Skip to content

fix(client): validate file extension whitelist on rename - #4175

Merged
khanniie merged 2 commits into
processing:developfrom
Dakshx07:fix/file-rename-bypass
Oct 16, 2026
Merged

khanniie merged 2 commits into
processing:developfrom
Dakshx07:fix/file-rename-bypass

Conversation

@Dakshx07

Copy link
Copy Markdown
Contributor

Issue:

Fixes #4102

Currently, the p5.js Web Editor blocks invalid file extensions (such as .obj) during file creation via the file modal. However, it does not perform the same validation when renaming a file. This allows users to bypass the file extension whitelist entirely by creating a valid file (e.g., test.js) and then renaming it to an invalid extension (e.g., test.obj).

This PR fixes the bypass by validating file extensions against the whitelist during the rename operation.

Demo:

(No complex UI layout modifications—it triggers the pre-existing toast error message when an invalid extension is supplied during rename, identical to the behavior in the file creation modal, and reverts the file to its previous valid name).

Changes:

  • FileNode.jsx:
    • Imported CREATE_FILE_REGEX (from server/utils/fileUtils.js) and showToast (mapped as showToastAction to resolve ESLint no-shadow rules).
    • Destructured showToast in component props and declared it in propTypes.
    • Updated the validateFileName method to check that renaming a file matches CREATE_FILE_REGEX.
    • If the validation fails, it triggers showToast with the translation key NewFileModal.InvalidType and reverts the filename.
  • FileNode.unit.test.jsx:
    • Mocked the showToast prop in the test setup.
    • Adjusted unit tests to use valid whitelisted extensions (.js and .json) for renaming scenarios.
    • Added a new unit test case cannot change to an invalid extension to verify that invalid renames are blocked and trigger showToast.

I have verified that this pull request:

  • has no linting errors (npm run lint)
  • has no test errors (npm run test)
  • has no typecheck errors (npm run typecheck)
  • is from a uniquely-named feature branch and is up to date with the develop branch.
  • is descriptively named and links to an issue number, i.e. Fixes #4102
  • meets the standards outlined in the accessibility guidelines

@ksen0
ksen0 requested a review from khanniie October 16, 2026 15:23

@khanniie khanniie left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM! thank you so much!

@khanniie
khanniie merged commit c0d874d into processing:develop Oct 16, 2026
1 of 2 checks passed

This branch is waiting to be deployed

1 waiting deployment
e2e-tests — 438d56fd Waiting Oct 16, 2026 by khanniie via test-e2e #367
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

File Type Restriction Bypass via Rename

2 participants