00b59ec2f4
Some checks failed
Build / build (22.12.0) (push) Has been cancelled
Reject non-mp4 / non-image attachment URLs in the MCP integrationSchedulePostTool (previously accepted any URL). Introduce a single ALLOWED_POST_MEDIA source of truth in helpers/has.extension and derive VALID_POST_MEDIA_EXTENSIONS + VALID_POST_MEDIA_MIME_TYPES from it, replacing duplicated constants in the file upload pipe, the public-api URL upload controller, and the ValidUrlExtension DTO validator. Error messages now consistently list the allowed extensions across the public API and MCP.
41 lines
1.3 KiB
TypeScript
41 lines
1.3 KiB
TypeScript
import {
|
|
ValidationArguments,
|
|
ValidatorConstraintInterface,
|
|
ValidatorConstraint,
|
|
} from 'class-validator';
|
|
import { VALID_POST_MEDIA_EXTENSIONS } from './has.extension';
|
|
|
|
@ValidatorConstraint({ name: 'checkValidExtension', async: false })
|
|
export class ValidUrlExtension implements ValidatorConstraintInterface {
|
|
validate(text: string, args: ValidationArguments) {
|
|
const path = text?.split?.('?')?.[0]?.toLowerCase?.();
|
|
if (!path) return false;
|
|
return VALID_POST_MEDIA_EXTENSIONS.some((ext) => path.endsWith('.' + ext));
|
|
}
|
|
|
|
defaultMessage(args: ValidationArguments) {
|
|
return `File must have a valid extension: ${VALID_POST_MEDIA_EXTENSIONS.map(
|
|
(ext) => '.' + ext
|
|
).join(', ')}`;
|
|
}
|
|
}
|
|
|
|
@ValidatorConstraint({ name: 'checkValidPath', async: false })
|
|
export class ValidUrlPath implements ValidatorConstraintInterface {
|
|
validate(text: string, args: ValidationArguments) {
|
|
if (!process.env.RESTRICT_UPLOAD_DOMAINS) {
|
|
return true;
|
|
}
|
|
|
|
return (
|
|
(text || 'invalid url').indexOf(process.env.RESTRICT_UPLOAD_DOMAINS) > -1
|
|
);
|
|
}
|
|
|
|
defaultMessage(args: ValidationArguments) {
|
|
// here you can provide default error message if validation failed
|
|
return (
|
|
'URL must contain the domain: ' + process.env.RESTRICT_UPLOAD_DOMAINS + ' Make sure you first use the upload API route.'
|
|
);
|
|
}
|
|
}
|