From d8850d1b5056b00265c2b076e9bd11440ff37119 Mon Sep 17 00:00:00 2001 From: Codeman maintainer Date: Sun, 18 Oct 2026 08:08:24 +0200 Subject: [PATCH] fix(#653): export ALLOWED_DOCUMENT_EXTS as ReadonlySet Now that the set is exported for the parity test, type it read-only like VIDEO_ATTACHMENT_EXTENSIONS, so an importer cannot add to the live upload allowlist. Co-Authored-By: Claude Opus 5.5 (1M context) --- src/web/routes/session-routes.ts | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/src/web/routes/session-routes.ts b/src/web/routes/session-routes.ts index e3980224..10ebe31a 100644 --- a/src/web/routes/session-routes.ts +++ b/src/web/routes/session-routes.ts @@ -338,7 +338,14 @@ const TEXT_UPLOAD_EXTS = new Set(['.txt', '.md', '.csv', '.tsv', '.json', '.log' * imageMagicMatchesExt (signature, or UTF-8 without NUL for text). The browser * keeps its own copies (test/upload-document-list-parity.test.ts pins them). */ -export const ALLOWED_DOCUMENT_EXTS = new Set(['.pdf', '.docx', '.pptx', '.xlsx', '.zip', ...TEXT_UPLOAD_EXTS]); +export const ALLOWED_DOCUMENT_EXTS: ReadonlySet = new Set([ + '.pdf', + '.docx', + '.pptx', + '.xlsx', + '.zip', + ...TEXT_UPLOAD_EXTS, +]); /** * Validate upload bytes against a declared extension. Sniffs the first ~12 bytes