fix(media): classify text/* MIME types as documents (openclaw#12341) thanks @arosstale

Verified:
- pnpm build
- pnpm check
- pnpm test

Co-authored-by: arosstale <117890364+arosstale@users.noreply.github.com>
Co-authored-by: Tak Hoffman <781889+Takhoffman@users.noreply.github.com>
This commit is contained in:
Artale
2026-02-14 01:38:38 +01:00
committed by GitHub
parent f9379ecee2
commit fdacfc571c
3 changed files with 18 additions and 0 deletions

View File

@@ -25,6 +25,7 @@ Docs: https://docs.openclaw.ai
- Inbound/Web UI: preserve literal `\n` sequences when normalizing inbound text so Windows paths like `C:\\Work\\nxxx\\README.md` are not corrupted. (#11547) Thanks @mcaxtr.
- Daemon/Windows: preserve literal backslashes in `gateway.cmd` command parsing so drive and UNC paths are not corrupted in runtime checks and doctor entrypoint comparisons. (#15642) Thanks @arosstale.
- Security/Canvas: serve A2UI assets via the shared safe-open path (`openFileWithinRoot`) to close traversal/TOCTOU gaps, with traversal and symlink regression coverage. (#10525) Thanks @abdelsfane.
- Media: classify `text/*` MIME types as documents in media-kind routing so text attachments are no longer treated as unknown. (#12237) Thanks @arosstale.
- Security/Gateway: breaking default-behavior change - canvas IP-based auth fallback now only accepts machine-scoped addresses (RFC1918, link-local, ULA IPv6, CGNAT); public-source IP matches now require bearer token auth. (#14661) Thanks @sumleo.
- Security/Gateway: sanitize and truncate untrusted WebSocket header values in pre-handshake close logs to reduce log-poisoning risk. Thanks @thewilloftheshadow.
- Security/WhatsApp: enforce `0o600` on `creds.json` and `creds.json.bak` on save/backup/restore paths to reduce credential file exposure. (#10529) Thanks @abdelsfane.

View File

@@ -0,0 +1,14 @@
import { describe, expect, it } from "vitest";
import { mediaKindFromMime } from "./constants.js";
describe("mediaKindFromMime", () => {
it("classifies text mimes as document", () => {
expect(mediaKindFromMime("text/plain")).toBe("document");
expect(mediaKindFromMime("text/csv")).toBe("document");
expect(mediaKindFromMime("text/html; charset=utf-8")).toBe("document");
});
it("keeps unknown mimes as unknown", () => {
expect(mediaKindFromMime("model/gltf+json")).toBe("unknown");
});
});

View File

@@ -21,6 +21,9 @@ export function mediaKindFromMime(mime?: string | null): MediaKind {
if (mime === "application/pdf") {
return "document";
}
if (mime.startsWith("text/")) {
return "document";
}
if (mime.startsWith("application/")) {
return "document";
}