MIME type set by client ignored

[paulchen]

Description:

When using the rooms.upload endpoint, the MIME type sent along is ignored. Instead, the server will guess the MIME type based on the filename.

Steps to reproduce:

1. Obtain the rid for a channel and the authToken and the userId for a logged-in user.
2. Download this file and rename it to pinksquare (without the .png extension): https://github.com/RocketChat/Rocket.Chat/assets/404840/08a10e00-a0ff-4204-a8e2-9b8c75ae615d
3. Run this cURL snippet (with <host>, <rid>, <userId>, <authToken> replaced by the actual values):

curl --request POST \
  --url https://<host>/api/v1/rooms.upload/<rid> \
  --header 'accept: application/json' \
  --header 'content-type: multipart/form-data' \
  --header 'x-user-id: <userId>' \
  --header 'x-auth-token: <authToken>' \
  -F "file=@pinksquare;type=image/png"

Expected behavior:

The file is stored with the MIME type image/png.

Actual behavior:

The file is stored with the MIME type application/octet-stream and therefore not treated as an image.

JSON response by the endpoint:

{
	"message": {
		"_id": "<id>",
		"rid": "<rid>",
		"ts": "2024-07-10T15:39:40.394Z",
		"msg": "",
		"file": {
			"_id": "668eab3cc93d62f6f83b7662",
			"name": "pinksquare",
			"type": "application/octet-stream",
			"size": 519,
			"format": ""
		},
		"files": [
			{
				"_id": "668eab3cc93d62f6f83b7662",
				"name": "pinksquare",
				"type": "application/octet-stream",
				"size": 519,
				"format": ""
			}
		],
		"attachments": [
			{
				"ts": "1970-01-01T00:00:00.000Z",
				"title": "pinksquare",
				"title_link": "/file-upload/668eab3cc93d62f6f83b7662/pinksquare",
				"title_link_download": true,
				"type": "file",
				"format": "file",
				"size": 519
			}
		],
		"u": {
			"_id": "<id>",
			"username": "<username>",
			"name": "<name>"
		},
		"_updatedAt": "2024-07-10T15:39:40.450Z",
		"urls": []
	},
	"success": true
}

Server Setup Information:

• Version of Rocket.Chat Server: 6.10.0
• License Type: Starter
• Number of Users: 21 (why is this relevant?)
• Deployment Method: Docker
• Number of Running Instances: 1
• MongoDB Version: 6.0.16 / wiredTiger (oplog Disabled)

Client Setup Information

Any client that wants the MIME type to be stored on the server.

Additional context

This problem was introduced by #32471. At apps/meteor/app/api/server/lib/getUploadFormData.ts:86, the MIME sent by the client is discarded.

When using the filename pinksquare.png, the MIME type is determined correctly based on the extension .png:

curl --request POST \
  --url https://<host>/api/v1/rooms.upload/<rid> \
  --header 'accept: application/json' \
  --header 'content-type: multipart/form-data' \
  --header 'x-user-id: <userId>' \
  --header 'x-auth-token: <authToken>' \
  -F "[email protected];type=image/png"

{
	"message": {
		"_id": "<id>",
		"rid": "<rid>",
		"ts": "2024-07-10T15:40:34.266Z",
		"msg": "",
		"file": {
			"_id": "668eab71c93d62f6f83b7663",
			"name": "pinksquare.png",
			"type": "image/png",
			"size": 519,
			"format": "png"
		},
		"files": [
			{
				"_id": "668eab71c93d62f6f83b7663",
				"name": "pinksquare.png",
				"type": "image/png",
				"size": 519,
				"format": "png"
			}
		],
		"attachments": [
			{
				"ts": "1970-01-01T00:00:00.000Z",
				"title": "pinksquare.png",
				"title_link": "/file-upload/668eab71c93d62f6f83b7663/pinksquare.png",
				"title_link_download": true,
				"image_dimensions": {
					"width": 1,
					"height": 1
				},
				"image_preview": "/9j/2wBDAAYEBQYFBAYGBQYHBwYIChAKCgkJChQODwwQFxQYGBcUFhYaHSUfGhsjHBYWICwgIyYnKSopGR8tMC0oMCUoKSj/2wBDAQcHBwoIChMKChMoGhYaKCgoKCgoKCgoKCgoKCgoKCgoKCgoKCgoKCgoKCgoKCgoKCgoKCgoKCgoKCgoKCgoKCj/wAARCAAgACADASIAAhEBAxEB/8QAFQABAQAAAAAAAAAAAAAAAAAAAAX/xAAUEAEAAAAAAAAAAAAAAAAAAAAA/8QAFQEBAQAAAAAAAAAAAAAAAAAAAAf/xAAUEQEAAAAAAAAAAAAAAAAAAAAA/9oADAMBAAIRAxEAPwCAAsC9AAAAAAP/2Q==",
				"image_url": "/file-upload/668eab71c93d62f6f83b7663/pinksquare.png",
				"image_type": "image/png",
				"image_size": 519,
				"type": "file"
			}
		],
		"u": {
			"_id": "<id>",
			"username": "<username>",
			"name": "<name>"
		},
		"_updatedAt": "2024-07-10T15:40:34.661Z",
		"urls": []
	},
	"success": true
}

[reetp]

Thanks for the report.

I'll ask someone to take a look.