SUM-SEC-13 [P1][13/20][Med] Attachment datas: field ACL, MIME allowlist, safe download

[CHINMAYVIVEK]

ID: SUM-SEC-13
Wave: P1
Severity: Medium
Labels: security, attachments, upload, P1, medium
Branch: fix/SUM-SEC-13-attachment-datas-acl-mime
Languages: Go
Related: SUM-PLAT-16
CWE: CWE-434 / CWE-552

Summary

Filestore path hashing mitigates ../ escapes. sys.attachment.datas remains readable/writable via ORM/RPC for anyone with model ACL; no MIME allowlist; bulk upload size-capped but little content sniffing. Serving without X-Content-Type-Options: nosniff + forced type risks XSS via “download”.

Acceptance criteria

• Field ACL / sensitive handling for datas (download via auth’d route, not raw RPC dump by default)
• MIME allowlist for upload; reject executable / HTML where policy requires
• Download responses: safe Content-Type, nosniff, disposition attachment
• Tests for path safety retained + MIME reject

Files to check / change

• sumeru/addons/base/models/sys_attachment.go
• sumeru/core/orm/filestore.go
• sumeru/core/server/web/bulk_handlers.go
• Attachment download/serve handlers under sumeru/core/server/web/