Restrict file types

server/Pipfile

@@ -40,6 +40,7 @@ shapely = "==2.0.6"
 psycogreen = "==1.0.2"
 importlib-metadata = "==8.4.0"  # https://github.com/pallets/flask/issues/4502
 typing_extensions = "==4.12.2"
+python-magic = "==0.4.27"
 # requirements for development on windows
 colorama = "==0.4.5"
 

server/mergin/sync/public_api_controller.py

@@ -5,14 +5,14 @@
 import binascii
 import functools
 import json
-import mimetypes
 import os
 import logging
 from dataclasses import asdict
 from typing import Dict
 from urllib.parse import quote
 import uuid
 from datetime import datetime
+
 import psycopg2
 from blinker import signal
 from connexion import NoContent, request
@@ -87,6 +87,9 @@
     get_project_path,
     get_device_id,
     is_valid_path,
+    is_supported_type,
+    is_supported_extension,
+    get_mimetype,
 )
 from .errors import StorageLimitHit
 from ..utils import format_time_delta
@@ -406,7 +409,7 @@ def download_project_file(
     if not is_binary(abs_path):
         mime_type = "text/plain"
     else:
-        mime_type = mimetypes.guess_type(abs_path)[0]
+        mime_type = get_mimetype(abs_path)
     resp.headers["Content-Type"] = mime_type
     resp.headers["Content-Disposition"] = "attachment; filename={}".format(
         quote(os.path.basename(file).encode("utf-8"))
@@ -813,7 +816,9 @@ def project_push(namespace, project_name):
         if not all(ele.path != item.path for ele in project.files):
             abort(400, f"File {item.path} has been already uploaded")
         if not is_valid_path(item.path):
-            abort(400, f"File {item.path} contains invalid characters.")
+            abort(400, f"File '{item.path}' contains invalid characters.")
+        if not is_supported_extension(item.path):
+            abort(400, f"Unsupported extension of '{item.path}' file.")
 
     # changes' files must be unique
     changes_files = [
@@ -1042,6 +1047,9 @@ def push_finish(transaction_id):
                 )
                 corrupted_files.append(f.path)
                 continue
+        if not is_supported_type(dest_file):
+            logging.info(f"Rejecting blacklisted file: {dest_file}")
+            abort(400, f"Unsupported file type of '{f.path}' file.")
 
         if expected_size != os.path.getsize(dest_file):
             logging.error(