[ADVAPP-2293]: Fix security issue with unauthorised file copying from anywhere on S3 to a form submission (#2208)

* add s3 file upload validation

* Update code formatting and copyright headers

* add validations in controller

---------

Co-authored-by: jayushi-canyon <170343024+jayushi-canyon@users.noreply.github.com>

Author: jayushi-canyon

app-modules/form/src/Actions/GenerateSubmissibleValidation.php

@@ -89,6 +89,20 @@ public function fields(array $blocks, Collection $fields): array
                     $field->getKey() => $rules->merge($blockRules)->all(),
                 ];
 
+                // Security: Add file upload path validation for upload fields
+                if ($field->type === 'upload' || $field->type === 'educatable-upload') {
+                    $nestedRules['*.path'] = [
+                        'required_with:' . $field->getKey(),
+                        'string',
+                        'regex:/^tmp\/[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}\.[a-zA-Z0-9]+$/i',
+                    ];
+                    $nestedRules['*.originalFileName'] = [
+                        'required_with:' . $field->getKey(),
+                        'string',
+                        'max:255',
+                    ];
+                }
+
                 foreach ($nestedRules as $nestedKey => $nestedRule) {
                     $result[$field->getKey() . '.' . $nestedKey] = $nestedRule;
                 }

app-modules/form/src/Actions/ProcessSubmissionField.php

@@ -58,6 +58,7 @@
 use App\Settings\ImportSettings;
 use Illuminate\Support\Facades\Storage;
 use Illuminate\Support\Str;
+use InvalidArgumentException;
 use libphonenumber\NumberParseException;
 use libphonenumber\PhoneNumberFormat;
 use libphonenumber\PhoneNumberUtil;
@@ -84,20 +85,28 @@ public function __invoke(Submission $submission, string $fieldId, mixed $respons
 
             foreach ($response as $file) {
                 $key = ltrim($file['path'], '/');
-
-                $media = $fieldSubmission
-                    ->addMediaFromDisk($key, 's3')
-                    ->usingFileName($file['originalFileName'] ?? basename($key))
-                    ->toMediaCollection('files', 's3');
-
-                Storage::disk('s3')->delete($key);
-                $fieldSubmission->update([
-                    'response' => [
-                        'media_id' => $media->id,
-                        'file_name' => $media->file_name,
-                        'original_name' => $file['originalFileName'] ?? $media->file_name,
-                    ],
-                ]);
+                $this->validatePath($key);
+
+                if (! Storage::exists($key)) {
+                    continue;
+                }
+
+                try {
+                    $media = $fieldSubmission
+                        ->addMediaFromDisk($key, 's3')
+                        ->usingFileName($file['originalFileName'] ?? basename($key))
+                        ->toMediaCollection('files', 's3');
+
+                    $fieldSubmission->update([
+                        'response' => [
+                            'media_id' => $media->id,
+                            'file_name' => $media->file_name,
+                            'original_name' => $file['originalFileName'] ?? $media->file_name,
+                        ],
+                    ]);
+                } finally {
+                    Storage::disk('s3')->delete($key);
+                }
             }
         }
 
@@ -126,6 +135,21 @@ public function __invoke(Submission $submission, string $fieldId, mixed $respons
         }
     }
 
+    protected function validatePath(string $path): void
+    {
+        if (str_contains($path, '..') || str_contains($path, '//')) {
+            throw new InvalidArgumentException('Invalid path: path traversal not allowed');
+        }
+
+        if (! str_starts_with($path, 'tmp/')) {
+            throw new InvalidArgumentException('Invalid path: must be within tmp/ directory');
+        }
+
+        if (! preg_match('/^tmp\/[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}\.[a-zA-Z0-9]+$/i', $path)) {
+            throw new InvalidArgumentException('Invalid path: does not match expected format');
+        }
+    }
+
     protected function handleEducatableEmailField(Submission $submission, mixed $response): void
     {
         $submissible = $submission->submissible;