OpenSource/misskey
OpenSource/misskey
1
0
Fork 0
mirror of https://github.com/misskey-dev/misskey.git synced 2025-01-01 04:56:19 +01:00
Code Issues Projects Releases Packages Wiki Activity

add mimetype check

Browse source
This commit is contained in:
samunohito 2024-02-03 18:51:01 +09:00
parent 9bb1e79c83
commit c88c8af8d9
2 changed files with 19 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

12
packages/backend/src/const.ts
View file

@ -24,6 +24,18 @@ export const DB_MAX_NOTE_TEXT_LENGTH = 8192;
export const DB_MAX_IMAGE_COMMENT_LENGTH = 512; export const DB_MAX_IMAGE_COMMENT_LENGTH = 512;
//#endregion //#endregion
export const FILE_TYPE_IMAGE = [
'image/png',
'image/gif',
'image/jpeg',
'image/webp',
'image/avif',
'image/apng',
'image/bmp',
'image/tiff',
'image/x-icon',
];
// ブラウザで直接表示することを許可するファイルの種類のリスト // ブラウザで直接表示することを許可するファイルの種類のリスト
// ここに含まれないものは application/octet-stream としてレスポンスされる // ここに含まれないものは application/octet-stream としてレスポンスされる
// SVGはXSSを生むので許可しない // SVGはXSSを生むので許可しない

7
packages/backend/src/server/api/endpoints/admin/emoji/add.ts
View file

@ -9,6 +9,7 @@ import type { DriveFilesRepository } from '@/models/_.js';
import { DI } from '@/di-symbols.js'; import { DI } from '@/di-symbols.js';
import { CustomEmojiService } from '@/core/CustomEmojiService.js'; import { CustomEmojiService } from '@/core/CustomEmojiService.js';
import { EmojiEntityService } from '@/core/entities/EmojiEntityService.js'; import { EmojiEntityService } from '@/core/entities/EmojiEntityService.js';
import { FILE_TYPE_IMAGE } from '@/const.js';
import { ApiError } from '../../../error.js'; import { ApiError } from '../../../error.js';
export const meta = { export const meta = {
@ -24,6 +25,11 @@ export const meta = {
code: 'NO_SUCH_FILE', code: 'NO_SUCH_FILE',
id: 'fc46b5a4-6b92-4c33-ac66-b806659bb5cf', id: 'fc46b5a4-6b92-4c33-ac66-b806659bb5cf',
}, },
notSupportFileType: {
message: 'Not support file type.',
code: 'NOT_SUPPORT_FILE_TYPE',
id: 'f7599d96-8750-af68-1633-9575d625c1a7',
},
duplicateName: { duplicateName: {
message: 'Duplicate name.', message: 'Duplicate name.',
code: 'DUPLICATE_NAME', code: 'DUPLICATE_NAME',
@ -78,6 +84,7 @@ export default class extends Endpoint<typeof meta, typeof paramDef> { // eslint-
if (driveFile == null) throw new ApiError(meta.errors.noSuchFile); if (driveFile == null) throw new ApiError(meta.errors.noSuchFile);
const isDuplicate = await this.customEmojiService.checkDuplicate(ps.name); const isDuplicate = await this.customEmojiService.checkDuplicate(ps.name);
if (isDuplicate) throw new ApiError(meta.errors.duplicateName); if (isDuplicate) throw new ApiError(meta.errors.duplicateName);
if (!FILE_TYPE_IMAGE.includes(driveFile.type)) throw new ApiError(meta.errors.notSupportFileType);
const emoji = await this.customEmojiService.add({ const emoji = await this.customEmojiService.add({
driveFile, driveFile,