From 614c792225f16986874bc0a8c3a8d5759e0fed9d Mon Sep 17 00:00:00 2001 From: weeihan Date: Mon, 13 Jul 2026 06:37:59 +0800 Subject: [PATCH] fix(security): VULN-009 magic-byte MIME validation + UTC date fix - uploadEvidenceFile: validate file type via file-type magic bytes, reject client-supplied MIME, derive extension from detected type, upload ArrayBuffer - getEscalationThreshold: use setUTCHours instead of setHours so date-only ISO strings (always UTC midnight) compare consistently in any timezone - Tests: mock file-type, update upload expectation to ArrayBuffer Co-Authored-By: Claude Sonnet 4.6 Claude-Session: https://claude.ai/code/session_01CPf5Rc8QPx6V8KLEEgfKEQ --- lib/notifications/capa-escalation.ts | 4 +- lib/supabase/storage.ts | 31 +++++-- package-lock.json | 120 ++++++++++++++++++++++++++- package.json | 1 + tests/lib/supabase/storage.test.ts | 6 +- 5 files changed, 150 insertions(+), 12 deletions(-) diff --git a/lib/notifications/capa-escalation.ts b/lib/notifications/capa-escalation.ts index be08ad4..bec2499 100644 --- a/lib/notifications/capa-escalation.ts +++ b/lib/notifications/capa-escalation.ts @@ -8,9 +8,9 @@ export type EscalationThreshold = 'warning_3d' | 'due_today' | 'overdue_3d' | 'o export function getEscalationThreshold(dueDateIso: string): EscalationThreshold | null { const today = new Date() - today.setHours(0, 0, 0, 0) + today.setUTCHours(0, 0, 0, 0) const due = new Date(dueDateIso) - due.setHours(0, 0, 0, 0) + // date-only ISO strings are parsed as UTC midnight — keep due in UTC too const diffDays = Math.round((due.getTime() - today.getTime()) / 86_400_000) if (diffDays === 3) return 'warning_3d' diff --git a/lib/supabase/storage.ts b/lib/supabase/storage.ts index 36446d0..e162165 100644 --- a/lib/supabase/storage.ts +++ b/lib/supabase/storage.ts @@ -1,34 +1,52 @@ import type { SupabaseClient } from '@supabase/supabase-js' +import { fileTypeFromBuffer } from 'file-type' export type EvidenceStage = 'report' | 'response' | 'investigation' | 'capa' | 'verification' +const ALLOWED_MIME_TYPES = new Set([ + 'image/jpeg', 'image/png', 'image/gif', 'image/webp', 'image/heic', 'image/avif', + 'video/mp4', 'video/quicktime', 'video/webm', 'video/x-msvideo', + 'application/pdf', + 'application/msword', + 'application/vnd.openxmlformats-officedocument.wordprocessingml.document', + 'application/vnd.ms-excel', + 'application/vnd.openxmlformats-officedocument.spreadsheetml.sheet', +]) + export async function uploadEvidenceFile( supabase: SupabaseClient, file: File, incidentId: string, stage: EvidenceStage, ): Promise<{ path: string; publicUrl: string; hash: string }> { - // Fix 3: Safe auth.getUser() destructuring const { data, error: authError } = await supabase.auth.getUser() if (authError || !data?.user) throw new Error('Not authenticated') const user = data.user - // Fix 2: Server-side size limit before processing + // Server-side size limit before processing const isVideo = file.type.startsWith('video/') const maxBytes = isVideo ? 200 * 1024 * 1024 : 10 * 1024 * 1024 if (file.size > maxBytes) { throw new Error(`File too large: max ${isVideo ? '200MB' : '10MB'} for this file type`) } - const ext = file.name.split('.').pop() ?? 'bin' + // Magic-byte validation — do not trust client-supplied MIME type + const buffer = await file.arrayBuffer() + const detected = await fileTypeFromBuffer(buffer) + const detectedMime = detected?.mime ?? null + if (!detectedMime || !ALLOWED_MIME_TYPES.has(detectedMime)) { + throw new Error(`File type not allowed: ${detectedMime ?? 'unknown'}`) + } + + const ext = detected?.ext ?? file.name.split('.').pop() ?? 'bin' const filename = `${Date.now()}-${Math.random().toString(36).slice(2)}.