fix(blossom): send the real content type on upload - #85
Merged
Conversation
every upload went out as application/octet-stream because no caller passes contentType, and a blossom server that sniffs the body rejects the mismatch: uploading a valid png returned 400 'Content-Type header does not match the file content, expected image/png'. detect from the leading bytes rather than the file name. the bytes are what the server checks, and an uploader should not be able to mislabel a blob by renaming it. png, jpeg, gif, webp, pdf and svg, falling back to octet-stream when nothing matches.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What this changes
blossom-uploadnow sends the actual media type instead ofapplication/octet-stream.Why
No caller passes
contentType, so every upload fell back to the default. A Blossom server that sniffs the body rejects the mismatch:The file was a valid PNG. This makes
blossom-uploadfail against any spec-compliant server for every format it recognises.How
Detect from the leading bytes rather than the file name. The bytes are what the server checks, and an uploader should not be able to mislabel a blob by renaming it. PNG, JPEG, GIF, WebP, PDF and SVG, falling back to
application/octet-streamwhen nothing matches, so unknown formats behave exactly as before.An explicit
args.contentTypestill wins, so existing callers are unaffected.Verification
Same upload after the fix returns 200 with
"type": "image/png", and the blob serves asimage/png. Unit tests cover each signature and the short-buffer and unknown-format fallbacks.npm run lintand the blossom suite (47 tests) pass.