fix(uploads): avoid merged map allocation, sanitize config extensions, add bin fallback test

Author: PierreBrisorgueil

modules/uploads/services/uploads.service.js

@@ -94,7 +94,8 @@ const createFromBuffer = async (buffer, contentType, kind, metadata = {}) => {
     throw new AppError(`Upload: buffer size ${buffer.length} exceeds limit ${kindConfig.limits.fileSize}`, { code: 'SERVICE_ERROR', status: 422 });
   }
 
-  const ext = { ...MIME_TO_EXT, ...(config.uploads?.mimeTypes ?? {}) }[contentType] || 'bin';
+  const rawExt = config.uploads?.mimeTypes?.[contentType] || MIME_TO_EXT[contentType];
+  const ext = rawExt && /^[a-zA-Z0-9]+$/.test(rawExt) ? rawExt : 'bin';
   const filename = `${crypto.randomBytes(32).toString('hex')}.${ext}`;
 
   const result = await gridfs.createFromBuffer(buffer, filename, contentType, { ...metadata, kind, contentType });

modules/uploads/tests/uploads.createFromBuffer.unit.tests.js

@@ -185,4 +185,35 @@ describe('Uploads createFromBuffer unit tests:', () => {
 
     expect(mockGridfs.createFromBuffer).not.toHaveBeenCalled();
   });
+
+  test('should fallback to bin extension for unmapped MIME types', async () => {
+    mockConfig.uploads.generic = {
+      kind: 'generic',
+      formats: ['application/octet-stream'],
+      limits: { fileSize: 1 * 1024 * 1024 },
+    };
+    mockGridfs.createFromBuffer.mockResolvedValue({ ...fakeFile, contentType: 'application/octet-stream' });
+
+    const buffer = Buffer.alloc(512);
+    await UploadsService.createFromBuffer(buffer, 'application/octet-stream', 'generic');
+
+    const [, filename] = mockGridfs.createFromBuffer.mock.calls[0];
+    expect(filename).toMatch(/^[a-f0-9]{64}\.bin$/);
+  });
+
+  test('should fallback to bin extension when config extension contains invalid characters', async () => {
+    mockConfig.uploads.mimeTypes = { 'application/x-tar': 'tar.gz' };
+    mockConfig.uploads.archive = {
+      kind: 'archive',
+      formats: ['application/x-tar'],
+      limits: { fileSize: 10 * 1024 * 1024 },
+    };
+    mockGridfs.createFromBuffer.mockResolvedValue({ ...fakeFile, contentType: 'application/x-tar' });
+
+    const buffer = Buffer.alloc(512);
+    await UploadsService.createFromBuffer(buffer, 'application/x-tar', 'archive');
+
+    const [, filename] = mockGridfs.createFromBuffer.mock.calls[0];
+    expect(filename).toMatch(/^[a-f0-9]{64}\.bin$/);
+  });
 });