error.message : String(error);\n    strapi.log.warn(`Failed to detect MIME type from file: ${errMsg}`, {\n      fileName,\n      error: errMsg,\n    });\n  }\n\n  const declaredMatchesExtension =\n    !isDeclaredGeneric(declaredMimeType) &&\n    expectedMimeFromExt !== null &&\n    expectedMimeFromExt !== undefined &&\n    (matchesMimePattern(declaredMimeType, [expectedMimeFromExt]) ||\n      matchesMimePattern(expectedMimeFromExt, [declaredMimeType]));\n  const detectedMatchesDeclared =\n    detectedMime && declaredMimeType && matchesMimePattern(detectedMime, [declaredMimeType]);\n\n  // Trusted declaration: declared matches extension and detection confirms.\n  if (declaredMatchesExtension && detectedMatchesDeclared) {\n    return validateAllowBanLists(\n      declaredMimeType,\n      fileName,\n      declaredMimeType,\n      detectedMime,\n      config\n    );\n  }\n\n  // Reject if detected type is denied.\n  if (detectedMime && deniedTypes?.length && matchesMimePattern(detectedMime, deniedTypes)) {\n    return buildNotAllowedError(fileName, declaredMimeType, detectedMime, detectedMime, config);\n  }\n\n  // Reject if detected is not in allow list (extension/declared cannot override).\n  // Exception: file-type often returns application/zip for Office formats (docx, xlsx); skip so the next block can allow via extension type.\n  const isZipWithAllowedExt =\n    detectedMime === 'application/zip' &&\n    expectedMimeFromExt &&\n    expectedMimeFromExt !== 'application/zip' &&\n    Array.isArray(allowedTypes) &&\n    allowedTypes.length > 0 &&\n    matchesMimePattern(expectedMimeFromExt, allowedTypes);\n  // Exception: file-type often returns application/xml for SVG; trust .svg extension when image/svg+xml is allowed.\n  const isSvgXmlWithAllowedExt =\n    detectedMime === 'application/xml' &&\n    fileExt === '.svg' &&\n    expectedMimeFromExt === 'image/svg+xml' &&\n    Array.isArray(allowedTypes) &&\n    allowedTypes.length > 0 &&\n    matchesMimePattern(expectedMimeFromExt, allowedTypes);\n  if (\n    detectedMime &&\n    Array.isArray(allowedTypes) &&\n    allowedTypes.length > 0 &&\n    !matchesMimePattern(detectedMime, allowedTypes) &&\n    !isZipWithAllowedExt &&\n    !isSvgXmlWithAllowedExt\n  ) {\n    return {\n      isValid: false,\n      error: {\n        code: 'MIME_TYPE_NOT_ALLOWED',\n        message: 'MIME type is not allowed',\n        details: {\n          fileName,\n          reason:\n            'File content was detected as a type not in the allow list; extension or declared type cannot override',\n          declaredType: declaredMimeType,\n          detectedType: detectedMime,\n          expectedMimeFromExtension: expectedMimeFromExt,\n          allowedTypes,\n          deniedTypes,\n        },\n      },\n    };\n  }\n\n  // Use detected type when defined and (no extension, or detected matches extension, or declared is generic).\n  const detectedMatchesExtension =\n    detectedMime &&\n    expectedMimeFromExt !== null &&\n    expectedMimeFromExt !== undefined &&\n    matchesMimePattern(detectedMime, [expectedMimeFromExt]);\n  if (\n    detectedMime &&\n    (!expectedMimeFromExt || detectedMatchesExtension || isDeclaredGeneric(declaredMimeType))\n  ) {\n    // Office/zip exception: use extension type when detection returned application/zip and extension is in allow list.\n    if (\n      detectedMime === 'application/zip' &&\n      expectedMimeFromExt &&\n      expectedMimeFromExt !