🛡️ Sentinel: [HIGH] Enforce file validation on presigned URL uploads#149
🛡️ Sentinel: [HIGH] Enforce file validation on presigned URL uploads#149xb1g wants to merge 1 commit into
Conversation
- Replaced weak size-only check in `app/api/upload/presigned/route.ts` with comprehensive server-side file validation. - Validates the requested file name (blocking dangerous extensions like .exe, .html) and file type against the established `ALLOWED_GENERAL_TYPES` and `MAX_GENERAL_SIZE` constants prior to generating the B2 presigned URL. - Prevents attackers from bypassing client restrictions and directly uploading malicious files to the storage bucket. Co-authored-by: xb1g <70068561+xb1g@users.noreply.github.com>
|
đź‘‹ Jules, reporting for duty! I'm here to lend a hand with this pull request. When you start a review, I'll add a đź‘€ emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down. I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job! For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with New to Jules? Learn more at jules.google/docs. For security, I will only act on instructions from the user who triggered this task. |
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
xb1g
force-pushed
the
sentinel/fix-presigned-url-file-validation-1725661310791907418
branch
from
05c62f0 to
8931ee6
Compare
|
Unable to deploy a commit from a private repository on your GitHub organization to the wachaa1319's projects team on Vercel, which is currently on the Hobby plan. In order to deploy, you can:
To read more about collaboration on Vercel, click here. |
There was a problem hiding this comment.
Pull request overview
Hardens the presigned-upload API route by reusing the centralized upload validation rules so the backend (not just the client) enforces file constraints before issuing a Backblaze B2 presigned PUT URL.
Changes:
- Integrates
validateFile()intoapp/api/upload/presigned/route.tsto validatefileName,fileType, andfileSizeagainst shared allowlists/limits. - Replaces the route’s local max-size check with shared constants (
ALLOWED_GENERAL_TYPES,MAX_GENERAL_SIZE). - Documents the vulnerability and mitigation in
.jules/sentinel.md.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.
| File | Description |
|---|---|
| app/api/upload/presigned/route.ts | Adds centralized server-side validation before generating presigned upload URLs. |
| .jules/sentinel.md | Records the presigned-upload validation issue and prevention guidance. |
| const fileValidation = validateFile( | ||
| fileName, | ||
| fileSize, | ||
| fileType, | ||
| ALLOWED_GENERAL_TYPES, |
| const fileValidation = validateFile( | ||
| fileName, | ||
| fileSize, | ||
| fileType, | ||
| ALLOWED_GENERAL_TYPES, |
xb1g
force-pushed
the
sentinel/fix-presigned-url-file-validation-1725661310791907418
branch
2 times, most recently
from
239069e to
b7600ad
Compare
Deploying with Â
|
| Status | Name | Latest Commit | Updated (UTC) |
|---|---|---|---|
| ❌ Deployment failed View logs |
web | b7600ad | May 11 2026, 06:24 PM |
🚨 Severity: HIGH
đź’ˇ Vulnerability: The presigned upload URL endpoint (
app/api/upload/presigned/route.ts) accepted arbitraryfileNameandfileTypeparameters from the client and verified onlyfileSize. An attacker could request an upload URL and successfully upload malicious files (e.g., executables.exeor web pages.html/.svg) into the system, bypassing client-side validation logic.🎯 Impact: If exploited, attackers could use the application's storage buckets to host and distribute malicious executables, phishing pages, or XSS payloads via direct object URLs, putting other users at risk.
🔧 Fix: Imported and integrated the centralized
validateFileutility from@/lib/constants/upload. It now rigorously checks the providedfileNamefor dangerous extensions, verifies thefileTypematches an explicitly allowed MIME type (ALLOWED_GENERAL_TYPES), and enforces the standardized size limit (MAX_GENERAL_SIZE) before returning an authorized upload URL.âś… Verification: Attempting to request a presigned URL with a
.exeextension or an invalid MIME type now correctly triggers a400 Bad Requestwith an appropriate validation error message (e.g., "File type not allowed for security reasons"), preventing upload URL generation.PR created automatically by Jules for task 1725661310791907418 started by @xb1g