Skip to content

Improve uploads security#507

Draft
AdamFipke wants to merge 5 commits intomainfrom
adam/improve-upload-security
Draft

Improve uploads security#507
AdamFipke wants to merge 5 commits intomainfrom
adam/improve-upload-security

Conversation

@AdamFipke
Copy link
Copy Markdown
Collaborator

Description

Please include a summary of the change and which issue is fixed.
Please also include relevant motivation and context.
List any dependencies that are required for this change.

Closes # (issue number)

Type of change

  • Bug fix (non-breaking change which fixes an issue)
  • New feature (non-breaking change which adds functionality)
  • Breaking change (fix or feature that would cause existing functionality to not work as expected)
  • This change requires a documentation update
  • This requires a run of yarn install
  • This change requires an addition/change to the production .env variables. These changes are below:
  • This change requires developers to add new .env variables. The file and variables needed are below:
  • This change requires a database query to update old data on production. This query is below:

How Has This Been Tested?

Please describe how you tested this PR (both manually and with tests)
Provide instructions so we can reproduce.

  • Test A
  • Test B

Checklist:

  • I have performed a code review of my own code (under the "Files Changed" tab on github) to ensure nothing is committed that shouldn't be (e.g. leftover console.logs, leftover unused logic, or anything else that was accidentally committed)
  • I have commented my code where needed
  • I have made corresponding changes to the documentation
  • My changes generate no new warnings
  • I have added tests that prove my fix is effective or that my feature works
  • I have checked that new and existing tests pass locally with my changes
  • Any work that this PR is dependent on has been merged into the main branch
  • Any UI changes have been checked to work on desktop, tablet, and mobile

…ting the photoURL from the user for some reason(????)
…rmission checks so you can't just retrieve a pfp just because you know the URL. Not completely scrubbing photoURL from the frontend since if \!photoURL the default avatar initials is shown instead. Also external photo urls will still have no permission checks
…l-vm-modules in the node options for testing since nestjs FileTypeValidator uses eval('import('file-type')') which doesn't work in jest, causing the magic byte validation to not work.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant