CommunityRule/community-rule
2
0
Fork 0
Code Issues 1 Pull Requests Actions Packages Projects Releases Wiki Activity

Restore the community photo after reload and reject empty, oversized, SVG, and spoofed uploads.

Browse Source 
Co-authored-by: Cursor <cursoragent@cursor.com>
This commit is contained in:
adilallo
2026-09-10 15:50:32 -06:00
co-authored by Cursor
parent 6ccc1e8c8e
commit 234f3998ad
18 changed files with 1072 additions and 112 deletions
Download Patch File Download Diff File Expand all files Collapse all files
lib/server/uploads/uploadConstants.ts
+2 -31
View File
@@ -1,39 +1,10 @@
import type { CreateFlowUploadPurpose } from "../../create/createFlowUploadPurpose";
export type { CreateFlowUploadPurpose };
export type { CreateFlowUploadPurpose } from "../../create/createFlowUploadPurpose";
export { CREATE_FLOW_UPLOAD_PURPOSES } from "../../create/createFlowUploadPurpose";
export { maxBytesForPurpose } from "../../create/createFlowUploadValidation";
/** Max body size for multipart upload (bytes). */
export const CREATE_FLOW_UPLOAD_MAX_BYTES = 12 * 1024 * 1024;
const COMMUNITY_MAX = 5 * 1024 * 1024;
const CUSTOM_MAX = 10 * 1024 * 1024;
const IMAGE_MIMES = new Set([
"image/jpeg",
"image/png",
"image/webp",
"image/gif",
]);
const CUSTOM_EXTRA_MIMES = new Set(["application/pdf"]);
export function maxBytesForPurpose(purpose: CreateFlowUploadPurpose): number {
return purpose === "communityAvatar" ? COMMUNITY_MAX : CUSTOM_MAX;
}
export function isAllowedMime(
purpose: CreateFlowUploadPurpose,
mime: string,
): boolean {
const m = mime.toLowerCase().split(";")[0]?.trim() ?? "";
if (IMAGE_MIMES.has(m)) return true;
if (purpose === "customMethodAttachment" && CUSTOM_EXTRA_MIMES.has(m)) {
return true;
}
return false;
}
/** Extension including dot, from normalized mime (lowercase). */
export function extensionForMime(mime: string): string {
const m = mime.toLowerCase().split(";")[0]?.trim() ?? "";