== 'application/zip'\n    ) {\n      const extResult = validateAllowBanLists(\n        expectedMimeFromExt,\n        fileName,\n        declaredMimeType,\n        detectedMime,\n        config\n      );\n      if (extResult.isValid) {\n        strapi.log.warn(\n          'MIME type detection returned application/zip; trusting extension for allow list',\n          { fileName, fileExtension: fileExt, expectedMimeFromExtension: expectedMimeFromExt }\n        );\n        return extResult;\n      }\n    }\n    return validateAllowBanLists(detectedMime, fileName, declaredMimeType, detectedMime, config);\n  }\n\n  // Use extension's type when present.\n  if (expectedMimeFromExt) {\n    return validateAllowBanLists(\n      expectedMimeFromExt,\n      fileName,\n      declaredMimeType,\n      detectedMime,\n      config\n    );\n  }\n\n  // Use declared type as last resort.\n  if (declaredMimeType) {\n    return validateAllowBanLists(\n      declaredMimeType,\n      fileName,\n      declaredMimeType,\n      detectedMime,\n      config\n    );\n  }\n\n  // Reject when no type can be chosen.\n  return {\n    isValid: false,\n    error: {\n      code: 'MIME_TYPE_NOT_ALLOWED',\n      message: 'Cannot verify file type for security reasons',\n      details: {\n        fileName,\n        reason: 'No MIME type to validate (no declared type, no extension, no detection)',\n        declaredType: declaredMimeType,\n        detectedType: detectedMime,\n        allowedTypes,\n        deniedTypes,\n      },\n    },\n  };\n}\n\nfunction buildNotAllowedError(\n  fileName: string,\n  declaredType: string,\n  detectedType: string | undefined,\n  rejectedType: string,\n  config: SecurityConfig\n): ValidationResult {\n  return {\n    isValid: false,\n    error: {\n      code: 'MIME_TYPE_NOT_ALLOWED',\n      message: `File type '${rejectedType}' is not allowed`,\n      details: {\n        fileName,\n        declaredType,\n        detectedType,\n        finalType: rejectedType,\n        allowedTypes: config.allowedTypes,\n        deniedTypes: config.deniedTypes,\n        reason: 'MIME type is in the denied list',\n      },\n    },\n  };\n}\n\nexport async function validateFiles(files: any, strapi: Core.Strapi): Promise<ValidationResult[]> {\n  const filesArray = Array.isArray(files) ? files : [files];\n\n  if (!filesArray.length) {\n    return [];\n  }\n\n  // Use array path so 'plugin::upload' is a single key (lodash string path splits on '.')\n  let config: SecurityConfig = strapi.config.get(\n    ['plugin::upload', 'security'],\n    {}\n  ) as SecurityConfig;\n  if (!config || typeof config !== 'object') {\n    config = {};\n  }\n  if (\n    config.allowedTypes &&\n    (!Array.isArray(config.allowedTypes) ||\n      !config.allowedTypes.every((item) => typeof item === 'string'))\n  ) {\n    throw new errors.ApplicationError(\n      'Invalid configuration: allowedTypes must be an array of strings.'\n    );\n  }\n\n  if (\n    config.deniedTypes &&\n    (!Array.isArray(config.deniedTypes) ||\n      !config.deniedTypes.every((item) => typeof item === 'string'))\n  ) {\n    throw new errors.ApplicationError(\n      'Invalid configuration: deniedTypes must be an array of strings.'\n    );\n  }\n\n  if (!config.allowedTypes && !config.deniedTypes) {\n    strapi.log.warn(\n      'No upload security configuration found. Consider configuring plugin.upload.security for enhanced file validation.'