add support for pasting images from clipboard #3412
Conversation
|
@AFZL210 is attempting to deploy a commit to the coral-xyz Team on Vercel. A member of the Team first needs to authorize it. |
| }) { | ||
| const classes = useStyles(); | ||
| const theme = useCustomTheme(); | ||
| const { type, remoteUsername, activeReply } = useChatContext(); | ||
| const { activeSearch } = useContext(RichMentionsContext); | ||
|
|
||
| const uploadFromClipboard = (e:React.ClipboardEvent<HTMLDivElement>):void => { | ||
| if(e.clipboardData.files.length > 0) { |
There was a problem hiding this comment.
Are there any security implications here?
There was a problem hiding this comment.
it takes the file from the clipboard and passes it to the onMediaSelect method, the file drop feature also uses this. however, I may be wrong. could you please suggest some better practices?
There was a problem hiding this comment.
Could you check the mime types of the file that's pasted and ensure it's an image/video format?
Also does this work for videos?
There was a problem hiding this comment.
yes, it supports all the file types as it uses the same method that the drop file feature uses and one thing i would like to mention is we can even drop a .js file which is not good. should i add a check in the onMediaSelect function and then only upload it? or it is being handled in the backend?
gif
Backpack.2023-03-20.22-04-03.mp4
video
Backpack.2023-03-20.22-05-32.mp4
There was a problem hiding this comment.
We cant really prevent people from uploading JS. The security policy of the img tag should prevent any JS to be parsed - https://security.stackexchange.com/questions/135513/what-could-an-img-src-xss-do
If you could create a follow up which prevents any non video/image file in both drag and drops and copy/pastes that would be great
closes #2410
Backpack.2023-03-19.19-18-20.mp4