UIFC-262 Add 50 MB file upload size limit to prevent DoS attacks - #349
Merged
Conversation
- Implement client-side file size validation (reject > 50 MB before upload) - Refactor handleDrop to async/await for proper error propagation - Add helper functions: createFileSizeErrorMessage, handlePayloadTooLargeError - Sanitize backend error messages (reject HTML tags, >200 chars) to prevent XSS - Handle HTTP 413 with fallback for malformed responses - Fix validation error timing (show only after touch/submit, not immediately) - Extract HTTP_STATUS_PAYLOAD_TOO_LARGE constant - Add translations: fileTooLarge, backendRejected, network - Update CHANGELOG
slaemmer
marked this pull request as draft
December 1, 2025 07:08
slaemmer
marked this pull request as ready for review
December 1, 2025 07:58
slaemmer
force-pushed
the
UIFC-262-limit-file-upload-size
branch
from
December 1, 2025 13:33
29e990e to
f58db5f
Compare
- Add component tests for FileUploaderField
- Fix ReDoS vulnerability: replace /<[^>]*>/ regex with simple string checks for HTML tag detection (backendMessage.includes('<') && includes('>'))
- Fix Sonar warnings
slaemmer
force-pushed
the
UIFC-262-limit-file-upload-size
branch
from
December 1, 2025 13:48
f58db5f to
58f385a
Compare
Contributor
|
Thanks @slaemmer , looking good! Having general questions:
|
Contributor
Author
|
Thanks!
|
elsenhans
requested changes
Dec 11, 2025
elsenhans
left a comment
elsenhans
left a comment
Contributor
There was a problem hiding this comment.
Seems like input.value has the wrong PropType:
value: PropTypes.string
Could you please change it to object?
elsenhans
reviewed
Dec 11, 2025
elsenhans
reviewed
Dec 11, 2025
elsenhans
reviewed
Dec 11, 2025
elsenhans
reviewed
Dec 11, 2025
elsenhans
reviewed
Dec 11, 2025
alb3rtino
reviewed
Dec 11, 2025
elsenhans
reviewed
Dec 11, 2025
elsenhans
left a comment
elsenhans
left a comment
Contributor
There was a problem hiding this comment.
Seems like input.value has the wrong PropType:
value: PropTypes.string
Could you please change it to object?
Contributor
Author
Good catch! Apparently it can be either string or object in code. Changed propTypes to reflect that. As this is less than ideal though, I created a bug ticket for this. |
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
https://folio-org.atlassian.net/browse/UIFC-262