\n    );\n    // Do not return; we still run validation so MIME detection runs and stored file gets detected type when possible\n  }\n\n  const validationPromises = filesArray.map(async (file, index) => {\n    try {\n      return await validateFile(file, config, strapi);\n    } catch (error) {\n      strapi.log.error('Unexpected error during file validation', {\n        fileIndex: index,\n        fileName: file?.name || file?.originalname,\n        error: error instanceof Error ? error.message : String(error),\n      });\n\n      return {\n        isValid: false,\n        error: {\n          code: 'VALIDATION_ERROR' as const,\n          message: `Validation failed for file at index ${index}`,\n          details: {\n            index,\n            fileName: file?.name || file?.originalname,\n            originalError: error instanceof Error ? error.message : String(error),\n          },\n        },\n      };\n    }\n  });\n\n  return Promise.all(validationPromises);\n}\n\nexport async function enforceUploadSecurity(\n  files: any,\n  strapi: Core.Strapi\n): Promise<{\n  validFiles: any[];\n  validFileNames: string[];\n  errors: Array<ErrorDetail>;\n}> {\n  const validationResults = await validateFiles(files, strapi);\n  const filesArray = Array.isArray(files) ? files : [files];\n\n  const validFiles: any[] = [];\n  const validFileNames: string[] = [];\n  const errors: Array<ErrorDetail> = [];\n\n  for (const [index, result] of validationResults.entries()) {\n    if (result.isValid) {\n      const file = filesArray[index];\n      // Enrich file with detected MIME type for use in storage\n      if (result.detectedMime) {\n        file.detectedMimeType = result.detectedMime;\n      }\n      validFiles.push(file);\n      validFileNames.push(file.originalFilename || file.name);\n    } else if (result.error) {\n      errors.push({\n        file: filesArray[index],\n        originalIndex: index,\n        error: result.error,\n      });\n    } else {\n      // Handle case where validation failed but no error details are provided\n      errors.push({\n        file: filesArray[index],\n        originalIndex: index,\n        error: {\n          code: 'UNKNOWN_ERROR' as const,\n          message: 'File validation failed for unknown reason',\n          details: {\n            index,\n            fileName: filesArray[index]?.name || filesArray[index]?.originalname,\n          },\n        },\n      });\n    }\n  }\n\n  return { validFiles, validFileNames, errors };\n}\n\nexport type FileUploadError = {\n  name: string;\n  message: string;\n};\n\nexport type PrepareUploadResult = {\n  validFiles: any[];\n  filteredBody: any;\n  errors: FileUploadError[];\n};\n\n/**\n * Prepare files and body for upload by enforcing security and parsing fileInfo\n */\nexport async function prepareUploadRequest(\n  filesInput: any,\n  body: any,\n  strapi: Core.Strapi\n): Promise<PrepareUploadResult> {\n  const securityResults = await enforceUploadSecurity(filesInput, strapi);\n\n  let filteredBody = body;\n  if (body?.fileInfo) {\n    // Parse JSON strings in fileInfo\n    let parsedFileInfo = body.fileInfo;\n    if (Array.isArray(body.fileInfo)) {\n      parsedFileInfo = body.fileInfo.map((fi: any) =>\n        typeof fi === 'string' ? JSON.parse(fi) : fi\n      );\n    } else if (typeof body.fileInfo === 'string') {\n      parsedFileInfo = JSON.parse(body.fileInfo);\n    }\n\n    // Filter fileInfo by index - only keep entries for files that passed validation\n    if (Array.isArray(parsedFileInfo)) {\n      const invalidIndices = new Set(securityResults.errors.map((e) => e.originalIndex));\n      const filteredFileInfo = parsedFileInfo.filter(\n        (_: any, index: number) => !invalidIndices.has(index)\n      );\n\n      if (filteredFileInfo.length === 1) {\n        filteredBody = {\n          ...body,\n          fileInfo: filteredFileInfo[0],\n        };\n      } else {\n        filteredBody = {\n          ...body,\n          fileInfo: filteredFileInfo,\n        };\n      }\n    } else {\n      filteredBody = {\n        ...body,\n        fileInfo: parsedFileInfo,\n      };\n    }\n  }\n\n  // Map errors to simplified format\n  