Details
-
Bug
-
Resolution: Fixed
-
Major
-
15.2, 15.3-rc-1, 14.10.8
-
None
-
Unknown
-
N/A
-
N/A
-
Description
When XWiki.AttachmentSelector fires the xwiki:actions:beforeUpload event, it passes a file input in the file property:
const beforeUploadEvent = Event.fire(document, 'xwiki:actions:beforeUpload', {
file: fileInput
});
Where it should rather pass a file:
const beforeUploadEvent = Event.fire(document, 'xwiki:actions:beforeUpload', {
file: fileInput.files[0]
});
The Javascript extensions at XWiki.Attachment.Validation.Code.MimetypeValidation and XWiki.Attachment.Validation.Code.FileSizeValidation both expect to find a type and a size attribute, which by coincidence the HTMLInputElement class has, but they do not correspond to the file size and mimetype. type is always "file", and size is the visual size of the input element rather than the file size (https://developer.mozilla.org/fr/docs/Web/API/HTMLInputElement). I saw no other uses of this event in xwiki-platform.
CKEditor.ImageSelectorServiceUIX.Upload does produce a xwiki:actions:beforeUpload event by passing a file.
Other locations where this event is fired, passing a file and not a file input:
This error causes rejection of any uploaded file when using a whitelist, and probably incorrectly allows any file client-side.