mirror of
https://github.com/penpot/penpot.git
synced 2026-11-10 20:10:37 +00:00
c39e3e8301
* ✨ Strictly validate uploads against file bytes on disk Sniff the real content type of every upload with simplemagic magic bytes instead of trusting the client-supplied mtype header. Declared types outside the allowlist keep the not-allowed code; allowed declarations whose bytes differ are rejected as mismatch. Covers SVG by probing its root tag over leading bytes (magic never matches XML text), TTF/OTF by magic name and WOFF/WOFF2 by four-cc. Read the real file size from disk instead of trusting the declared :size. Files over the limit are rejected even when the declared size lies downwards, and small files pass even when it lies upwards. Run the path check first everywhere so forged server paths keep the params-validation code. Recheck from-url downloads after the write, with a declared-only fast fail at header time. Thread the assembled path through font validation. Refresh the affected tests around real and sparse fixture files, including a PNG-as-font chunked-upload rejection case. Closes #12796 AI-assisted-by: muse-spark-1.3-contributor * 🐛 Accept BOM-prefixed SVG uploads and cover WOFF/WOFF2/OTF/WEBP Address review comments on #12801: - SVG files saved with a UTF-8 BOM were rejected as :media-type-mismatch: read-head kept U+FEFF and the <svg probe never ran. A leading BOM is now stripped before the probe, and a generic XML sniff (application/xml, text/xml) is treated as "no magic evidence" for declared image/svg+xml, so the root-tag probe decides whether the file opens with an <svg root. - sniff-match?/svg-file? docstrings claimed the magic database never matches SVG; simplemagic 1.17 does match an SVG with an XML prolog as image/svg+xml. Reworded to match reality. - Added matching-pass tests for WOFF, WOFF2, OTF and WEBP (they hit the read-four-cc, magic-name and direct magic branches) and three BOM SVG regression cases. AI-assisted-by: inkling-2-small-free