Check metadata of uploaded files

library/agent/Context.ts

@@ -27,6 +27,7 @@ export type Context = {
   rawBody?: unknown;
   subdomains?: string[]; // https://expressjs.com/en/5x/api.html#req.subdomains
   markUnsafe?: unknown[];
+  files?: unknown; // Multipart file metadata
   cache?: ReturnType<typeof extractStringsFromUserInput>;
   cachePathTraversal?: ReturnType<typeof extractStringsFromUserInput>;
   /**
@@ -97,6 +98,7 @@ export function runWithContext<T>(context: Context, fn: () => T) {
     current.subdomains = context.subdomains;
     current.outgoingRequestRedirects = context.outgoingRequestRedirects;
     current.markUnsafe = context.markUnsafe;
+    current.files = context.files;
 
     // Clear all the cached user input strings
     delete current.cache;

library/agent/Source.ts

@@ -10,6 +10,7 @@ export const SOURCES = [
   "markUnsafe",
   "url",
   "rawBody",
+  "files",
 ] as const;
 
 export type Source = (typeof SOURCES)[number];

library/helpers/getSourceForUserString.test.ts

@@ -38,3 +38,77 @@ t.test(
     );
   }
 );
+
+t.test(
+  "it returns 'files' source when the user string is in multipart file metadata",
+  async () => {
+    const context = createContext();
+    context.files = [
+      {
+        fieldname: "document",
+        originalname: "' OR '1'='1",
+        encoding: "7bit",
+        mimetype: "application/pdf",
+      },
+    ];
+    t.same(getSourceForUserString(context, "' OR '1'='1"), "files");
+  }
+);
+
+t.test(
+  "it returns 'files' source when the user string is in the filename of the second file",
+  async () => {
+    const context = createContext();
+    context.files = [
+      {
+        fieldname: "photo",
+        filename: "benign.jpg",
+        encoding: "7bit",
+        mimeType: "image/jpeg",
+      },
+      {
+        fieldname: "attachment",
+        filename: "../../etc/passwd",
+        encoding: "7bit",
+        mimeType: "text/plain",
+      },
+    ];
+    t.same(getSourceForUserString(context, "../../etc/passwd"), "files");
+  }
+);
+
+t.test(
+  "it returns 'files' source when the user string matches a mimeType field",
+  async () => {
+    const context = createContext();
+    context.files = [
+      {
+        fieldname: "upload",
+        filename: "safe.txt",
+        encoding: "7bit",
+        mimeType: "'; DROP TABLE users; --",
+      },
+    ];
+    t.same(getSourceForUserString(context, "'; DROP TABLE users; --"), "files");
+  }
+);
+
+t.test("it returns undefined when files array is empty", async () => {
+  const context = createContext();
+  context.files = [];
+  t.same(getSourceForUserString(context, "anything"), undefined);
+});
+
+t.test(
+  "it returns 'files' source when files is a single object (req.file style)",
+  async () => {
+    const context = createContext();
+    context.files = {
+      fieldname: "avatar",
+      originalname: "; rm -rf /",
+      encoding: "7bit",
+      mimetype: "image/png",
+    };
+    t.same(getSourceForUserString(context, "; rm -rf /"), "files");
+  }
+);

library/package.json

@@ -73,8 +73,6 @@
     "@koa/router-v11": "npm:@koa/router@^11.0.0",
     "@koa/router-v12": "npm:@koa/router@^12.0.0",
     "@koa/router-v13": "npm:@koa/router@^13.0.0",
-    "mistralai-v1": "npm:@mistralai/mistralai@^1.11.0",
-    "mistralai-v2": "npm:@mistralai/mistralai@^2.1.2",
     "@prisma/client": "^5.22.0",
     "@sinonjs/fake-timers": "^11.2.2",
     "@types/aws-lambda": "^8.10.131",
@@ -118,11 +116,14 @@
     "koa-v3": "npm:koa@^3.0.0",
     "mariadb-v3.4": "npm:mariadb@3.4.4",
     "mariadb-v3.5": "npm:mariadb@^3.5.1",
+    "mistralai-v1": "npm:@mistralai/mistralai@^1.11.0",
+    "mistralai-v2": "npm:@mistralai/mistralai@^2.1.2",
     "mongodb": "^6.16.0",
     "mongodb-v4": "npm:mongodb@^4.0.0",
     "mongodb-v5": "npm:mongodb@^5.0.0",
     "mongodb-v6": "npm:mongodb@^6.0.0",
     "mongodb-v7": "npm:mongodb@^7.0.0",
+    "multer": "^2.1.1",
     "mysql": "^2.18.1",
     "mysql2-v3.10": "npm:mysql2@3.10",
     "mysql2-v3.12": "npm:mysql2@3.12",