${ext}` const path = `${user.id}/${incidentId}/${stage}/${filename}` - const hash = await computeHash(file) + const hash = await computeHashFromBuffer(buffer) const { data: uploadData, error } = await supabase.storage .from('evidence') - .upload(path, file, { contentType: file.type, upsert: false }) + .upload(path, buffer, { contentType: detectedMime, upsert: false }) if (error) throw new Error(error.message) @@ -48,8 +66,7 @@ export async function getEvidenceUrl(supabase: SupabaseClient, path: string): Pr return data.signedUrl } -async function computeHash(file: File): Promise { - const buffer = await file.arrayBuffer() +async function computeHashFromBuffer(buffer: ArrayBuffer): Promise { const hashBuffer = await crypto.subtle.digest('SHA-256', buffer) return Array.from(new Uint8Array(hashBuffer)) .map(b => b.toString(16).padStart(2, '0')) diff --git a/package-lock.json b/package-lock.json index 77dc84e..906004c 100644 --- a/package-lock.json +++ b/package-lock.json @@ -11,6 +11,7 @@ "@anthropic-ai/sdk": "^0.111.0", "@supabase/ssr": "^0.12.0", "@supabase/supabase-js": "^2.110.2", + "file-type": "^22.0.1", "idb": "^8.0.3", "next": "^15.5.20", "openai": "^6.46.0", @@ -379,6 +380,16 @@ "node": ">=6.9.0" } }, + "node_modules/@borewit/text-codec": { + "version": "0.2.2", + "resolved": "https://registry.npmjs.org/@borewit/text-codec/-/text-codec-0.2.2.tgz", + "integrity": "sha512-DDaRehssg1aNrH4+2hnj1B7vnUGEjU6OIlyRdkMd0aUdIUvKXrJfXsy8LVtXAy7DRvYVluWbMspsRhz2lcW0mQ==", + "license": "MIT", + "funding": { + "type": "github", + "url": "https://github.com/sponsors/Borewit" + } + }, "node_modules/@bramus/specificity": { "version": "2.4.2", "resolved": "https://registry.npmjs.org/@bramus/specificity/-/specificity-2.4.2.tgz", @@ -2850,6 +2861,29 @@ } } }, + "node_modules/@tokenizer/inflate": { + "version": "0.4.1", + "resolved": "https://registry.npmjs.org/@tokenizer/inflate/-/inflate-0.4.1.tgz", + "integrity": "sha512-2mAv+8pkG6GIZiF1kNg1jAjh27IDxEPKwdGul3snfztFerfPGI1LjDezZp3i7BElXompqEtPmoPx6c2wgtWsOA==", + "license": "MIT", + "dependencies": { + "debug": "^4.4.3", + "token-types": "^6.1.1" + }, + "engines": { + "node": ">=18" + }, + "funding": { + "type": "github", + "url": "https://github.com/sponsors/Borewit" + } + }, + "node_modules/@tokenizer/token": { + "version": "0.3.0", + "resolved": "https://registry.npmjs.org/@tokenizer/token/-/token-0.3.0.tgz", + "integrity": "sha512-OvjF+z51L3ov0OyAU0duzsYuvO01PH7x4t6DJx+guahgTnBHkhJdG7soQeTSFLWN3efnHyibZ4Z8l2EuWwJN3A==", + "license": "MIT" + }, "node_modules/@tybys/wasm-util": { "version": "0.10.3", "resolved": "https://registry.npmjs.org/@tybys/wasm-util/-/wasm-util-0.10.3.tgz", @@ -4434,7 +4468,6 @@ "version": "4.4.3", "resolved": "https://registry.npmjs.org/debug/-/debug-4.4.3.tgz", "integrity": "sha512-RGwwWnwQvkVfavKVt22FGLw+xYSdzARwm0ru6DhTVA3umU5hZc28V3kO4stgYryrTlLpuvgI9GiijltAjNbcqA==", - "dev": true, "license": "MIT", "dependencies": { "ms": "^2.1.3" @@ -5399,6 +5432,24 @@ "node": ">=16.0.0" } }, + "node_modules/file-type": { + "version": "22.0.1", + "resolved": "https://registry.npmjs.org/file-type/-/file-type-22.0.1.tgz", + "integrity": "sha512-ww5Mhre0EE+jmBvOXTmXAbEMuZE7uX4a3+oRCQFNj8w++g3ev913N6tXQz0XTXbueQ5TWQfm6BdaViEHHn8bhA==", + "license": "MIT", + "dependencies": { + "@tokenizer/inflate": "^0.4.1", + "strtok3": "^10.3.5", + "token-types": "^6.1.2", + "uint8array-extras": "^1.5.0" + }, + "engines": { + "node": ">=22" + }, + "funding": { + "url": "https://github.com/sindresorhus/file-type?sponsor=1" + } + }, "node_modules/fill-range": { "version": "7.1.1", "resolved": "https://registry.npmjs.org/fill-range/-/fill-range-7.1.1.tgz", @@ -5827,6 +5878,26 @@ "integrity": "sha512-LtwtVyVYO5BqRvcsKuB2iUMnHwPVByPCXFXOpuU96IZPPoPN6xjOGxZQ74pgSVVLQWtUOYgyeL4GE98BY5D3wg==", "license": "ISC" }, + "node_modules/ieee754": { + "version": "1.2.1", + "resolved": "https://registry.npmjs.org/ieee754/-/ieee754-1.2.1.tgz", + "integrity": "sha512-dcyqhDvX1C46lXZcVqCpK+FtMRQVdIMN6/Df5js2zouUsqG7I6sFxitIC+7KYK29KdXOLHdu9zL4sFnoVQnqaA==", + "funding": [ + { + "type": "github", + "url": "https://github.com/sponsors/feross" + }, + { + "type": "patreon", + "url": "https://www.patreon.com/feross" + }, + { + "type": "consulting", + "url": "https://feross.org/support" + } + ], + "license": "BSD-3-Clause" + }, "node_modules/ignore": { "version": "5.3.2", "resolved": "https://registry.npmjs.org/ignore/-/ignore-5.3.2.tgz", @@ -6998,7 +7069,6 @@ "version": "2.1.3", "resolved": "https://registry.npmjs.org/ms/-/ms-2.1.3.tgz", "integrity": "sha512-6FlzubTLZG3J2a/NVCAleEhjzq5oxgHyaCU9yYXvcLsvoVaHJq/s5xXI6/XXP6tz7R9xAOtHnSO/tXtF3WRTlA==", - "dev": true, "license": "MIT" }, "node_modules/nanoid": { @@ -8453,6 +8523,22 @@ "url": "https://github.com/sponsors/sindresorhus" } }, + "node_modules/strtok3": { + "version": "10.3.5", + "resolved": "https://registry.npmjs.org/strtok3/-/strtok3-10.3.5.tgz", + "integrity": "sha512-ki4hZQfh5rX0QDLLkOCj+h+CVNkqmp/CMf8v8kZpkNVK6jGQooMytqzLZYUVYIZcFZ6yDB70EfD8POcFXiF5oA==", + "license": "MIT", + "dependencies": { + "@tokenizer/token": "^0.3.0" + }, + "engines": { + "node": ">=18" + }, + "funding": { + "type": "github", + "url": "https://github.com/sponsors/Borewit" + } + }, "node_modules/styled-jsx": { "version": "5.1.6", "resolved": "https://registry.npmjs.org/styled-jsx/-/styled-jsx-5.1.6.tgz", @@ -8638,6 +8724,24 @@ "node": ">=8.0" } }, + "node_modules/token-types": { + "version": "6.1.2", + "resolved": "https://registry.npmjs.org/token-types/-/token-types-6.1.2.tgz", + "integrity": "sha512-dRXchy+C0IgK8WPC6xvCHFRIWYUbqqdEIKPaKo/AcTUNzwLTK6AH7RjdLWsEZcAN/TBdtfUw3PYEgPr5VPr6ww==", + "license": "MIT", + "dependencies": { + "@borewit/text-codec": "^0.2.1", + "@tokenizer/token": "^0.3.0", + "ieee754": "^1.2.1" + }, + "engines": { + "node": ">=14.16" + }, + "funding": { + "type": "github", + "url": "https://github.com/sponsors/Borewit" + } + }, "node_modules/tough-cookie": { "version": "6.0.2", "resolved": "https://registry.npmjs.org/tough-cookie/-/tough-cookie-6.0.2.tgz", @@ -8863,6 +8967,18 @@ "typescript": ">=4.8.4 <6.1.0" } }, + "node_modules/uint8array-extras": { + "version": "1.5.0", + "resolved": "https://registry.npmjs.org/uint8array-extras/-/uint8array-extras-1.5.0.tgz", + "integrity": "sha512-rvKSBiC5zqCCiDZ9kAOszZcDvdAHwwIKJG33Ykj43OKcWsnmcBRL09YTU4nOeHZ8Y2a7l1MgTd08SBe9A8Qj6A==", + "license": "MIT", + "engines": { + "node": ">=18" + }, + "funding": { + "url": "https://github.com/sponsors/sindresorhus" + } + }, "node_modules/unbox-primitive": { "version": "1.1.0", "resolved": "https://registry.npmjs.org/unbox-primitive/-/unbox-primitive-1.1.0.tgz", diff --git a/package.json b/package.json index d6983e0..3905669 100644 --- a/package.json +++ b/package.json @@ -15,6 +15,7 @@ "@anthropic-ai/sdk": "^0.111.0", "@supabase/ssr": "^0.12.0", "@supabase/supabase-js": "^2.110.2", + "file-type": "^22.0.1", "idb": "^8.0.3", "next": "^15.5.20", "openai": "^6.46.0", diff --git a/tests/lib/supabase/storage.test.ts b/tests/lib/supabase/storage.test.ts index d4e9cc5..b5ade2a 100644 --- a/tests/lib/supabase/storage.test.ts +++ b/tests/lib/supabase/storage.test.ts @@ -1,6 +1,10 @@ import { describe, it, expect, vi, beforeEach } from 'vitest' import { uploadEvidenceFile, getEvidenceUrl } from '@/lib/supabase/storage' +vi.mock('file-type', () => ({ + fileTypeFromBuffer: vi.fn().mockResolvedValue({ mime: 'image/jpeg', ext: 'jpg' }), +})) + const mockUpload = vi.fn() const mockCreateSignedUrl = vi.fn() const mockSupabase = { @@ -26,7 +30,7 @@ describe('uploadEvidenceFile', () => { expect(mockSupabase.storage.from).toHaveBeenCalledWith('evidence') expect(mockUpload).toHaveBeenCalledWith( expect.stringContaining('user-123/incident-abc/report/'), - file, + expect.any(ArrayBuffer), expect.objectContaining({ contentType: 'image/jpeg', upsert: false }) ) expect(mockCreateSignedUrl).toHaveBeenCalledWith(expect.stringContaining('user-123/incident-abc/report/'), 315360000)