Phase 1: Critical security fixes - 59 permissions, grants, RLS, mass-assignment, ownership, leaks, MIME

app/plugins/builtins/dms/routes.py

@@ -97,6 +97,40 @@ def _sanitize_filename(filename: str) -> str:
 BLOCKED_EXTENSIONS = {
     ".exe", ".bat", ".cmd", ".sh", ".jar", ".com", ".scr", ".msi",
     ".dll", ".vbs", ".ps1", ".app", ".bin", ".reg", ".inf",
+    ".php", ".py", ".pl", ".asp", ".aspx", ".jsp", ".svg", ".htaccess",
+    ".phtml", ".pht", ".cgi", ".cfm", ".erb",
+}
+
+# Allowed MIME types for upload validation
+ALLOWED_MIME_PREFIXES = {
+    "application/pdf",
+    "application/msword",
+    "application/vnd.openxmlformats-officedocument",
+    "application/vnd.oasis.opendocument",
+    "application/vnd.ms-excel",
+    "application/vnd.ms-powerpoint",
+    "application/zip",
+    "application/gzip",
+    "application/x-tar",
+    "application/json",
+    "application/xml",
+    "application/rtf",
+    "application/x-7z-compressed",
+    "application/x-rar-compressed",
+    "text/plain",
+    "text/csv",
+    "text/html",
+    "text/markdown",
+    "image/png",
+    "image/jpeg",
+    "image/gif",
+    "image/webp",
+    "image/bmp",
+    "image/tiff",
+    "image/x-icon",
+    "audio/",
+    "video/",
+    "application/octet-stream",
 }
 
 
@@ -467,6 +501,14 @@ async def upload_file(
             detail={"detail": "File type not allowed", "code": "blocked_filetype"},
         )
 
+    # MIME type validation: verify content_type against allowlist
+    mime_type = file.content_type or "application/octet-stream"
+    if not any(mime_type.startswith(prefix) for prefix in ALLOWED_MIME_PREFIXES):
+        raise HTTPException(
+            400,
+            detail={"detail": f"MIME type '{mime_type}' not allowed", "code": "blocked_mimetype"},
+        )
+
     # Validate folder exists if specified
     if fid is not None:
         folder_result = await db.execute(