Nhost Storage Affected by MIME Type Spoofing via Trusted Client Content-Type Header in Storage Upload

@@ -4,6 +4,7 @@ import (
 	"context"
 	"encoding/json"
 	"fmt"
+	"io"
 	"log/slog"
 	"mime/multipart"
 	"net/http"
@@ -53,11 +54,8 @@ func (ctrl *Controller) getMultipartFile(file fileData) (multipart.File, string,
 		)
 	}
 
-	contentType := file.header.Header.Get("Content-Type")
-	if contentType != "" && contentType != "application/octet-stream" {
-		return fileContent, contentType, nil
-	}
-
+	// Always detect MIME type from file content, never trust the client-provided
+	// Content-Type header to prevent MIME type spoofing (GHSA-g9f6-9775-hffm).
 	mt, err := mimetype.DetectReader(fileContent)
 	if err != nil {
 		return nil, "",
@@ -66,6 +64,13 @@ func (ctrl *Controller) getMultipartFile(file fileData) (multipart.File, string,
 			)
 	}
 
+	if _, err := fileContent.Seek(0, io.SeekStart); err != nil {
+		return nil, "",
+			InternalServerError(
+				fmt.Errorf("problem seeking file %s: %w", file.Name, err),
+			)
+	}
+
 	return fileContent, mt.String(), nil
 }
 

@@ -132,7 +132,7 @@ func TestUploadFile(t *testing.T) {
 				},
 				{
 					contents:    "more content",
-					contentType: "text/markdown",
+					contentType: "image/png",
 					md: fakeFileMetadata{
 						Name:     "another_file.md",
 						ID:       uuid.New().String(),
@@ -211,15 +211,15 @@ func TestUploadFile(t *testing.T) {
 			}
 
 			{
-				// file 2
+				// file 2 - client sends text/markdown but server detects from content
 				file := files[1]
 				metadataStorage.EXPECT().InitializeFile(
 					gomock.Any(),
 					file.md.ID,
 					file.md.Name,
 					int64(len(file.contents)),
 					"blah",
-					"text/markdown",
+					"text/plain; charset=utf-8",
 					gomock.Any(),
 				).Return(nil)
 
@@ -229,7 +229,7 @@ func TestUploadFile(t *testing.T) {
 						file.contents,
 					),
 					file.md.ID,
-					"text/markdown",
+					"text/plain; charset=utf-8",
 				).Return("some-etag", nil)
 
 				metadataStorage.EXPECT().PopulateMetadata(
@@ -240,7 +240,7 @@ func TestUploadFile(t *testing.T) {
 					"blah",
 					"some-etag",
 					true,
-					"text/markdown",
+					"text/plain; charset=utf-8",
 					file.md.Metadata,
 					gomock.Any(),
 				).Return(
@@ -253,7 +253,7 @@ func TestUploadFile(t *testing.T) {
 						CreatedAt:        time.Time{}, // ignored
 						UpdatedAt:        time.Time{}, // ignored
 						IsUploaded:       true,
-						MimeType:         "text/markdown",
+						MimeType:         "text/plain; charset=utf-8",
 						UploadedByUserId: new("some-valid-uuid"),
 						Metadata:         new(map[string]any{"some": "metadata"}),
 					},
@@ -308,7 +308,7 @@ func TestUploadFile(t *testing.T) {
 						CreatedAt:        time.Time{}, // ignored
 						UpdatedAt:        time.Time{}, // ignored
 						IsUploaded:       true,
-						MimeType:         "text/markdown",
+						MimeType:         "text/plain; charset=utf-8",
 						UploadedByUserId: new("some-valid-uuid"),
 						Metadata:         new(map[string]any{"some": "metadata"}),
 					},