Skip to content

fix: file extension restriction doesn't check for dot#16426

Open
timakai wants to merge 1 commit intopayloadcms:mainfrom
timakai:fix/file-extension-restriction-check-dot
Open

fix: file extension restriction doesn't check for dot#16426
timakai wants to merge 1 commit intopayloadcms:mainfrom
timakai:fix/file-extension-restriction-check-dot

Conversation

@timakai
Copy link
Copy Markdown

@timakai timakai commented Apr 29, 2026

What?

Add a dot . in front of the checked extension before validating.

Why?

The current file restriction checker checks for extensions by checking the end of the filename.

file.name.toLowerCase().endsWith(ext)

It does not check if a dot is present, which gives problems with files that have no extension at all.
I uploaded a file with the name 0a621d9d1aa24f8ca3a5fbd523f6a24174061deb (a md5 hash). This file triggered the deb restriction because it ended in deb.

How?

Before:

const hasRestrictedExt = type.extensions.some((ext) => file.name.toLowerCase().endsWith(ext))

After:

const hasRestrictedExt = type.extensions.some((ext) => file.name.toLowerCase().endsWith("." + ext))

Current impl. checks extension without dot. We need to check the dot in case of files without an extension.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant