fix(security): VULN-009 magic-byte MIME validation + UTC date fix

- uploadEvidenceFile: validate file type via file-type magic bytes, reject client-supplied MIME, derive extension from detected type, upload ArrayBuffer - getEscalationThreshold: use setUTCHours instead of setHours so date-only ISO strings (always UTC midnight) compare consistently in any timezone - Tests: mock file-type, update upload expectation to ArrayBuffer Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01CPf5Rc8QPx6V8KLEEgfKEQ
2026-07-13 06:37:59 +08:00
parent 3776bc20b3
commit 614c792225
5 changed files with 150 additions and 12 deletions
@@ -8,9 +8,9 @@ export type EscalationThreshold = 'warning_3d' | 'due_today' | 'overdue_3d' | 'o

 export function getEscalationThreshold(dueDateIso: string): EscalationThreshold | null {
  const today = new Date()
-  today.setHours(0, 0, 0, 0)
+  today.setUTCHours(0, 0, 0, 0)
  const due = new Date(dueDateIso)
-  due.setHours(0, 0, 0, 0)
+  // date-only ISO strings are parsed as UTC midnight — keep due in UTC too
  const diffDays = Math.round((due.getTime() - today.getTime()) / 86_400_000)

  if (diffDays === 3) return 'warning_3d'
@@ -1,34 +1,52 @@
 import type { SupabaseClient } from '@supabase/supabase-js'
+import { fileTypeFromBuffer } from 'file-type'

 export type EvidenceStage = 'report' | 'response' | 'investigation' | 'capa' | 'verification'

+const ALLOWED_MIME_TYPES = new Set([
+  'image/jpeg', 'image/png', 'image/gif', 'image/webp', 'image/heic', 'image/avif',
+  'video/mp4', 'video/quicktime', 'video/webm', 'video/x-msvideo',
+  'application/pdf',
+  'application/msword',
+  'application/vnd.openxmlformats-officedocument.wordprocessingml.document',
+  'application/vnd.ms-excel',
+  'application/vnd.openxmlformats-officedocument.spreadsheetml.sheet',
+])
+
 export async function uploadEvidenceFile(
  supabase: SupabaseClient,
  file: File,
  incidentId: string,
  stage: EvidenceStage,
 ): Promise<{ path: string; publicUrl: string; hash: string }> {
-  // Fix 3: Safe auth.getUser() destructuring
  const { data, error: authError } = await supabase.auth.getUser()
  if (authError || !data?.user) throw new Error('Not authenticated')
  const user = data.user

-  // Fix 2: Server-side size limit before processing
+  // Server-side size limit before processing
  const isVideo = file.type.startsWith('video/')
  const maxBytes = isVideo ? 200 * 1024 * 1024 : 10 * 1024 * 1024
  if (file.size > maxBytes) {
    throw new Error(`File too large: max ${isVideo ? '200MB' : '10MB'} for this file type`)
  }

-  const ext = file.name.split('.').pop() ?? 'bin'
+  // Magic-byte validation — do not trust client-supplied MIME type
+  const buffer = await file.arrayBuffer()
+  const detected = await fileTypeFromBuffer(buffer)
+  const detectedMime = detected?.mime ?? null
+  if (!detectedMime || !ALLOWED_MIME_TYPES.has(detectedMime)) {
+    throw new Error(`File type not allowed: ${detectedMime ?? 'unknown'}`)
+  }
+
+  const ext = detected?.ext ?? file.name.split('.').pop() ?? 'bin'
  const filename = `${Date.now()}-${Math.random().toString(36).slice(2)}.${ext}`
  const path = `${user.id}/${incidentId}/${stage}/${filename}`

-  const hash = await computeHash(file)
+  const hash = await computeHashFromBuffer(buffer)

  const { data: uploadData, error } = await supabase.storage
    .from('evidence')
-    .upload(path, file, { contentType: file.type, upsert: false })
+    .upload(path, buffer, { contentType: detectedMime, upsert: false })

  if (error) throw new Error(error.message)

@@ -48,8 +66,7 @@ export async function getEvidenceUrl(supabase: SupabaseClient, path: string): Pr
  return data.signedUrl
 }

