🛡️ Sentinel: [CRITICAL/HIGH] Fix File Upload Extension Validation

[xb1g]

🚨 Severity: HIGH

💡 Vulnerability: The DANGEROUS_EXTENSIONS configuration in lib/constants/upload.ts did not block potentially malicious executable scripts (like .php, .sh, .py, .cgi) or web content (like .html, .htm, .svg, .xml). Since Backblaze B2 endpoints generate URLs that might serve these files with their client-provided MIME type or extension, this allowed attackers to bypass intended restrictions and potentially upload files capable of triggering Cross-Site Scripting (XSS), Server-Side Request Forgery (SSRF), or other remote execution depending on the storage server configuration.

🎯 Impact: Malicious users could upload script files that, when accessed, execute in the context of the user's browser (XSS) or the server environment if improperly configured.

🔧 Fix: Expanded the DANGEROUS_EXTENSIONS array to include .php, .sh, .py, .pl, .cgi, .html, .htm, .svg, and .xml, effectively blocking their upload globally across all features utilizing the standard upload validations.

✅ Verification: Run pnpm test to ensure existing file validation logic correctly processes the updated array and existing tests pass. Evaluated the codebase to confirm DANGEROUS_EXTENSIONS is used effectively in the unified validateFileName utility.

---

PR created automatically by Jules for task 12299279236695494635 started by @xb1g

[google-labs-jules]

👋 Jules, reporting for duty! I'm here to lend a hand with this pull request.

When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down.

I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job!

For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with @jules. You can find this option in the Pull Request section of your global Jules UI settings. You can always switch back!

New to Jules? Learn more at jules.google/docs.

---

For security, I will only act on instructions from the user who triggered this task.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
pseed	Error		Mar 23, 2026 3:43am