[Bug] dashboard-api: uploadFile does not sanitize file.originalname before use in storage path, allowing path injection characters

[anshul23102]

Describe the bug

In apps/public-api/src/controllers/storage.controller.js, the uploaded file's original filename is used directly in the Supabase storage path after only replacing spaces:

const safeName = file.originalname.replace(/\s+/g, "_");
const filePath = `${project._id}/${randomUUID()}_${safeName}`;

The originalname field comes from the HTTP multipart upload and is entirely user-controlled. Characters such as ../, null bytes (%00), or Unicode directory separators are not stripped. While the random UUID prefix reduces the practical risk of path traversal, the unsanitized filename is sent verbatim to Supabase's storage API and is also returned to the client in the path response field.

A crafted filename like ../../secret.pdf or valid.pdf\x00.jpg may exploit permissive storage backends or confuse downstream filename parsers that use the stored path.

To Reproduce

1. Send a POST /api/storage/upload request with Content-Type: audio/webm and set the filename in the multipart header to ../../test.webm.
2. Observe that the path field in the response contains the unsanitized string (e.g., projectId/uuid_../../test.webm).

Expected behavior

The filename should be sanitized to safe characters before use in any path construction:

const safeName = file.originalname
    .replace(/[^a-zA-Z0-9._-]/g, "_")
    .replace(/\.{2,}/g, "_")
    .substring(0, 100);
const filePath = `${project._id}/${randomUUID()}_${safeName}`;

Additional context

File: apps/public-api/src/controllers/storage.controller.js, function: uploadFile

Labels: bug, nsoc26, level2

Checklist:

• Searched existing issues - not a duplicate
• Read CONTRIBUTING.md
• No AI/Claude mentions
• No em dashes or double hyphens
• Repository verified as NSOC

[anshul23102]

@geturbackend Could you please /assign this issue to me? I'd like to work on it under NSOC '26.

[Jyotiiii3003]

Hey .
I would love to work on this issue as part of SSoC'26.
Please let me know if I can proceed. Thanks!

[Priyanka0205-CSE]

Hi @yash-pouranik
I reviewed this issue and understand the root cause. The uploaded filename is currently used in the storage path with only whitespace replacement, which allows potentially unsafe characters to be included in the generated path.

I would be interested in working on this issue by implementing proper filename sanitization, preventing path traversal patterns, restricting unsafe characters, and adding tests to verify the behavior.

If the issue is still available, could you please consider assigning it to me under GSSoC 2026?

Thank you!

[yash-pouranik]

u are not in gssoc @Jyotiiii3003
??

[yash-pouranik]

U can take this
@Priyanka0205-CSE

[aaniya22]

pls assign this to me under gssoc'26

[yash-pouranik]

SSOC Has not communicated to me, on how to handle contributions
So Not going with ssoc, Only GSSoC and NSOC
@Jyotiiii3003

[yash-pouranik]

@Priyanka0205-CSE
U are already assigned to one another issue, .

[yash-pouranik]

@aaniya22
SHare approach

[aaniya22]

I plan to implement the recommended sanitation solution directly inside the controller layer (image_5.png):

1. Sanitize Filename: Use a strict regex whitelist replacement to scrub any non-alphanumeric, dot, underscore, or hyphen characters (image_5.png):

const safeName = file.originalname
    .replace(/[^a-zA-Z0-9._-]/g, "_")
    .replace(/\.{2,}/g, "_") // Block consecutive directory-traversal dots
    .substring(0, 100);       // Cap maximum name length

2. **Path Reconstruction:** Use this `safeName` variable instead of the raw `originalname` when combining the project ID and random UUID prefix to generate the final `filePath` (`image_5.png`).
3. **Verification:** Test the multi-part form upload with payload injection strings like `../../test.webm` to ensure they are properly neutralized to `__test.webm` or equivalent safe characters (`image_6.png`).

Could you please assign this issue to me so I can open a PR?

[yash-pouranik]

already assigned 1 issue.
cant assign this.
@aaniya22

[aaniya22]

already assigned 1 issue. cant assign this. @aaniya22

i have completed the previous one

[yash-pouranik]

yh u can start working on this one.
@aaniya22