fix(media): case-sensitive Content-Type checks bypass header extension and image-header safety rules (#111184)

YangManBOBO · steipete · web-flow · commit 1508a586744d · 2026-07-19T21:53:13.000-07:00
* fix(media): normalize Content-Type casing in header extension and image-header checks

* test(media): consolidate MIME case coverage

Co-authored-by: 潘晓波0668000512 &lt;pan.xiaobo@xydigit.com&gt;

---------

Co-authored-by: Peter Steinberger &lt;steipete@gmail.com&gt;
diff --git a/src/media/store.test.ts b/src/media/store.test.ts
@@ -458,12 +458,12 @@ describe("media store", () => {
       },
     },
     {
-      name: "prefers detected stream mime over generic zip header extension",
+      name: "prefers detected stream mime over mixed-case generic zip header extension",
       run: async () => {
         await withTempStore(async (storeLocal10) => {
           const saved = await storeLocal10.saveMediaStream(
             Readable.from([Buffer.from("docx")]),
-            "application/zip",
+            "Application/Zip",
             "stream-inbound",
             1024,
             undefined,
@@ -687,13 +687,13 @@ describe("media store", () => {
       expectedExtension: ".custom",
     },
     {
-      name: "does not preserve image header extensions for generic container buffers",
+      name: "does not preserve mixed-case image header extensions for generic container buffers",
       bufferFactory: async () => {
         const zip = new JSZip();
         zip.file("hello.txt", "hi");
         return await zip.generateAsync({ type: "nodebuffer" });
       },
-      contentType: "image/png",
+      contentType: "IMAGE/PNG",
       originalFilename: "fake.png",
       expectedContentType: "application/zip",
       expectedExtension: ".zip",
diff --git a/src/media/store.ts b/src/media/store.ts
@@ -9,9 +9,8 @@ import {
   extnameFromAnyPath,
   nameFromAnyPath,
 } from "@openclaw/media-core/file-name";
-import { detectMime, extensionForMime } from "@openclaw/media-core/mime";
+import { detectMime, extensionForMime, normalizeMimeType } from "@openclaw/media-core/mime";
 import { hasHttpUrlPrefix } from "@openclaw/net-policy/url-protocol";
-import { normalizeOptionalString } from "@openclaw/normalization-core/string-coerce";
 import { truncateUtf16Safe } from "@openclaw/normalization-core/utf16-slice";
 import { fileStore } from "../infra/file-store.js";
 import { sanitizeUntrustedFileName } from "../infra/fs-safe-advanced.js";
@@ -246,7 +245,7 @@ function safeOriginalFilenameExtension(originalFilename?: string): string | unde
 }
 
 function extensionForAuthoritativeHeaderMime(contentType?: string): string | undefined {
-  const mime = normalizeOptionalString(contentType?.split(";")[0]);
+  const mime = normalizeMimeType(contentType);
   if (!mime || mime === "application/octet-stream" || mime === "binary/octet-stream") {
     return undefined;
   }
@@ -261,7 +260,7 @@ function isGenericContainerMime(mime?: string): boolean {
 }
 
 function isImageHeaderMime(contentType?: string): boolean {
-  return normalizeOptionalString(contentType?.split(";")[0])?.startsWith("image/") === true;
+  return normalizeMimeType(contentType)?.startsWith("image/") === true;
 }
 
 function resolveSavedMediaExtension(params: {

Original file line number	Diff line number	Diff line change
`@@ -9,9 +9,8 @@ import {`
`9`	`9`	`extnameFromAnyPath,`
`10`	`10`	`nameFromAnyPath,`
`11`	`11`	`} from "@openclaw/media-core/file-name";`
`12`		`-import { detectMime, extensionForMime } from "@openclaw/media-core/mime";`
	`12`	`+import { detectMime, extensionForMime, normalizeMimeType } from "@openclaw/media-core/mime";`
`13`	`13`	`import { hasHttpUrlPrefix } from "@openclaw/net-policy/url-protocol";`
`14`		`-import { normalizeOptionalString } from "@openclaw/normalization-core/string-coerce";`
`15`	`14`	`import { truncateUtf16Safe } from "@openclaw/normalization-core/utf16-slice";`
`16`	`15`	`import { fileStore } from "../infra/file-store.js";`
`17`	`16`	`import { sanitizeUntrustedFileName } from "../infra/fs-safe-advanced.js";`
`@@ -246,7 +245,7 @@ function safeOriginalFilenameExtension(originalFilename?: string): string \| unde`
`246`	`245`	`}`
`247`	`246`
`248`	`247`	`function extensionForAuthoritativeHeaderMime(contentType?: string): string \| undefined {`
`249`		`- const mime = normalizeOptionalString(contentType?.split(";")[0]);`
	`248`	`+ const mime = normalizeMimeType(contentType);`
`250`	`249`	`if (!mime \|\| mime === "application/octet-stream" \|\| mime === "binary/octet-stream") {`
`251`	`250`	`return undefined;`
`252`	`251`	`}`
`@@ -261,7 +260,7 @@ function isGenericContainerMime(mime?: string): boolean {`
`261`	`260`	`}`
`262`	`261`
`263`	`262`	`function isImageHeaderMime(contentType?: string): boolean {`
`264`		`- return normalizeOptionalString(contentType?.split(";")[0])?.startsWith("image/") === true;`
	`263`	`+ return normalizeMimeType(contentType)?.startsWith("image/") === true;`
`265`	`264`	`}`
`266`	`265`
`267`	`266`	`function resolveSavedMediaExtension(params: {`