fix: GHSA-r899-h629-j84r

Author: mtrezza

spec/ParseFile.spec.js

@@ -1716,6 +1716,31 @@ describe('Parse.File testing', () => {
       ).toBeResolved();
     });
 
+    it('default should allow a valid custom content type the mime package does not recognize', async () => {
+      await reconfigureServer({
+        fileUpload: {
+          enableForPublic: true,
+        },
+      });
+      // A well-formed `type/subtype` that `mime` does not recognize (e.g. a
+      // vendor type) must still be accepted; only malformed or blocked
+      // Content-Types are rejected.
+      await expectAsync(
+        request({
+          method: 'POST',
+          url: 'http://localhost:8378/1/files/note.foo',
+          body: JSON.stringify({
+            _ApplicationId: 'test',
+            _JavaScriptKey: 'test',
+            _ContentType: 'application/vnd.api+json',
+            base64: Buffer.from('{}').toString('base64'),
+          }),
+        }).catch(e => {
+          throw new Error(e.data.error);
+        })
+      ).toBeResolved();
+    });
+
     it('works with a period in the file name', async () => {
       await reconfigureServer({
         fileUpload: {

spec/PurchaseValidation.spec.js

@@ -6,7 +6,7 @@ function createProduct() {
     {
       base64: new Buffer('download_file', 'utf-8').toString('base64'),
     },
-    'text'
+    'text/plain'
   );
   return file.save().then(function () {
     const product = new Parse.Object('_Product');

src/Routers/FilesRouter.js

@@ -445,26 +445,39 @@ export class FilesRouter {
 
       // When the filename extension is not recognized by `mime`,
       // `FilesController.createFile` cannot derive a Content-Type from the
-      // filename and preserves the client-supplied Content-Type verbatim. The
-      // type the file is actually served as must therefore be validated against
-      // the blocklist. A Content-Type that does not parse as `type/subtype` with
-      // a non-empty type AND subtype (e.g. `image`, `image/`) is unparseable:
-      // browsers ignore it and fall back to MIME-sniffing the file body, which
-      // can render HTML/script markers as active content on storage adapters
-      // that serve the stored Content-Type. Reject such malformed values rather
-      // than store them verbatim, unless extension filtering is disabled (`*`).
+      // filename and preserves the client-supplied Content-Type verbatim, so the
+      // type the file is actually served as must be validated. Skip this when
+      // extension filtering is disabled (`*`).
       const allowsAllExtensions = fileExtensions.includes('*');
       if (!isExtensionRecognized && contentType && !allowsAllExtensions) {
         const slashIndex = contentType.indexOf('/');
         const type = slashIndex > 0 ? contentType.slice(0, slashIndex).trim() : '';
         const subtype =
           slashIndex > 0 ? contentType.slice(slashIndex + 1).split(';')[0].trim() : '';
         if (!type || !subtype) {
+          // A Content-Type that does not parse as `type/subtype` with a non-empty
+          // type AND subtype is malformed: there is no valid MIME type without a
+          // subtype (RFC 9110 §8.3.1). Browsers cannot parse it and fall back to
+          // MIME-sniffing the file body, which can render HTML/script markers as
+          // active content on storage adapters that serve the stored Content-Type
+          // (e.g. `image`, `image/`). Surface the precise blocklist message when
+          // the bare token names a blocked extension (e.g. a no-slash `svg`),
+          // otherwise reject the unparseable Content-Type.
+          const bareToken = (slashIndex < 0 ? contentType.split(';')[0] : type).replace(
+            /\s+/g,
+            ''
+          );
+          if (bareToken && !isValidExtension(bareToken)) {
+            rejectExtension(bareToken);
+            return;
+          }
           next(new Parse.Error(Parse.Error.FILE_SAVE_ERROR, 'Invalid Content-Type.'));
           return;
         }
-        // Validate the Content-Type subtype against the blocklist, e.g.
+        // Validate the well-formed Content-Type subtype against the blocklist, e.g.
         // "image/svg+xml" -> "svg+xml", "image/svg+xml;charset=utf-8" -> "svg+xml".
+        // Valid custom/vendor types (e.g. "application/vnd.api+json") parse and are
+        // allowed; only blocked subtypes are rejected.
         const contentTypeExtension = subtype.replace(/\s+/g, '');
         if (!isValidExtension(contentTypeExtension)) {
           rejectExtension(contentTypeExtension);