Gate Bugzilla attachment downloads behind a mimetype allowlist - #6707
Open
msujaws wants to merge 1 commit into
Open
Gate Bugzilla attachment downloads behind a mimetype allowlist#6707msujaws wants to merge 1 commit into
msujaws wants to merge 1 commit into
Conversation
msujaws
force-pushed
the
attachment-mimetype-allowlist
branch
2 times, most recently
from
August 24, 2026 22:15
9af8d0c to
024c16e
Compare
crythms
requested changes
Aug 25, 2026
crythms
left a comment
crythms
left a comment
Member
There was a problem hiding this comment.
added a few suggested changes for review
… a video attachment cost a full download and tens of thousands of tokens and still came back undecodable get_bug_attachments and download_attachment now check an attachment's effective content type against ALLOWED_ATTACHMENT_TYPES plus every text/* subtype, and probe metadata with exclude_fields=data first so a refused attachment's bytes never leave Bugzilla. is_patch resolves to text/plain and application/octet-stream resolves from Python's built-in mimetypes table rather than the host's /etc/mime.types, so an update.log still comes through and an untyped .mp4 does not, identically on a laptop and in the agent containers. Fixes mozilla#6701
msujaws
force-pushed
the
attachment-mimetype-allowlist
branch
from
August 25, 2026 16:34
024c16e to
1abdd75
Compare
crythms
approved these changes
Aug 25, 2026
crythms
left a comment
crythms
left a comment
Member
There was a problem hiding this comment.
Thanks for addressing the feedback. Looks great!
msujaws
enabled auto-merge (squash)
August 25, 2026 17:53
Member
|
@mozilla/hackbot-webcompat is PR okay for you since it changes something you also use? |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
get_bug_attachmentsanddownload_attachmentapplied no mimetype filter, so a video attachment on a bug got downloaded, read, and billed as tens of thousands of tokens before the agent gave up on decoding it (run 5daab632).download_attachmentnow refuses anything outsideALLOWED_ATTACHMENT_TYPESplus everytext/*subtype, and probes metadata withexclude_fields=datafirst so a refused attachment's bytes never leave Bugzilla.get_bug_attachments(include_data=true)is narrower still, since a tool result is text and a base64 image is therefore never an image block: it inlines only textual types under 256KiB, for the first 10 that qualify, and points atdownload_attachmentfor everything else.is_patchresolves totext/plainandapplication/octet-streamresolves from Python's built-in mimetypes table rather than the host's/etc/mime.types, so anupdate.logbehaves identically on a laptop and in the agent containers. The cost is1 + Krequests for K inlined attachments, each wrapped so one inaccessible attachment setsdata_errorrather than discarding the ones already fetched.libs/agent-tools/tests/test_bugzilla.pygoes from 4 tests to 26 and coversdownload_attachment's body for the first time;dest_pathis still an unconstrained agent-supplied string and belongs with the path-hardening work.Fixes #6701