Skip to content

fix: avoid to get files with other extensions than the proper ones for custom-sounds and emoji-custom endpoints #38531

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
nazabucciarelli wants to merge 6 commits into
base: develop
Choose a base branch
from
+13 −6
Draft

fix: avoid to get files with other extensions than the proper ones for custom-sounds and emoji-custom endpoints #38531

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
a9c85f8
avoid getting other files than images from emoji-custom endpoint
nazabucciarelli Feb 6, 2026
854ceb9
use contentType property to validate file fetching
nazabucciarelli Feb 7, 2026
08a694a
restore deno.lock
nazabucciarelli Feb 7, 2026
81954f6
remove undesired .only
nazabucciarelli Feb 9, 2026
a41d01c
add changeset
nazabucciarelli Feb 9, 2026
d9b8d60
Merge branch 'develop' into fix/sounds-emojis-get-files
nazabucciarelli Feb 9, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 5 additions & 0 deletions .changeset/clean-ears-fly.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,5 @@
---
'@rocket.chat/meteor': patch
---

Fixes a cross-resource access issue that allowed users to retrieve emojis from the Custom Sounds endpoint and sounds from the Custom Emojis endpoint when using the FileSystem storage mode.
3 changes: 2 additions & 1 deletion apps/meteor/app/custom-sounds/server/startup/custom-sounds.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -48,7 +48,8 @@ Meteor.startup(() => {
}

const file = await RocketChatFileCustomSoundsInstance.getFileWithReadStream(fileId);
if (!file) {

if (!file || !file.contentType?.startsWith('audio/')) {
res.writeHead(404);
res.write('Not found');
res.end();
Expand Down
11 changes: 6 additions & 5 deletions apps/meteor/app/emoji-custom/server/startup/emoji-custom.js
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,5 @@
import { Meteor } from 'meteor/meteor';
import { WebApp } from 'meteor/webapp';
import _ from 'underscore';

import { SystemLogger } from '../../../../server/lib/logger/system';
import { RocketChatFile } from '../../../file/server';
Expand Down Expand Up @@ -41,7 +40,9 @@ Meteor.startup(() => {
return WebApp.connectHandlers.use('/emoji-custom/', async (req, res /* , next*/) => {
const params = { emoji: decodeURIComponent(req.url.replace(/^\//, '').replace(/\?.*$/, '')) };

if (_.isEmpty(params.emoji)) {
const extension = params.emoji?.split('.').pop()?.toLowerCase() ?? '';

if (!extension) {
res.writeHead(403);
res.write('Forbidden');
res.end();
Expand All @@ -52,7 +53,7 @@ Meteor.startup(() => {

res.setHeader('Content-Disposition', 'inline');

if (!file) {
if (!file || !file.contentType?.startsWith('image/')) {
// use code from username initials renderer until file upload is complete
res.setHeader('Content-Type', 'image/svg+xml');
res.setHeader('Cache-Control', 'public, max-age=0');
Expand Down Expand Up @@ -97,9 +98,9 @@ Meteor.startup(() => {
res.setHeader('Last-Modified', fileUploadDate || new Date().toUTCString());
res.setHeader('Content-Length', file.length);

if (/^svg$/i.test(params.emoji.split('.').pop())) {
if (/^svg$/i.test(extension)) {
res.setHeader('Content-Type', 'image/svg+xml');
} else if (/^png$/i.test(params.emoji.split('.').pop())) {
} else if (/^png$/i.test(extension)) {
res.setHeader('Content-Type', 'image/png');
} else {
res.setHeader('Content-Type', 'image/jpeg');
Expand Down
Loading