Harden IPFS uploads and enforce strict Zod validation - #1438
Open
CillaSam wants to merge 2 commits into
Open
Conversation
Uploaded images are now verified by their actual decoded content (via sharp/libvips format detection) instead of the client-supplied MIME type or filename extension, which are both attacker-controlled. Only a fixed raster allowlist (jpeg/png/gif/webp) is accepted; SVG is rejected outright since it can carry scripts and can't be verified the same way. Accepted images are bounded to 4096x4096px and re-encoded before pinning, which strips all EXIF/IPTC/XMP metadata (including GPS) and drops any bytes outside the actual image data — closing off the classic polyglot-file trick of appending a payload after a format's end-of-data marker. Tests cover a valid image, a spoofed content-type, SVG rejection, oversized dimensions, and EXIF/GPS stripping.
…kanimoh12#1233) Every schema that parses a mutating endpoint's request body (plus IPFS's CID param schema) now calls .strict(), so an unrecognized field is rejected with a 400 naming the offending key instead of silently passing through — the existing global error handler already surfaces Zod's unrecognized-key message via the VALIDATION_ERROR response. Also closes two mass-assignment gaps found while auditing Prisma writes for spread input: - notifications.service.ts upserted a preference row with `{ userId, ...patch }` / `patch`; now lists each column explicitly. - moderation.service.ts spread the full report input into an audit log's metadata field; now lists each field explicitly. - admin's POST /admin/audit-log read action/target/metadata straight off req.body with no validation at all; it now parses through createAuditLogSchema first. Added tests/zodStrictValidation.test.ts, which exercises every one of these schemas against its minimal valid payload plus one with an unrecognized field, so every mutating endpoint's schema is covered by a rejection test in one place.
|
@CillaSam Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits. You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
.strict(), so unrecognized fields are rejected with a 400 naming the offending key. Also fixed two mass-assignment gaps found while auditing Prisma writes that spread parsed input directly:notifications.service.tsandmoderation.service.tsnow use explicit field allowlists, and the previously-unvalidatedPOST /admin/audit-logbody now goes through its schema.Test plan
backend/src/modules/ipfs/ipfs.test.ts— valid image, spoofed content-type, SVG rejection, oversized dimensions, EXIF/GPS stripping, HTTP route integration (26 tests)backend/tests/zodStrictValidation.test.ts— every mutating-endpoint body schema (plus the IPFS CID param schema) accepts its valid payload and rejects an unrecognized field (79 tests)npm testacross affected modules — no regressions (failures seen locally are pre-existing and require a live Postgres/Redis not available in this sandbox)npm run typecheck— no new errors introducednpm run lint— clean on all changed filesCloses #1232, Closes #1233