MokoConsulting/MokoJoomOpenGraph
1
0
Fork 0
Code Issues 12 Pull Requests 1 Releases 3 Wiki Activity

CSV import missing file type and size validation #35

New Issue
Open
opened 2026-05-31 01:18:58 +00:00 by jmiller · 1 comment
jmiller commented 2026-05-31 01:18:58 +00:00
Owner
Copy Link
Copy Source

Problem

ImportExportController::import() accepts file uploads without validating:

  1. MIME type - any file type is accepted, not just CSV
  2. File size - no maximum file size check
  3. File extension - no .csv extension check
  4. Content type whitelist - imported content_type values are not validated

Impact

  • Users could upload non-CSV files
  • Extremely large files could cause memory exhaustion
  • Arbitrary content_type values could pollute the database

Acceptance Criteria

  • Validate file extension is .csv
  • Validate MIME type is text/csv or text/plain
  • Enforce max file size (e.g., 2MB)
  • Validate content_type values against allowed list or pattern
  • Add error messages for each validation failure

File

  • src/packages/com_mokoog/src/Controller/ImportExportController.php:87-110
## Problem `ImportExportController::import()` accepts file uploads without validating: 1. **MIME type** - any file type is accepted, not just CSV 2. **File size** - no maximum file size check 3. **File extension** - no `.csv` extension check 4. **Content type whitelist** - imported `content_type` values are not validated ## Impact - Users could upload non-CSV files - Extremely large files could cause memory exhaustion - Arbitrary `content_type` values could pollute the database ## Acceptance Criteria - [ ] Validate file extension is `.csv` - [ ] Validate MIME type is `text/csv` or `text/plain` - [ ] Enforce max file size (e.g., 2MB) - [ ] Validate `content_type` values against allowed list or pattern - [ ] Add error messages for each validation failure ## File - `src/packages/com_mokoog/src/Controller/ImportExportController.php:87-110`
jmiller added the priority: mediumsecurityproduction-readiness labels 2026-05-31 01:18:58 +00:00
jmiller commented 2026-05-31 01:18:59 +00:00
Author
Owner
Copy Link
Copy Source

Branch created: feature/35-csv-import-missing-file-type-and-size-va

git fetch origin
git checkout feature/35-csv-import-missing-file-type-and-size-va
Branch created: [`feature/35-csv-import-missing-file-type-and-size-va`](https://git.mokoconsulting.tech/MokoConsulting/MokoJoomOpenGraph/src/branch/feature/35-csv-import-missing-file-type-and-size-va) ```bash git fetch origin git checkout feature/35-csv-import-missing-file-type-and-size-va ```
Sign in to join this conversation.
Labels
Clear labels
bug
Something is broken
 documentation
Documentation improvements
 enhancement
priority: high
priority: low
priority: medium
production-readiness
Required before v1.0 release
 security
Security vulnerability or hardening
 testing
Test coverage and QA
bug
Something is not working
 chore
Maintenance and housekeeping
 documentation
Documentation improvements
 enhancement
Improvement to existing functionality
 feature
New feature or request
 pending: dependency
Blocked by another issue or external dependency
 pending: deployment
Tested and approved, awaiting deployment to production
 pending: design
Needs UI/UX or architecture design before implementation
 pending: documentation
Feature works, needs documentation/wiki update
 pending: feedback
Awaiting feedback or decision from stakeholder
 pending: review
Implementation complete, awaiting code review
 pending: testing
Feature implemented but not yet tested
 priority: critical
Must fix immediately
 priority: high
Should fix soon
 priority: low
Nice to have
 priority: medium
Fix when convenient
 refactor
Code restructuring without behavior change
 roadmap
Planned feature or enhancement tracked on the roadmap
 scope: client
Client-specific work
 scope: dolibarr
Dolibarr modules and customizations
 scope: infrastructure
Server, CI, backups, monitoring
 scope: joomla
Joomla templates and extensions
 scope: waas
MokoWaaS platform
 security
Security vulnerability or hardening
 status: blocked
Waiting on external dependency
 status: duplicate
Duplicate of another issue
 status: in-progress
Being worked on
 status: needs-review
Ready for review
 status: wontfix
Will not be addressed
No labels priority: medium production-readiness security
Milestone
No items
No Milestone
Assignees
Clear assignees
jmiller (Jonathan Miller)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: MokoConsulting/MokoJoomOpenGraph#35
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?