-async function computeHash(file: File): Promise<string> {
-  const buffer = await file.arrayBuffer()
+async function computeHashFromBuffer(buffer: ArrayBuffer): Promise<string> {
  const hashBuffer = await crypto.subtle.digest('SHA-256', buffer)
  return Array.from(new Uint8Array(hashBuffer))
    .map(b => b.toString(16).padStart(2, '0'))
@@ -11,6 +11,7 @@
        "@anthropic-ai/sdk": "^0.111.0",
        "@supabase/ssr": "^0.12.0",
        "@supabase/supabase-js": "^2.110.2",
+        "file-type": "^22.0.1",
        "idb": "^8.0.3",
        "next": "^15.5.20",
        "openai": "^6.46.0",
@@ -379,6 +380,16 @@
        "node": ">=6.9.0"
      }
    },
+    "node_modules/@borewit/text-codec": {
+      "version": "0.2.2",
+      "resolved": "https://registry.npmjs.org/@borewit/text-codec/-/text-codec-0.2.2.tgz",
+      "integrity": "sha512-DDaRehssg1aNrH4+2hnj1B7vnUGEjU6OIlyRdkMd0aUdIUvKXrJfXsy8LVtXAy7DRvYVluWbMspsRhz2lcW0mQ==",
+      "license": "MIT",
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/sponsors/Borewit"
+      }
+    },
    "node_modules/@bramus/specificity": {
      "version": "2.4.2",
      "resolved": "https://registry.npmjs.org/@bramus/specificity/-/specificity-2.4.2.tgz",
@@ -2850,6 +2861,29 @@
        }
      }
    },
+    "node_modules/@tokenizer/inflate": {
+      "version": "0.4.1",
+      "resolved": "https://registry.npmjs.org/@tokenizer/inflate/-/inflate-0.4.1.tgz",
+      "integrity": "sha512-2mAv+8pkG6GIZiF1kNg1jAjh27IDxEPKwdGul3snfztFerfPGI1LjDezZp3i7BElXompqEtPmoPx6c2wgtWsOA==",
+      "license": "MIT",
+      "dependencies": {
+        "debug": "^4.4.3",
+        "token-types": "^6.1.1"
+      },
+      "engines": {
+        "node": ">=18"
+      },
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/sponsors/Borewit"
+      }
+    },
+    "node_modules/@tokenizer/token": {
+      "version": "0.3.0",
+      "resolved": "https://registry.npmjs.org/@tokenizer/token/-/token-0.3.0.tgz",
+      "integrity": "sha512-OvjF+z51L3ov0OyAU0duzsYuvO01PH7x4t6DJx+guahgTnBHkhJdG7soQeTSFLWN3efnHyibZ4Z8l2EuWwJN3A==",
+      "license": "MIT"
+    },
    "node_modules/@tybys/wasm-util": {
      "version": "0.10.3",
      "resolved": "https://registry.npmjs.org/@tybys/wasm-util/-/wasm-util-0.10.3.tgz",
@@ -4434,7 +4468,6 @@
      "version": "4.4.3",
      "resolved": "https://registry.npmjs.org/debug/-/debug-4.4.3.tgz",
      "integrity": "sha512-RGwwWnwQvkVfavKVt22FGLw+xYSdzARwm0ru6DhTVA3umU5hZc28V3kO4stgYryrTlLpuvgI9GiijltAjNbcqA==",
-      "dev": true,
      "license": "MIT",
      "dependencies": {
        "ms": "^2.1.3"
@@ -5399,6 +5432,24 @@
        "node": ">=16.0.0"
      }
    },
+    "node_modules/file-type": {
+      "version": "22.0.1",
+      "resolved": "https://registry.npmjs.org/file-type/-/file-type-22.0.1.tgz",
+      "integrity": "sha512-ww5Mhre0EE+jmBvOXTmXAbEMuZE7uX4a3+oRCQFNj8w++g3ev913N6tXQz0XTXbueQ5TWQfm6BdaViEHHn8bhA==",
+      "license": "MIT",
+      "dependencies": {
+        "@tokenizer/inflate": "^0.4.1",
+        "strtok3": "^10.3.5",
+        "token-types": "^6.1.2",
+        "uint8array-extras": "^1.5.0"
+      },
+      "engines": {
+        "node": ">=22"
+      },
+      "funding": {
+        "url": "https://github.com/sindresorhus/file-type?sponsor=1"
+      }
+    },
    "node_modules/fill-range": {
      "version": "7.1.1",
      "resolved": "https://registry.npmjs.org/fill-range/-/fill-range-7.1.1.tgz",
@@ -5827,6 +5878,26 @@
      "integrity": "sha512-LtwtVyVYO5BqRvcsKuB2iUMnHwPVByPCXFXOpuU96IZPPoPN6xjOGxZQ74pgSVVLQWtUOYgyeL4GE98BY5D3wg==",
      "license": "ISC"
    },
+    "node_modules/ieee754": {
+      "version": "1.2.1",
+      "resolved": "https://registry.npmjs.org/ieee754/-/ieee754-1.2.1.tgz",
+      "integrity": "sha512-dcyqhDvX1C46lXZcVqCpK+FtMRQVdIMN6/Df5js2zouUsqG7I6sFxitIC+7KYK29KdXOLHdu9zL4sFnoVQnqaA==",
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/feross"
+        },
