graphile-settings 6.14.0 → 6.15.1

package/esm/upload-resolver.js

@@ -29,6 +29,7 @@ import Streamer from '@constructive-io/s3-streamer';
 import { Logger } from '@pgpmjs/logger';
 import { createHash, randomUUID } from 'crypto';
 import { finalizeStagedUpload, resolveManagedUploadTarget, withRequestPgClient, } from 'graphile-presigned-url-plugin';
+import { checkTypeAgreement } from 'mime-bytes';
 import { Transform } from 'stream';
 import { createBucketNameResolver, createEnsureBucketProvisioned, getPresignedUrlS3Config, } from './presigned-url-resolver';
 const log = new Logger('upload-resolver');
@@ -178,6 +179,21 @@ async function uploadResolver(upload, _args, context, info) {
         readStream: upload.createReadStream(),
         filename,
     });
+    // The three claims must agree, and disagreement is rejection rather than
+    // relabelling: an `.jpg` carrying HTML is served to a browser as an image and
+    // executed as a script. Compared against `magic.type` — what the bytes say —
+    // not `contentType`, which the detector may have refined using the very
+    // extension under suspicion.
+    const agreement = checkTypeAgreement({
+        filename,
+        declaredMime: upload.mimetype,
+        detectedMime: detected.magic?.type,
+    });
+    if (!agreement.ok) {
+        detected.stream.destroy();
+        throw new Error(`UPLOAD_TYPE_MISMATCH: ${agreement.violation.message}. The upload was rejected rather than ` +
+            'stored under a type it is not.');
+    }
     const allowed = allowedMimeTypes(tags, typ);
     if (allowed.length && !allowed.includes(detected.contentType)) {
         detected.stream.destroy();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "graphile-settings",
-  "version": "6.14.0",
+  "version": "6.15.1",
   "author": "Constructive <developers@constructive.io>",
   "description": "graphile settings",
   "main": "index.js",
@@ -31,46 +31,47 @@
   "dependencies": {
     "@aws-sdk/client-s3": "^3.1052.0",
     "@constructive-io/bucket-provisioner": "^0.24.0",
-    "@constructive-io/graphql-env": "^3.29.3",
-    "@constructive-io/graphql-types": "^3.28.3",
-    "@constructive-io/s3-streamer": "^2.40.0",
+    "@constructive-io/graphql-env": "^3.29.4",
+    "@constructive-io/graphql-types": "^3.28.4",
+    "@constructive-io/s3-streamer": "^2.40.2",
     "@constructive-io/s3-utils": "^2.30.0",
     "@constructive-io/upload-names": "^2.29.0",
     "@dataplan/json": "1.0.1",
     "@dataplan/pg": "1.1.1",
     "@graphile-contrib/pg-many-to-many": "2.0.0-rc.2",
     "@pgpmjs/logger": "^2.24.1",
-    "@pgpmjs/types": "^2.50.3",
+    "@pgpmjs/types": "^2.50.4",
     "@pgsql/quotes": "^18.2.4",
     "cors": "^2.8.6",
     "express": "^5.2.1",
-    "grafast": "1.1.1",
+    "grafast": "1.1.2",
     "grafserv": "1.0.1",
     "graphile-bucket-provisioner-plugin": "1.12.4",
     "graphile-build": "5.1.1",
     "graphile-build-pg": "5.1.3",
-    "graphile-bulk-mutations": "^1.11.7",
+    "graphile-bulk-mutations": "^1.11.9",
     "graphile-config": "1.1.0",
-    "graphile-connection-filter": "^2.11.7",
-    "graphile-history": "^1.3.7",
-    "graphile-i18n": "^2.11.7",
-    "graphile-llm": "^1.11.7",
-    "graphile-ltree": "^2.11.7",
+    "graphile-connection-filter": "^2.11.9",
+    "graphile-history": "^1.3.9",
+    "graphile-i18n": "^2.11.9",
+    "graphile-llm": "^1.11.9",
+    "graphile-ltree": "^2.11.9",
     "graphile-meta": "^1.7.1",
-    "graphile-pg-aggregates": "^2.11.7",
-    "graphile-postgis": "^3.11.7",
-    "graphile-presigned-url-plugin": "^1.12.0",
+    "graphile-pg-aggregates": "^2.11.9",
+    "graphile-postgis": "^3.11.9",
+    "graphile-presigned-url-plugin": "^1.13.0",
     "graphile-realtime-subscriptions": "^1.10.5",
-    "graphile-search": "^2.11.7",
+    "graphile-search": "^2.11.9",
     "graphile-upload-plugin": "^2.25.0",
     "graphile-utils": "5.0.3",
     "graphql": "16.13.0",
     "inflekt": "^0.8.1",
     "lru-cache": "^11.2.7",
+    "mime-bytes": "^0.31.0",
     "pg": "^8.21.0",
     "pg-query-context": "^2.29.1",
     "pg-sql2": "5.0.1",
-    "postgraphile": "5.1.3",
+    "postgraphile": "5.1.4",
     "request-ip": "^3.3.0",
     "tamedevil": "0.1.1"
   },
@@ -79,7 +80,7 @@
     "@types/express": "^5.0.6",
     "@types/pg": "^8.20.4",
     "@types/request-ip": "^0.0.41",
-    "graphile-test": "^5.11.7",
+    "graphile-test": "^5.11.9",
     "makage": "^0.3.0",
     "nodemon": "^3.1.14",
     "ts-node": "^10.9.2"
@@ -91,5 +92,5 @@
     "constructive",
     "graphql"
   ],
-  "gitHead": "44f56ee80a348f649a22e5bd32b35f2822726509"
+  "gitHead": "eacbe10ce544848c93a4c17fc8a8474d1a788a18"
 }

package/upload-resolver.js

@@ -35,6 +35,7 @@ const s3_streamer_1 = __importDefault(require("@constructive-io/s3-streamer"));
 const logger_1 = require("@pgpmjs/logger");
 const crypto_1 = require("crypto");
 const graphile_presigned_url_plugin_1 = require("graphile-presigned-url-plugin");
+const mime_bytes_1 = require("mime-bytes");
 const stream_1 = require("stream");
 const presigned_url_resolver_1 = require("./presigned-url-resolver");
 const log = new logger_1.Logger('upload-resolver');
@@ -184,6 +185,21 @@ async function uploadResolver(upload, _args, context, info) {
         readStream: upload.createReadStream(),
         filename,
     });
+    // The three claims must agree, and disagreement is rejection rather than
+    // relabelling: an `.jpg` carrying HTML is served to a browser as an image and
+    // executed as a script. Compared against `magic.type` — what the bytes say —
+    // not `contentType`, which the detector may have refined using the very
+    // extension under suspicion.
+    const agreement = (0, mime_bytes_1.checkTypeAgreement)({
+        filename,
+        declaredMime: upload.mimetype,
+        detectedMime: detected.magic?.type,
+    });
+    if (!agreement.ok) {
+        detected.stream.destroy();
+        throw new Error(`UPLOAD_TYPE_MISMATCH: ${agreement.violation.message}. The upload was rejected rather than ` +
+            'stored under a type it is not.');
+    }
     const allowed = allowedMimeTypes(tags, typ);
     if (allowed.length && !allowed.includes(detected.contentType)) {
         detected.stream.destroy();