fix(security): validate uploaded file types by content with Apache Tika in the AI plugin

[wyattwalter]

What & why

The AI plugin's upload path validated files by the client-supplied filename and Content-Type — both spoofable. The allowed types already existed as a client-side allowedFileTypes hint in form.json (application/pdf, text/plain, text/markdown), but the server never enforced them. This brings server-side validation in line with that hint — closing a client/server mismatch, not adding a new restriction — by detecting the true type from the file's content with Apache Tika (MIME + magic bytes) and rejecting anything outside the allow-list (e.g. a malicious SVG).

Scope / severity: defense-in-depth, not an XSS-serving fix. Uploaded files are never served back to the user from the app origin — they're forwarded to the AI service and stored in S3, reachable only via short-lived presigned URLs on a different origin. Independently re-reviewed (SHIP-WITH-RISKS).

How

• FileValidationUtils detects the type via tika-core detectors constructed directly (no ServiceLoader, so it survives the plugin uber-jar shading; no tika-parsers).
• Encoding-aware: on an ambiguous first pass, the head is decoded from its real charset (BOM / null-pattern heuristic for UTF-16LE/BE and UTF-32), its BOM + XML-prolog whitespace stripped, re-encoded to UTF-8 and re-detected — so UTF-8/UTF-16/UTF-32 SVG (incl. BOM-, whitespace-, and namespace-prefixed) surfaces as image/svg+xml and is rejected. Genuine wide-encoded text still passes.
• Per-file size cap: the file is joined with DataBufferUtils.join's fail-fast maxByteCount (20 MiB, mirroring form.json's maxFileSizeInBytes), so an oversized upload is rejected as it is read rather than buffered into heap — scoped to this endpoint, unlike the shared 150MB global multipart ceiling. The resulting DataBufferLimitException is translated to a clear rejection message.
• BufferedFilePart buffers bytes so the file is inspected and still forwarded.
• tika-core 3.2.2 (1.13–3.2.1 are affected by CVE-2025-66516).

Residual (low): benign non-markup padding followed by a markup root stays text/plain — correct, since it isn't well-formed XML and no parser renders it as SVG.

Tests cover the encoding matrix (all rejected), oversized-file rejection, and allowed types incl. wide-encoded text (all accepted); module suite green.

Linear: https://linear.app/appsmith/issue/APP-15345

Warning

Tests have not run on the HEAD 6be7672 yet

---

Fri, 17 Jul 2026 13:16:03 UTC

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 2fced0d0-9da5-4928-868b-5151fe3518ca

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fm/svg-tika-e1

---

_{Comment @coderabbitai help to get the list of available commands.}