const uploadErrors: FileUploadError[] = securityResults.errors.map((e) => ({\n    name: e.file?.originalFilename || e.file?.name || 'unknown',\n    message: e.error.message,\n  }));\n\n  return {\n    validFiles: securityResults.validFiles,\n    filteredBody,\n    errors: uploadErrors,\n  };\n}\n"],"names":["readFileChunk","filePath","chunkSize","file","open","buffer","Buffer","alloc","bytesRead","read","subarray","close","detectMimeType","filepath","path","tempFilePath","error","Error","message","String","length","undefined","fileTypeFromBuffer","result","Uint8Array","mime","matchesMimePattern","mimeType","patterns","some","pattern","normalizedPattern","toLowerCase","normalizedMimeType","includes","regexPattern","replace","regex","RegExp","matches","test","exactMatch","validateAllowBanLists","mimetype","fileName","declaredType","detectedType","config","isValid","code","details","reason","allowedTypes","deniedTypes","buildNotAllowedError","Array","isArray","detectedMime","finalType","isDeclaredGeneric","declaredMimeType","extractFileInfo","originalFilename","name","filename","newFilename","originalname","type","validateFile","strapi","fileExt","extname","expectedMimeFromExt","lookup","errMsg","log","warn","declaredMatchesExtension","detectedMatchesDeclared","isZipWithAllowedExt","isSvgXmlWithAllowedExt","expectedMimeFromExtension","detectedMatchesExtension","extResult","fileExtension","rejectedType","validateFiles","files","filesArray","get","every","item","errors","ApplicationError","validationPromises","map","index","fileIndex","originalError","Promise","all","enforceUploadSecurity","validationResults","validFiles","validFileNames","entries","detectedMimeType","push","originalIndex","prepareUploadRequest","filesInput","body","securityResults","filteredBody","fileInfo","parsedFileInfo","fi","JSON","parse","invalidIndices","Set","e","filteredFileInfo","filter","_","has","uploadErrors"],"mappings":";;;;;AA4BA,eAAeA,aAAAA,CAAcC,QAAgB,EAAEC,SAAAA,GAAoB,IAAI,EAAA;IACrE,MAAMC,IAAAA,GAAO,MAAMC,IAAAA,CAAKH,QAAAA,EAAU,GAAA,CAAA;IAElC,IAAI;QACF,MAAMI,MAAAA,GAASC,MAAAA,CAAOC,KAAK,CAACL,SAAAA,CAAAA;QAC5B,MAAM,EAAEM,SAAS,EAAE,GAAG,MAAML,KAAKM,IAAI,CAACJ,MAAAA,EAAQ,CAAA,EAAGH,SAAAA,EAAW,CAAA,CAAA;QAE5D,OAAOG,MAAAA,CAAOK,QAAQ,CAAC,CAAA,EAAGF,SAAAA,CAAAA;IAC5B,CAAA,QAAU;AACR,QAAA,MAAML,KAAKQ,KAAK,EAAA;AAClB,IAAA;AACF;AAEO,eAAeC,eAAeT,IAAS,EAAA;IAC5C,IAAIE,MAAAA;;IAGJ,MAAMJ,QAAAA,GAAWE,IAAAA,CAAKU,QAAQ,IAAIV,IAAAA,CAAKW,IAAI,IAAIX,IAAAA,CAAKY,YAAY,IAAIZ,IAAAA,CAAKF,QAAQ;AAEjF,IAAA,IAAIA,QAAAA,EAAU;QACZ,IAAI;YACFI,MAAAA,GAAS,MAAML,cAAcC,QAAAA,EAAU,IAAA,CAAA;AACzC,QAAA,CAAA,CAAE,OAAOe,KAAAA,EAAO;YACd,MAAM,IAAIC,KAAAA,CACR,CAAC,qBAAqB,EAAED,KAAAA,YAAiBC,KAAAA,GAAQD,KAAAA,CAAME,OAAO,GAAGC,MAAAA,CAAOH,KAAAA,CAAAA,CAAAA,CAAQ,CAAA;AAEpF,QAAA;IACF,CAAA,MAAO,IAAIb,IAAAA,CAAKE,MAAM,EAAE;AACtBA,QAAAA,MAAAA,GAASF,IAAAA,CAAKE,MAAM,CAACe,MAAM,GAAG,IAAA,GAAOjB,IAAAA,CAAKE,MAAM,CAACK,QAAQ,CAAC,CAAA,EAAG,IAAA,CAAA,GAAQP,KAAKE,MAAM;IAClF,CAAA,MAAO;;QAEL,OAAOgB,SAAAA;AACT,IAAA;IAEA,IAAI;AACF;;;;AAIC,QACD,MAAM,EAAEC,kBAAkB,EAAE,GAAG,MAAM,OAAO,WAAA,CAAA;AAE5C,QAAA,MAAMC,MAAAA,GAAS,MAAMD,kBAAAA,CAAmB,IAAIE,UAAAA,CAAWnB,MAAAA,CAAAA,CAAAA;AACvD,QAAA,OAAOkB,MAAAA,EAAQE,IAAAA;AACjB,IAAA,CAAA,CAAE,OAAOT,KAAAA,EAAO;QACd,MAAM,IAAIC,KAAAA,CACR,CAAC,4BAA4B,EAAED,KAAAA,YAAiBC,KAAAA,GAAQD,KAAAA,CAAME,OAAO,GAAGC,MAAAA,CAAOH,KAAAA,CAAAA,CAAAA,CAAQ,CAAA;AAE3F,IAAA;AACF;AAEA,SAASU,kBAAAA,CAAmBC,QAAgB,EAAEC,QAAkB,EAAA;IAC9D,IAAI,CAACA,QAAAA,EAAUR,MAAAA,EAAQ,OAAO,KAAA;IAE9B,OAAOQ,QAAAA,CAASC,IAAI,CAAC,CAACC,OAAAA,GAAAA;QACpB,MAAMC,iBAAAA,GAAoBD,QAAQE,WAAW,EAAA;QAC7C,MAAMC,kBAAAA,GAAqBN,SAASK,WAAW,EAAA;QAE/C,IAAID,iBAAAA,CAAkBG,QAAQ,CAAC,GAAA,CAAA,EAAM;AACnC,YAAA,MAAMC,YAAAA,GAAeJ,iBAAAA,CAAkBK,OAAO,CAAC,KAAA,EAAO,IAAA,CAAA;YAEtD,MAAMC,KAAAA,GAAQ,IAAIC,MAAAA,CAAO,CAAC,CAAC,EAAEH,YAAAA,CAAa,CAAC,CAAC,CAAA;YAC5C,MAAMI,OAAAA,GAAUF,KAAAA,CAAMG,IAAI,CAACP,kBAAAA,CAAAA;YAC3B,OAAOM,OAAAA;AACT,QAAA;AAEA,QAAA,MAAME,aAAaV,iBAAAA,KAAsBE,kBAAAA;QACzC,OAAOQ,UAAAA;AACT,IAAA,CAAA,CAAA;AACF;AAkBA;;;IAIA,SAASC,qBAAAA,CACPC,QAAgB,EAChBC,QAAgB,EAChBC,YAAoB,EACpBC,YAAgC,EAChCC,MAAsB,EAAA;AAEtB,IAAA,IAAI,CAACJ,QAAAA,EAAU;QACb,OAAO;YACLK,OAAAA,EAAS,KAAA;YACThC,KAAAA,EAAO;gBACLiC,IAAAA,EAAM,uBAAA;gBACN/B,OAAAA,EAAS,0BAAA;gBACTgC,OAAAA,EAAS;AACPN,oBAAAA,QAAAA;oBACAO,MAAAA,EAAQ,0BAAA;AACRN,oBAAAA,YAAAA;AACAC,oBAAAA,YAAAA;AACAM,oBAAAA,YAAAA,EAAcL,OAAOK,YAAY;AACjCC,oBAAAA,WAAAA,EAAaN,OAAOM;AACtB;AACF;AACF,SAAA;AACF,IAAA;IACA,IAAIN,MAAAA,CAAOM,WAAW,EAAEjC,MAAAA,IAAUM,mBAAmBiB,QAAAA,EAAUI,MAAAA,CAAOM,WAAW,CAAA,EAAG;AAClF,QAAA,OAAOC,oBAAAA,CAAqBV,QAAAA,EAAUC,YAAAA,EAAcC,YAAAA,EAAcH,QAAAA,EAAUI,MAAAA,CAAAA;AAC9E,IAAA;AACA,IAAA,IAAI,CAACQ,KAAAA,CAAMC,OAAO,CAACT,MAAAA,CAAOK,YAAY,CAAA,EAAG;QACvC,OAAO;YAAEJ,OAAAA,EAAS,IAAA;YAAMS,YAAAA,EAAcd;AAAS,SAAA;AACjD,IAAA;AACA,IAAA,IAAII,MAAAA,CAAOK,YAAY,CAAChC,MAAM,KAAK,CAAA,EAAG;QACpC,OAAO;YACL4B,OAAAA,EAAS,KAAA;YACThC,KAAAA,EAAO;gBACLiC,IAAAA,EAAM,uBAAA;gBACN/B,OAAAA,EAAS,0BAAA;gBACTgC,OAAAA,EAAS;AACPN,oBAAAA,QAAAA;oBACAO,MAAAA,EAAQ,qBAAA;AACRN,oBAAAA,YAAAA;AACAC,oBAAAA,YAAAA;AACAM,oBAAAA,YAAAA,EAAcL,OAAOK,YAAY;AACjCC,oBAAAA,WAAAA,EAAaN,OAAOM;AACtB;AACF;AACF,SAAA;AACF,IAAA;AACA,IAAA,IAAI3B,kBAAAA,CAAmBiB,QAAAA,EAAUI,MAAAA,CAAOK,YAAY,CAAA,EAAG;QACrD,OAAO;YAAEJ,OAAAA,EAAS,IAAA;YAAMS,YAAAA,EAAcd;AAAS,SAAA;AACjD,IAAA;IACA,OAAO;QACLK,OAAAA,EAAS,KAAA;QACThC,KAAAA,EAAO;YACLiC,IAAAA,EAAM,uBAAA;AACN/B,YAAAA,OAAAA,EAAS,CAAC,WAAW,EAAEyB,QAAAA,CAAS,gBAAgB,CAAC;YACjDO,OAAAA,EAAS;AACPN,gBAAAA,QAAAA;AACAC,gBAAAA,YAAAA;AACAC,gBAAAA,YAAAA;gBACAY,SAAAA,EAAWf,QAAAA;AACXS,gBAAAA,YAAAA,EAAcL,OAAOK,YAAY;AACjCC,gBAAAA,WAAAA,EAAaN,OAAOM;AACtB;AACF;AACF,KAAA;AACF;AAEA,SAASM,kBAAkBC,gBAAwB,EAAA;IACjD,OAAO,CAACA,oBAAoBA,gBAAAA,KAAqB,0BAAA;AACnD;AAEO,SAASC,gBAAgB1D,IAAS,EAAA;AACvC,IAAA,MAAMyC,QAAAA,GACJzC,IAAAA,CAAK2D,gBAAgB,IACrB3D,KAAK4D,IAAI,IACT5D,IAAAA,CAAK6D,QAAQ,IACb7D,IAAAA,CAAK8D,WAAW,IAChB9D,IAAAA,CAAK+D,YAAY,IACjB,SAAA;AACF,IAAA,MAAMN,gBAAAA,GAAmBzD,IAAAA,CAAKwC,QAAQ,IAAIxC,IAAAA,CAAKgE,IAAI,IAAIhE,IAAAA,CAAKwB,QAAQ,IAAIxB,IAAAA,CAAKsB,IAAI,IAAI,EAAA;IAErF,OAAO;AAAEmB,QAAAA,QAAAA;AAAUgB,QAAAA;AAAiB,KAAA;AACtC;AAEO,eAAeQ,YAAAA,CACpBjE,IAAS,EACT4C,MAAsB,EACtBsB,MAAmB,EAAA;AAEnB,IAAA,MAAM,EAAEjB,YAAY,EAAEC,WAAW,EAAE,GAAGN,MAAAA;AAEtC,IAAA,MAAM,EAAEH,QAAQ,EAAEgB,gBAAgB,EAAE,GAAGC,eAAAA,CAAgB1D,IAAAA,CAAAA;IAEvD,MAAMmE,OAAAA,GAAUC,OAAAA,CAAQ3B,QAAAA,CAAAA,CAAUZ,WAAW,EAAA;AAC7C,IAAA,MAAMwC,mBAAAA,GAAsBF,OAAAA,GAAUG,MAAAA,CAAOH,OAAAA,CAAAA,IAAY,IAAA,GAAO,IAAA;;AAGhE,IAAA,IACE,CAACX,iBAAAA,CAAkBC,gBAAAA,CAAAA,IACnBP,aAAajC,MAAAA,IACbM,kBAAAA,CAAmBkC,kBAAkBP,WAAAA,CAAAA,EACrC;AACA,QAAA,OAAOC,oBAAAA,CAAqBV,QAAAA,EAAUgB,gBAAAA,EAAkBvC,SAAAA,EAAWuC,gBAAAA,EAAkBb,MAAAA,CAAAA;AACvF,IAAA;;AAGA,IAAA,IACEyB,mBAAAA,IACAnB,WAAAA,EAAajC,MAAAA,IACbM,kBAAAA,CAAmB8C,qBAAqBnB,WAAAA,CAAAA,EACxC;AACA,QAAA,OAAOC,oBAAAA,CAAqBV,QAAAA,EAAUgB,gBAAAA,EAAkBvC,SAAAA,EAAWmD,mBAAAA,EAAqBzB,MAAAA,CAAAA;AAC1F,IAAA;;IAGA,IAAIU,YAAAA;IACJ,IAAI;AACFA,QAAAA,YAAAA,GAAe,MAAM7C,cAAAA,CAAeT,IAAAA,CAAAA;AACtC,IAAA,CAAA,CAAE,OAAOa,KAAAA,EAAO;AACd,QAAA,MAAM0D,SAAS1D,KAAAA,YAAiBC,KAAAA,GAAQD,KAAAA,CAAME,OAAO,GAAGC,MAAAA,CAAOH,KAAAA,CAAAA;QAC/DqD,MAAAA,CAAOM,GAAG,CAACC,IAAI,CAAC,CAAC,sCAAsC,EAAEF,QAAQ,EAAE;AACjE9B,YAAAA,QAAAA;YACA5B,KAAAA,EAAO0D;AACT,SAAA,CAAA;AACF,IAAA;IAEA,MAAMG,wBAAAA,GACJ,CAAClB,iBAAAA,CAAkBC,gBAAAA,CAAAA,IACnBY,mBAAAA,KAAwB,QACxBA,mBAAAA,KAAwBnD,SAAAA,KACvBK,kBAAAA,CAAmBkC,gBAAAA,EAAkB;AAACY,QAAAA;AAAoB,KAAA,CAAA,IACzD9C,mBAAmB8C,mBAAAA,EAAqB;AAACZ,QAAAA;KAAiB,CAAA,CAAA;AAC9D,IAAA,MAAMkB,uBAAAA,GACJrB,YAAAA,IAAgBG,gBAAAA,IAAoBlC,kBAAAA,CAAmB+B,YAAAA,EAAc;AAACG,QAAAA;AAAiB,KAAA,CAAA;;AAGzF,IAAA,IAAIiB,4BAA4BC,uBAAAA,EAAyB;AACvD,QAAA,OAAOpC,qBAAAA,CACLkB,gBAAAA,EACAhB,QAAAA,EACAgB,gBAAAA,EACAH,YAAAA,EACAV,MAAAA,CAAAA;AAEJ,IAAA;;AAGA,IAAA,IAAIU,YAAAA,IAAgBJ,WAAAA,EAAajC,MAAAA,IAAUM,kBAAAA,CAAmB+B,cAAcJ,WAAAA,CAAAA,EAAc;AACxF,QAAA,OAAOC,oBAAAA,CAAqBV,QAAAA,EAAUgB,gBAAAA,EAAkBH,YAAAA,EAAcA,YAAAA,EAAcV,MAAAA,CAAAA;AACtF,IAAA;;;AAIA,IAAA,MAAMgC,mBAAAA,GACJtB,YAAAA,KAAiB,iBAAA,IACjBe,mBAAAA,IACAA,wBAAwB,iBAAA,IACxBjB,KAAAA,CAAMC,OAAO,CAACJ,iBACdA,YAAAA,CAAahC,MAAM,GAAG,CAAA,IACtBM,mBAAmB8C,mBAAAA,EAAqBpB,YAAAA,CAAAA;;AAE1C,IAAA,MAAM4B,yBACJvB,YAAAA,KAAiB,iBAAA,IACjBa,OAAAA,KAAY,MAAA,IACZE,wBAAwB,eAAA,IACxBjB,KAAAA,CAAMC,OAAO,CAACJ,iBACdA,YAAAA,CAAahC,MAAM,GAAG,CAAA,IACtBM,mBAAmB8C,mBAAAA,EAAqBpB,YAAAA,CAAAA;AAC1C,IAAA,IACEK,gBACAF,KAAAA,CAAMC,OAAO,CAACJ,YAAAA,CAAAA,IACdA,aAAahC,MAAM,GAAG,CAAA,IACtB,CAACM,mBAAmB+B,YAAAA,EAAcL,YAAAA,CAAAA,IAClC,CAAC2B,mBAAAA,IACD,CAACC,sBAAAA,EACD;QACA,OAAO;YACLhC,OAAAA,EAAS,KAAA;YACThC,KAAAA,EAAO;gBACLiC,IAAAA,EAAM,uBAAA;gBACN/B,OAAAA,EAAS,0BAAA;gBACTgC,OAAAA,EAAS;AACPN,oBAAAA,QAAAA;oBACAO,MAAAA,EACE,uGAAA;oBACFN,YAAAA,EAAce,gBAAAA;oBACdd,YAAAA,EAAcW,YAAAA;oBACdwB,yBAAAA,EAA2BT,mBAAAA;AAC3BpB,oBAAAA,YAAAA;AACAC,oBAAAA;AACF;AACF;AACF,SAAA;AACF,IAAA;;AAGA,IAAA,MAAM6B,2BACJzB,YAAAA,IACAe,mBAAAA,KAAwB,QACxBA,mBAAAA,KAAwBnD,SAAAA,IACxBK,mBAAmB+B,YAAAA,EAAc;AAACe,QAAAA;AAAoB,KAAA,CAAA;AACxD,IAAA,IACEf,iBACC,CAACe,uBAAuBU,wBAAAA,IAA4BvB,iBAAAA,CAAkBC,iBAAgB,CAAA,EACvF;;AAEA,QAAA,IACEH,YAAAA,KAAiB,iBAAA,IACjBe,mBAAAA,IACAA,mBAAAA,KAAwB,iBAAA,EACxB;AACA,YAAA,MAAMW,SAAAA,GAAYzC,qBAAAA,CAChB8B,mBAAAA,EACA5B,QAAAA,EACAgB,kBACAH,YAAAA,EACAV,MAAAA,CAAAA;YAEF,IAAIoC,SAAAA,CAAUnC,OAAO,EAAE;AACrBqB,gBAAAA,MAAAA,CAAOM,GAAG,CAACC,IAAI,CACb,iFAAA,EACA;AAAEhC,oBAAAA,QAAAA;oBAAUwC,aAAAA,EAAed,OAAAA;oBAASW,yBAAAA,EAA2BT;AAAoB,iBAAA,CAAA;gBAErF,OAAOW,SAAAA;AACT,YAAA;AACF,QAAA;AACA,QAAA,OAAOzC,qBAAAA,CAAsBe,YAAAA,EAAcb,QAAAA,EAAUgB,gBAAAA,EAAkBH,YAAAA,EAAcV,MAAAA,CAAAA;AACvF,IAAA;;AAGA,IAAA,IAAIyB,mBAAAA,EAAqB;AACvB,QAAA,OAAO9B,qBAAAA,CACL8B,mBAAAA,EACA5B,QAAAA,EACAgB,gBAAAA,EACAH,YAAAA,EACAV,MAAAA,CAAAA;AAEJ,IAAA;;AAGA,IAAA,IAAIa,gBAAAA,EAAkB;AACpB,QAAA,OAAOlB,qBAAAA,CACLkB,gBAAAA,EACAhB,QAAAA,EACAgB,gBAAAA,EACAH,YAAAA,EACAV,MAAAA,CAAAA;AAEJ,IAAA;;IAGA,OAAO;QACLC,OAAAA,EAAS,KAAA;QACThC,KAAAA,EAAO;YACLiC,IAAAA,EAAM,uBAAA;YACN/B,OAAAA,EAAS,8CAAA;YACTgC,OAAAA,EAAS;AACPN,gBAAAA,QAAAA;gBACAO,MAAAA,EAAQ,yEAAA;gBACRN,YAAAA,EAAce,gBAAAA;gBACdd,YAAAA,EAAcW,YAAAA;AACdL,gBAAAA,YAAAA;AACAC,gBAAAA;AACF;AACF;AACF,KAAA;AACF;AAEA,SAASC,oBAAAA,CACPV,QAAgB,EAChBC,YAAoB,EACpBC,YAAgC,EAChCuC,YAAoB,EACpBtC,MAAsB,EAAA;IAEtB,OAAO;QACLC,OAAAA,EAAS,KAAA;QACThC,KAAAA,EAAO;YACLiC,IAAAA,EAAM,uBAAA;AACN/B,YAAAA,OAAAA,EAAS,CAAC,WAAW,EAAEmE,YAAAA,CAAa,gBAAgB,CAAC;YACrDnC,OAAAA,EAAS;AACPN,gBAAAA,QAAAA;AACAC,gBAAAA,YAAAA;AACAC,gBAAAA,YAAAA;gBACAY,SAAAA,EAAW2B,YAAAA;AACXjC,gBAAAA,YAAAA,EAAcL,OAAOK,YAAY;AACjCC,gBAAAA,WAAAA,EAAaN,OAAOM,WAAW;gBAC/BF,MAAAA,EAAQ;AACV;AACF;AACF,KAAA;AACF;AAEO,eAAemC,aAAAA,CAAcC,KAAU,EAAElB,MAAmB,EAAA;AACjE,IAAA,MAAMmB,UAAAA,GAAajC,KAAAA,CAAMC,OAAO,CAAC+B,SAASA,KAAAA,GAAQ;AAACA,QAAAA;AAAM,KAAA;IAEzD,IAAI,CAACC,UAAAA,CAAWpE,MAAM,EAAE;AACtB,QAAA,OAAO,EAAE;AACX,IAAA;;AAGA,IAAA,IAAI2B,MAAAA,GAAyBsB,MAAAA,CAAOtB,MAAM,CAAC0C,GAAG,CAC5C;AAAC,QAAA,gBAAA;AAAkB,QAAA;AAAW,KAAA,EAC9B,EAAC,CAAA;AAEH,IAAA,IAAI,CAAC1C,MAAAA,IAAU,OAAOA,MAAAA,KAAW,QAAA,EAAU;AACzCA,QAAAA,MAAAA,GAAS,EAAC;AACZ,IAAA;IACA,IACEA,MAAAA,CAAOK,YAAY,KAClB,CAACG,KAAAA,CAAMC,OAAO,CAACT,MAAAA,CAAOK,YAAY,CAAA,IACjC,CAACL,MAAAA,CAAOK,YAAY,CAACsC,KAAK,CAAC,CAACC,IAAAA,GAAS,OAAOA,IAAAA,KAAS,QAAA,CAAQ,CAAA,EAC/D;QACA,MAAM,IAAIC,MAAAA,CAAOC,gBAAgB,CAC/B,kEAAA,CAAA;AAEJ,IAAA;IAEA,IACE9C,MAAAA,CAAOM,WAAW,KACjB,CAACE,KAAAA,CAAMC,OAAO,CAACT,MAAAA,CAAOM,WAAW,CAAA,IAChC,CAACN,MAAAA,CAAOM,WAAW,CAACqC,KAAK,CAAC,CAACC,IAAAA,GAAS,OAAOA,IAAAA,KAAS,QAAA,CAAQ,CAAA,EAC9D;QACA,MAAM,IAAIC,MAAAA,CAAOC,gBAAgB,CAC/B,iEAAA,CAAA;AAEJ,IAAA;AAEA,IAAA,IAAI,CAAC9C,MAAAA,CAAOK,YAAY,IAAI,CAACL,MAAAA,CAAOM,WAAW,EAAE;QAC/CgB,MAAAA,CAAOM,GAAG,CAACC,IAAI,CACb,mHAAA,CAAA;;AAGJ,IAAA;AAEA,IAAA,MAAMkB,kBAAAA,GAAqBN,UAAAA,CAAWO,GAAG,CAAC,OAAO5F,IAAAA,EAAM6F,KAAAA,GAAAA;QACrD,IAAI;YACF,OAAO,MAAM5B,YAAAA,CAAajE,IAAAA,EAAM4C,MAAAA,EAAQsB,MAAAA,CAAAA;AAC1C,QAAA,CAAA,CAAE,OAAOrD,KAAAA,EAAO;AACdqD,YAAAA,MAAAA,CAAOM,GAAG,CAAC3D,KAAK,CAAC,yCAAA,EAA2C;gBAC1DiF,SAAAA,EAAWD,KAAAA;gBACXpD,QAAAA,EAAUzC,IAAAA,EAAM4D,QAAQ5D,IAAAA,EAAM+D,YAAAA;AAC9BlD,gBAAAA,KAAAA,EAAOA,KAAAA,YAAiBC,KAAAA,GAAQD,KAAAA,CAAME,OAAO,GAAGC,MAAAA,CAAOH,KAAAA;AACzD,aAAA,CAAA;YAEA,OAAO;gBACLgC,OAAAA,EAAS,KAAA;gBACThC,KAAAA,EAAO;oBACLiC,IAAAA,EAAM,kBAAA;oBACN/B,OAAAA,EAAS,CAAC,oCAAoC,EAAE8E,KAAAA,CAAAA,CAAO;oBACvD9C,OAAAA,EAAS;AACP8C,wBAAAA,KAAAA;wBACApD,QAAAA,EAAUzC,IAAAA,EAAM4D,QAAQ5D,IAAAA,EAAM+D,YAAAA;AAC9BgC,wBAAAA,aAAAA,EAAelF,KAAAA,YAAiBC,KAAAA,GAAQD,KAAAA,CAAME,OAAO,GAAGC,MAAAA,CAAOH,KAAAA;AACjE;AACF;AACF,aAAA;AACF,QAAA;AACF,IAAA,CAAA,CAAA;IAEA,OAAOmF,OAAAA,CAAQC,GAAG,CAACN,kBAAAA,CAAAA;AACrB;AAEO,eAAeO,qBAAAA,CACpBd,KAAU,EACVlB,MAAmB,EAAA;IAMnB,MAAMiC,iBAAAA,GAAoB,MAAMhB,aAAAA,CAAcC,KAAAA,EAAOlB,MAAAA,CAAAA;AACrD,IAAA,MAAMmB,UAAAA,GAAajC,KAAAA,CAAMC,OAAO,CAAC+B,SAASA,KAAAA,GAAQ;AAACA,QAAAA;AAAM,KAAA;AAEzD,IAAA,MAAMgB,aAAoB,EAAE;AAC5B,IAAA,MAAMC,iBAA2B,EAAE;AACnC,IAAA,MAAMZ,SAA6B,EAAE;AAErC,IAAA,KAAK,MAAM,CAACI,KAAAA,EAAOzE,OAAO,IAAI+E,iBAAAA,CAAkBG,OAAO,EAAA,CAAI;QACzD,IAAIlF,MAAAA,CAAOyB,OAAO,EAAE;YAClB,MAAM7C,IAAAA,GAAOqF,UAAU,CAACQ,KAAAA,CAAM;;YAE9B,IAAIzE,MAAAA,CAAOkC,YAAY,EAAE;gBACvBtD,IAAAA,CAAKuG,gBAAgB,GAAGnF,MAAAA,CAAOkC,YAAY;AAC7C,YAAA;AACA8C,YAAAA,UAAAA,CAAWI,IAAI,CAACxG,IAAAA,CAAAA;AAChBqG,YAAAA,cAAAA,CAAeG,IAAI,CAACxG,IAAAA,CAAK2D,gBAAgB,IAAI3D,KAAK4D,IAAI,CAAA;QACxD,CAAA,MAAO,IAAIxC,MAAAA,CAAOP,KAAK,EAAE;AACvB4E,YAAAA,MAAAA,CAAOe,IAAI,CAAC;gBACVxG,IAAAA,EAAMqF,UAAU,CAACQ,KAAAA,CAAM;gBACvBY,aAAAA,EAAeZ,KAAAA;AACfhF,gBAAAA,KAAAA,EAAOO,OAAOP;AAChB,aAAA,CAAA;QACF,CAAA,MAAO;;AAEL4E,YAAAA,MAAAA,CAAOe,IAAI,CAAC;gBACVxG,IAAAA,EAAMqF,UAAU,CAACQ,KAAAA,CAAM;gBACvBY,aAAAA,EAAeZ,KAAAA;gBACfhF,KAAAA,EAAO;oBACLiC,IAAAA,EAAM,eAAA;oBACN/B,OAAAA,EAAS,2CAAA;oBACTgC,OAAAA,EAAS;AACP8C,wBAAAA,KAAAA;wBACApD,QAAAA,EAAU4C,UAAU,CAACQ,KAAAA,CAAM,EAAEjC,QAAQyB,UAAU,CAACQ,MAAM,EAAE9B;AAC1D;AACF;AACF,aAAA,CAAA;AACF,QAAA;AACF,IAAA;IAEA,OAAO;AAAEqC,QAAAA,UAAAA;AAAYC,QAAAA,cAAAA;AAAgBZ,QAAAA;AAAO,KAAA;AAC9C;AAaA;;AAEC,IACM,eAAeiB,oBAAAA,CACpBC,UAAe,EACfC,IAAS,EACT1C,MAAmB,EAAA;IAEnB,MAAM2C,eAAAA,GAAkB,MAAMX,qBAAAA,CAAsBS,UAAAA,EAAYzC,MAAAA,CAAAA;AAEhE,IAAA,IAAI4C,YAAAA,GAAeF,IAAAA;AACnB,IAAA,IAAIA,MAAMG,QAAAA,EAAU;;QAElB,IAAIC,cAAAA,GAAiBJ,KAAKG,QAAQ;AAClC,QAAA,IAAI3D,KAAAA,CAAMC,OAAO,CAACuD,IAAAA,CAAKG,QAAQ,CAAA,EAAG;AAChCC,YAAAA,cAAAA,GAAiBJ,IAAAA,CAAKG,QAAQ,CAACnB,GAAG,CAAC,CAACqB,EAAAA,GAClC,OAAOA,EAAAA,KAAO,QAAA,GAAWC,IAAAA,CAAKC,KAAK,CAACF,EAAAA,CAAAA,GAAMA,EAAAA,CAAAA;AAE9C,QAAA,CAAA,MAAO,IAAI,OAAOL,IAAAA,CAAKG,QAAQ,KAAK,QAAA,EAAU;AAC5CC,YAAAA,cAAAA,GAAiBE,IAAAA,CAAKC,KAAK,CAACP,IAAAA,CAAKG,QAAQ,CAAA;AAC3C,QAAA;;QAGA,IAAI3D,KAAAA,CAAMC,OAAO,CAAC2D,cAAAA,CAAAA,EAAiB;YACjC,MAAMI,cAAAA,GAAiB,IAAIC,GAAAA,CAAIR,eAAAA,CAAgBpB,MAAM,CAACG,GAAG,CAAC,CAAC0B,CAAAA,GAAMA,CAAAA,CAAEb,aAAa,CAAA,CAAA;YAChF,MAAMc,gBAAAA,GAAmBP,cAAAA,CAAeQ,MAAM,CAC5C,CAACC,GAAQ5B,KAAAA,GAAkB,CAACuB,cAAAA,CAAeM,GAAG,CAAC7B,KAAAA,CAAAA,CAAAA;YAGjD,IAAI0B,gBAAAA,CAAiBtG,MAAM,KAAK,CAAA,EAAG;gBACjC6F,YAAAA,GAAe;AACb,oBAAA,GAAGF,IAAI;oBACPG,QAAAA,EAAUQ,gBAAgB,CAAC,CAAA;AAC7B,iBAAA;YACF,CAAA,MAAO;gBACLT,YAAAA,GAAe;AACb,oBAAA,GAAGF,IAAI;oBACPG,QAAAA,EAAUQ;AACZ,iBAAA;AACF,YAAA;QACF,CAAA,MAAO;YACLT,YAAAA,GAAe;AACb,gBAAA,GAAGF,IAAI;gBACPG,QAAAA,EAAUC;AACZ,aAAA;AACF,QAAA;AACF,IAAA;;IAGA,MAAMW,YAAAA,GAAkCd,gBAAgBpB,MAAM,CAACG,GAAG,CAAC,CAAC0B,KAAO;AACzE1D,YAAAA,IAAAA,EAAM0D,EAAEtH,IAAI,EAAE2D,oBAAoB2D,CAAAA,CAAEtH,IAAI,EAAE4D,IAAAA,IAAQ,SAAA;YAClD7C,OAAAA,EAASuG,CAAAA,CAAEzG,KAAK,CAACE;SACnB,CAAA,CAAA;IAEA,OAAO;AACLqF,QAAAA,UAAAA,EAAYS,gBAAgBT,UAAU;AACtCU,QAAAA,YAAAA;QACArB,MAAAA,EAAQkC;AACV,KAAA;AACF;;;;"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@strapi/upload",
-  "version": "5.49.0",
+  "version": "5.50.0",
   "description": "Makes it easy to upload images and files to your Strapi Application.",
   "homepage": "https://strapi.io",
   "bugs": {
@@ -73,11 +73,11 @@
     "@radix-ui/react-dialog": "1.0.5",
     "@radix-ui/react-toggle-group": "1.1.11",
     "@reduxjs/toolkit": "1.9.7",
-    "@strapi/database": "5.49.0",
-    "@strapi/design-system": "2.2.0",
-    "@strapi/icons": "2.2.0",
-    "@strapi/provider-upload-local": "5.49.0",
-    "@strapi/utils": "5.49.0",
+    "@strapi/database": "5.50.0",
+    "@strapi/design-system": "2.2.1",
+    "@strapi/icons": "2.2.1",
+    "@strapi/provider-upload-local": "5.50.0",
+    "@strapi/utils": "5.50.0",
     "byte-size": "8.1.1",
     "cropperjs": "1.6.1",
     "date-fns": "2.30.0",
@@ -101,14 +101,14 @@
     "zod": "3.25.67"
   },
   "devDependencies": {
-    "@strapi/admin": "5.49.0",
-    "@strapi/types": "5.49.0",
+    "@strapi/admin": "5.50.0",
+    "@strapi/types": "5.50.0",
     "@testing-library/dom": "10.4.1",
     "@testing-library/react": "16.3.2",
     "@testing-library/user-event": "14.6.1",
     "@types/byte-size": "8.1.2",
     "@types/fs-extra": "11.0.4",
-    "@types/koa": "2.13.4",
+    "@types/koa": "2.15.2",
     "@types/koa-range": "0.3.5",
     "@types/koa-static": "4.0.2",
     "formidable": "3.5.4",

package/dist/admin/future/enums.js

@@ -1,12 +0,0 @@
-'use strict';
-
-var AssetType = /*#__PURE__*/ function(AssetType) {
-    AssetType["Video"] = "video";
-    AssetType["Image"] = "image";
-    AssetType["Document"] = "doc";
-    AssetType["Audio"] = "audio";
-    return AssetType;
-}({});
-
-exports.AssetType = AssetType;
-//# sourceMappingURL=enums.js.map

package/dist/admin/future/enums.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"enums.js","sources":["../../../admin/src/future/enums.ts"],"sourcesContent":["export enum AssetType {\n  Video = 'video',\n  Image = 'image',\n  Document = 'doc',\n  Audio = 'audio',\n}\n"],"names":["AssetType"],"mappings":";;AAAO,IAAA,SAAKA,iBAAAA,SAAAA,SAAAA,EAAAA;;;;;AAAAA,IAAAA,OAAAA,SAAAA;AAKX,CAAA,CAAA,EAAA;;;;"}

package/dist/admin/future/enums.mjs

@@ -1,10 +0,0 @@
-var AssetType = /*#__PURE__*/ function(AssetType) {
-    AssetType["Video"] = "video";
-    AssetType["Image"] = "image";
-    AssetType["Document"] = "doc";
-    AssetType["Audio"] = "audio";
-    return AssetType;
-}({});
-
-export { AssetType };
-//# sourceMappingURL=enums.mjs.map

package/dist/admin/future/enums.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"enums.mjs","sources":["../../../admin/src/future/enums.ts"],"sourcesContent":["export enum AssetType {\n  Video = 'video',\n  Image = 'image',\n  Document = 'doc',\n  Audio = 'audio',\n}\n"],"names":["AssetType"],"mappings":"AAAO,IAAA,SAAKA,iBAAAA,SAAAA,SAAAA,EAAAA;;;;;AAAAA,IAAAA,OAAAA,SAAAA;AAKX,CAAA,CAAA,EAAA;;;;"}

package/dist/admin/src/future/enums.d.ts

@@ -1,6 +0,0 @@
-export declare enum AssetType {
-    Video = "video",
-    Image = "image",
-    Document = "doc",
-    Audio = "audio"
-}