Repository navigation
Fix file upload security: bind authenticated user, add MIME type filter, fix CI artifact paths - #297
Merged
memplethee-lab merged 4 commits intoOct 12, 2026
Conversation
…ct paths Three security and CI fixes: Issue SourceXXL#156 - Replace hardcoded userId=system with authenticated user identity - FileUploadController: use @currentuser() decorator to extract user.id - WebhookController: same pattern for all 8 endpoints - Both controllers now throw BadRequestException if user identity missing Issue SourceXXL#157 - Add fileFilter allowlist to multer interceptor - Added FILE_ALLOWED_MIME_TYPES env var with comprehensive default - fileFilter rejects disallowed MIME types with 400 before storage - Configurable via environment without code changes Issue SourceXXL#158 - Fix CI artifact upload paths - Changed TypeScript client path from client/ to sdks/typescript - Added Python client artifact upload step for sdks/python - All three artifacts now upload correctly Closes SourceXXL#156 Closes SourceXXL#157 Closes SourceXXL#158
- Import ConfigService from @nestjs/config instead of @nestjs/common - Add null guard for file object in fileFilter callback - Reorder parameters so required @currentuser comes before optional query params
TypeScript control flow cannot narrow file to non-null across cb() call boundaries. The guard clause already ensures file is non-null, so the assertion is safe.
TypeScript could not narrow file to non-null across cb() boundaries. Extracting to a local const f ensures proper control flow narrowing.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Three security and CI fixes for the file upload system and build pipeline.
#156 — Bind authenticated user instead of hardcoded
userId = systemProblem: Every handler in
FileUploadControllerandWebhookControllerhardcodedconst userId = "system", so all authenticated users shared the same storage namespace. Any user could list, overwrite, or delete any other user's files and webhook subscriptions.Fix: Both controllers now use the existing
@CurrentUser()decorator (fromsrc/core/auth/decorators) to extract the authenticated user ID from the request, mirroring the pattern already used inPortfolioController. ABadRequestExceptionis thrown if the user identity is missing.#157 — Add a
fileFilterallowlist to the multer interceptorProblem:
POST /files/uploadaccepted any MIME type up to 50 MB — executables, HTML, SVG, shell scripts — creating a stored XSS and malware distribution vector.Fix: Added a
fileFilterto theFileInterceptoroptions backed by a newFILE_ALLOWED_MIME_TYPESenvironment variable. The default allowlist covers images, documents, video, audio, and archives (mirroringFileValidationService). Disallowed types are rejected with400 Unsupported file type: <mime>before the file reaches storage.#158 — Fix CI artifact upload paths
Problem: The
openapijob generated SDKs intosdks/typescriptandsdks/python, but the artifact upload step pointed atclient/— a directory the workflow never created. The Python client was never uploaded at all.Fix: Changed the TypeScript client upload path from
client/tosdks/typescriptand added a new step to upload the Python client fromsdks/python. A push tomainnow produces three non-empty artifacts:openapi-spec,typescript-client, andpython-client.Testing
@CurrentUser()pattern is reused from the existing codebase — no new abstractionsNotes
FILE_ALLOWED_MIME_TYPESdefault matches theFileValidationServiceallowlist exactly, so the multer filter and the post-upload validation are consistentfileSizelimit remains unchanged at 50 MBif: github.event_name == 'push'guard is preserved)Closes #156
Closes #157
Closes #158