Default fileExtension regex does not match plain files. #8698

Activity

1. parse-github-assistant commented on Jul 23, 2023

   

   parse-github-assistantbot

   on Jul 23, 2023

   More actions

   Thanks for opening this issue!

   • ❌ Please fill out all fields with a placeholder FILL_THIS_OUT, otherwise your issue will be closed. If a field does not apply to the issue, fill in n/a.
2. dblythy commented on Jul 23, 2023

   

   dblythy

   on Jul 23, 2023

   MemberAuthor

   More actions

   Related: parse-community/Parse-SDK-JS#1979
3. dblythy commented on Jul 23, 2023

   

   dblythy

   on Jul 23, 2023

   MemberAuthor

   More actions

   I think the default regex should instead be '^(?!html$|htm$).*'
4. mtrezza

   added

   type:bugImpaired feature or lacking behavior that is likely assumedImpaired feature or lacking behavior that is likely assumed

   on Jul 23, 2023
5. mtrezza commented on Jul 23, 2023

   

   mtrezza

   on Jul 23, 2023

   Last edited by mtrezza

   Member

   More actions

   From the web server point of view, the path component of a URI is case sensitive, so we cannot add the i flag to the regex. On the other hand modern web browsers handle file extensions case-insensitive (file.HTML, file.html, file.HtMl, etc. are all rendered as HTML).

   So to truly prevent HTML content files we'd need to block any case-style without using the i flag, that's why we had the regex so far.

   If we don't keep the current case insensitive regex style, then the regex could be simply ^(?!html?$). This requires only 4 steps for the regex engine, regardless of the extension string length. But that would allow uploading malicious.HTmL and browsers would likely render the HTML content.

   If we want to keep the case insensitive style then we could use ^(?!(h|H)(t|T)(m|M)(l|L)?$), which should

   • not match html, htm with any casing combination (e.g. html, HTML HtMl)
   • match empty string '', i.e. no file extension
   • match any other extension

   Btw, the current file extension regex looks wrong anyway as it won't allow extensions shorter than 3 or longer than 4 chars.
6. dblythy commented on Jul 24, 2023

   

   dblythy

   on Jul 24, 2023

   MemberAuthor

   More actions

   Is it possible that a file could be uploaded with the extension hTmL?
7. mtrezza commented on Jul 24, 2023

   

   mtrezza

   on Jul 24, 2023

   Last edited by mtrezza

   Member

   More actions

   If the file extension regex is ["^(?!html?$)"] without the i flag, then yes, and a browser would render it. But we can't use the i flag, because we would limit developers who differentiate casing in the URI, technically index.HTML and index.html could be 2 different files. So we'd need ^(?!(h|H)(t|T)(m|M)(l|L)?$).
8. mtrezza

   closed this as completedin #8699on Mar 10, 2024
9. parseplatformorg commented on Mar 10, 2024

   

   parseplatformorg

   on Mar 10, 2024

   Contributor

   More actions

   🎉 This change has been released in version 7.0.0-alpha.26
10. parseplatformorg

    added

    state:released-alphaReleased as alpha versionReleased as alpha version

    on Mar 10, 2024
11. parseplatformorg commented on Mar 19, 2024

    

    parseplatformorg

    on Mar 19, 2024

    Contributor

    More actions

    🎉 This change has been released in version 7.0.0-beta.1
12. parseplatformorg

    added

    state:released-betaReleased as beta versionReleased as beta version

    on Mar 19, 2024
13. parseplatformorg commented on Mar 19, 2024

    

    parseplatformorg

    on Mar 19, 2024

    Contributor

    More actions

    🎉 This change has been released in version 7.0.0
14. parseplatformorg

    added

    state:releasedReleased as stable versionReleased as stable version

    on Mar 19, 2024