Uploaded image for project: 'XWiki Platform'
  1. XWiki Platform
  2. XWIKI-20884

AttachmentSelector passes a file input instead of a file, breaking file size and mimetype verification

    XMLWordPrintable

Details

    • Bug
    • Resolution: Fixed
    • Major
    • 14.10.10, 15.4-rc-1
    • 15.2, 15.3-rc-1, 14.10.8
    • Attachments
    • None
    • Unknown
    • N/A
    • N/A

    Description

      When XWiki.AttachmentSelector fires the xwiki:actions:beforeUpload event, it passes a file input in the file property:

            const beforeUploadEvent = Event.fire(document, 'xwiki:actions:beforeUpload', {
              file: fileInput
            });

      Where it should rather pass a file:

            const beforeUploadEvent = Event.fire(document, 'xwiki:actions:beforeUpload', {
              file: fileInput.files[0]
            });

      The Javascript extensions at XWiki.Attachment.Validation.Code.MimetypeValidation and XWiki.Attachment.Validation.Code.FileSizeValidation both expect to find a type and a size attribute, which by coincidence the HTMLInputElement class has, but they do not correspond to the file size and mimetype. type is always "file", and size is the visual size of the input element rather than the file size (https://developer.mozilla.org/fr/docs/Web/API/HTMLInputElement). I saw no other uses of this event in xwiki-platform.

      CKEditor.ImageSelectorServiceUIX.Upload does produce a xwiki:actions:beforeUpload event by passing a file.

      Other locations where this event is fired, passing a file and not a file input:

      https://github.com/xwiki/xwiki-platform/blob/04cb85cb0b576da2d59bee23abdbf69702fcdc85/xwiki-platform-core/xwiki-platform-ckeditor/xwiki-platform-ckeditor-ui/src/main/resources/CKEditor/ImageSelectorServiceUIX/Upload.xml#L148

      https://github.com/xwiki/xwiki-platform/blob/cad681e1b49f5515475264a54168d2d5952f2fc9/xwiki-platform-core/xwiki-platform-web/xwiki-platform-web-war/src/main/webapp/resources/uicomponents/widgets/upload.js#L511

      This error causes rejection of any uploaded file when using a whitelist, and probably incorrectly allows any file client-side.

      Attachments

        Activity

          People

            rjakse Raphaël Jakse
            rjakse Raphaël Jakse
            Votes:
            0 Vote for this issue
            Watchers:
            0 Start watching this issue

            Dates

              Created:
              Updated:
              Resolved: