fix(bluebubbles): harden voice memo handling #1482
Conversation
PR SummaryStrengthens BlueBubbles voice memo sending and tightens attachment safety.
Written by Cursor Bugbot for commit d0ffad7. This will update automatically on new commits. Configure here. |
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes and found 4 potential issues.
Bugbot Autofix is OFF. To automatically fix reported issues with Cloud Agents, enable Autofix in the Cursor dashboard.
| if (trimmed === "false") return false; | ||
| } | ||
| return undefined; | ||
| } |
There was a problem hiding this comment.
Duplicate readBooleanParam function implementation
Low Severity
The readBooleanParam helper function is duplicated identically in both actions.ts and message-action-runner.ts. This increases maintenance burden since any bug fixes or improvements need to be applied in multiple places, and creates inconsistency risk across the codebase.
| const trimmed = input?.trim() ?? ""; | ||
| const base = trimmed ? path.basename(trimmed) : ""; | ||
| return base || fallback; | ||
| } |
There was a problem hiding this comment.
Insufficient filename sanitization breaks multipart form encoding
Medium Severity
The sanitizeFilename function only removes directory traversal via path.basename() but doesn't sanitize special characters like double quotes, newlines, or carriage returns. These characters will corrupt the multipart form data at line 209 where the filename is interpolated into the Content-Disposition header with double-quote delimiters, potentially breaking attachment uploads or allowing header injection.
| const trimmed = input?.trim() ?? ""; | ||
| const base = trimmed ? path.basename(trimmed) : ""; | ||
| return base || fallback; | ||
| } |
There was a problem hiding this comment.
Invalid filenames not rejected by sanitization
Medium Severity
The sanitizeFilename function returns invalid filenames like / or \ instead of falling back to the fallback name when path.basename() returns a path separator. This happens because path separators are truthy strings, so the base || fallback check fails to catch them, leading to malformed filenames in the multipart form data that could cause BlueBubbles attachment uploads to fail.
| contentType = contentType ?? "audio/mpeg"; | ||
| } else if (voiceInfo.isCaf) { | ||
| filename = ensureExtension(filename, ".caf", fallbackName); | ||
| contentType = contentType ?? "audio/x-caf"; |
There was a problem hiding this comment.
Inconsistent contentType when filename and MIME type conflict
Medium Severity
For voice memos, when the filename extension and provided contentType indicate different formats (e.g., filename is voice.mp3 but contentType is audio/x-caf), the code uses contentType ?? defaultType which preserves the conflicting contentType. This sends inconsistent metadata to BlueBubbles where the filename says MP3 but the Content-Type header says CAF, potentially causing voice memo conversion or upload to fail.
Summary
Testing