+        {
+          "type": "patreon",
+          "url": "https://www.patreon.com/feross"
+        },
+        {
+          "type": "consulting",
+          "url": "https://feross.org/support"
+        }
+      ],
+      "license": "BSD-3-Clause"
+    },
    "node_modules/ignore": {
      "version": "5.3.2",
      "resolved": "https://registry.npmjs.org/ignore/-/ignore-5.3.2.tgz",
@@ -6998,7 +7069,6 @@
      "version": "2.1.3",
      "resolved": "https://registry.npmjs.org/ms/-/ms-2.1.3.tgz",
      "integrity": "sha512-6FlzubTLZG3J2a/NVCAleEhjzq5oxgHyaCU9yYXvcLsvoVaHJq/s5xXI6/XXP6tz7R9xAOtHnSO/tXtF3WRTlA==",
-      "dev": true,
      "license": "MIT"
    },
    "node_modules/nanoid": {
@@ -8453,6 +8523,22 @@
        "url": "https://github.com/sponsors/sindresorhus"
      }
    },
+    "node_modules/strtok3": {
+      "version": "10.3.5",
+      "resolved": "https://registry.npmjs.org/strtok3/-/strtok3-10.3.5.tgz",
+      "integrity": "sha512-ki4hZQfh5rX0QDLLkOCj+h+CVNkqmp/CMf8v8kZpkNVK6jGQooMytqzLZYUVYIZcFZ6yDB70EfD8POcFXiF5oA==",
+      "license": "MIT",
+      "dependencies": {
+        "@tokenizer/token": "^0.3.0"
+      },
+      "engines": {
+        "node": ">=18"
+      },
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/sponsors/Borewit"
+      }
+    },
    "node_modules/styled-jsx": {
      "version": "5.1.6",
      "resolved": "https://registry.npmjs.org/styled-jsx/-/styled-jsx-5.1.6.tgz",
@@ -8638,6 +8724,24 @@
        "node": ">=8.0"
      }
    },
+    "node_modules/token-types": {
+      "version": "6.1.2",
+      "resolved": "https://registry.npmjs.org/token-types/-/token-types-6.1.2.tgz",
+      "integrity": "sha512-dRXchy+C0IgK8WPC6xvCHFRIWYUbqqdEIKPaKo/AcTUNzwLTK6AH7RjdLWsEZcAN/TBdtfUw3PYEgPr5VPr6ww==",
+      "license": "MIT",
+      "dependencies": {
+        "@borewit/text-codec": "^0.2.1",
+        "@tokenizer/token": "^0.3.0",
+        "ieee754": "^1.2.1"
+      },
+      "engines": {
+        "node": ">=14.16"
+      },
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/sponsors/Borewit"
+      }
+    },
    "node_modules/tough-cookie": {
      "version": "6.0.2",
      "resolved": "https://registry.npmjs.org/tough-cookie/-/tough-cookie-6.0.2.tgz",
@@ -8863,6 +8967,18 @@
        "typescript": ">=4.8.4 <6.1.0"
      }
    },
+    "node_modules/uint8array-extras": {
+      "version": "1.5.0",
+      "resolved": "https://registry.npmjs.org/uint8array-extras/-/uint8array-extras-1.5.0.tgz",
+      "integrity": "sha512-rvKSBiC5zqCCiDZ9kAOszZcDvdAHwwIKJG33Ykj43OKcWsnmcBRL09YTU4nOeHZ8Y2a7l1MgTd08SBe9A8Qj6A==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=18"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
    "node_modules/unbox-primitive": {
      "version": "1.1.0",
      "resolved": "https://registry.npmjs.org/unbox-primitive/-/unbox-primitive-1.1.0.tgz",
@@ -15,6 +15,7 @@
    "@anthropic-ai/sdk": "^0.111.0",
    "@supabase/ssr": "^0.12.0",
    "@supabase/supabase-js": "^2.110.2",
+    "file-type": "^22.0.1",
    "idb": "^8.0.3",
    "next": "^15.5.20",
    "openai": "^6.46.0",
@@ -1,6 +1,10 @@
 import { describe, it, expect, vi, beforeEach } from 'vitest'
 import { uploadEvidenceFile, getEvidenceUrl } from '@/lib/supabase/storage'

+vi.mock('file-type', () => ({
+  fileTypeFromBuffer: vi.fn().mockResolvedValue({ mime: 'image/jpeg', ext: 'jpg' }),
+}))
+
 const mockUpload = vi.fn()
 const mockCreateSignedUrl = vi.fn()
 const mockSupabase = {
@@ -26,7 +30,7 @@ describe('uploadEvidenceFile', () => {
    expect(mockSupabase.storage.from).toHaveBeenCalledWith('evidence')
    expect(mockUpload).toHaveBeenCalledWith(
      expect.stringContaining('user-123/incident-abc/report/'),
-      file,
+      expect.any(ArrayBuffer),
      expect.objectContaining({ contentType: 'image/jpeg', upsert: false })
    )
    expect(mockCreateSignedUrl).toHaveBeenCalledWith(expect.stringContaining('user-123/incident-abc/report/'), 315360000)