fix: normalize MIME type to lowercase before upload validation#7147
fix: normalize MIME type to lowercase before upload validation#7147deepak0x wants to merge 2 commits intoRocketChat:developfrom
Conversation
On devices with Turkish locale, string casing behaves differently — 'I'.toLowerCase() returns 'ı' instead of 'i'. MIME types returned by the OS can have unexpected casing, which breaks the allowlist check in canUploadFile and blocks valid file uploads.
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (1)
🚧 Files skipped from review as they are similar to previous changes (1)
Walkthrough
Changes
Estimated code review effort🎯 1 (Trivial) | ⏱️ ~3 minutes Suggested labels
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@app/lib/methods/helpers/media.ts`:
- Around line 28-33: The code dangerously uses file.mime! without a runtime
guard; normalize the MIME once into a local variable (e.g., const normalizedMime
= file.mime?.toLowerCase().trim()) and use that for all checks in the helper
(replace the non-null assertion in the allowedMime includes check and the
wildCards comparison), early-return failure if normalizedMime is falsy, compute
wildCards from allowedMime as before and compare using
normalizedMime.replace(/(\/.*)$/, wildCardGlob) for the wildcard match; update
the logic in the helper so both the direct includes and wildcard check use
normalizedMime and never dereference file.mime directly.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: aa1356ad-a246-4e82-99d3-94d557efbef8
📒 Files selected for processing (1)
app/lib/methods/helpers/media.ts
📜 Review details
🧰 Additional context used
📓 Path-based instructions (4)
**/*.{js,jsx,ts,tsx,json}
📄 CodeRabbit inference engine (CLAUDE.md)
Configure Prettier with tabs, single quotes, 130 character width, no trailing commas, arrow parens avoid, and bracket same line
Files:
app/lib/methods/helpers/media.ts
**/*.{js,jsx,ts,tsx}
📄 CodeRabbit inference engine (CLAUDE.md)
Use ESLint with
@rocket.chat/eslint-configbase configuration including React, React Native, TypeScript, and Jest plugins
Files:
app/lib/methods/helpers/media.ts
**/*.{ts,tsx}
📄 CodeRabbit inference engine (CLAUDE.md)
Use TypeScript with strict mode enabled and configure baseUrl to app/ for import resolution
**/*.{ts,tsx}: Use TypeScript for type safety; add explicit type annotations to function parameters and return types
Prefer interfaces over type aliases for defining object shapes in TypeScript
Use enums for sets of related constants rather than magic strings or numbers
Files:
app/lib/methods/helpers/media.ts
**/*.{js,ts,jsx,tsx}
📄 CodeRabbit inference engine (AGENTS.md)
**/*.{js,ts,jsx,tsx}: Use descriptive names for functions, variables, and classes that clearly convey their purpose
Write comments that explain the 'why' behind code decisions, not the 'what'
Keep functions small and focused on a single responsibility
Use const by default, let when reassignment is needed, and avoid var
Prefer async/await over .then() chains for handling asynchronous operations
Use explicit error handling with try/catch blocks for async operations
Avoid deeply nested code; refactor complex logic into helper functions
Files:
app/lib/methods/helpers/media.ts
Extracted file.mime?.toLowerCase() into a normalizedMime variable to avoid the unsafe non-null assertion on the optional mime property and reuse the normalized value for both the exact and wildcard checks.
1 participant
File uploads fail when the phone language is set to Turkish. The root cause is the Turkish 'I' problem — in Turkish locale,
'I'.toLowerCase()returns'ı'(dotless i) instead of'i', and MIME types returned by the OS can have unexpected casing. ThecanUploadFilefunction inmedia.tscompares MIME types case-sensitively against the server's allowlist, so a MIME type like'IMAGE/JPEG'won't match'image/jpeg'and the upload gets rejected as an invalid file type.Added
.toLowerCase()on the file's MIME type before both the exact match and wildcard match comparisons.Issue(s)
Closes #3040
How to test or reproduce
Screenshots
N/A — validation logic change, no UI impact.
Types of changes
Checklist
Summary by CodeRabbit