{"record":{"id":"be2b74f30d3c1853","repo":"HKUDS/Vibe-Trading","slug":"this-file-type-is-not-allowed-for-upload","errorCode":null,"errorMessage":"This file type is not allowed for upload.","messagePattern":"This file type is not allowed for upload\\.","errorType":"validation","errorClass":"HTTPException","httpStatus":400,"severity":"error","filePath":"agent/src/api/uploads_routes.py","lineNumber":132,"sourceCode":"            path,\n            media_type=media_type,\n            headers={\"Content-Disposition\": f'inline; filename=\"{shadow_id}.{format}\"'},\n        )\n\n    @app.post(\"/upload\", dependencies=[Depends(require_auth)])\n    async def upload_file(file: UploadFile):\n        \"\"\"Upload any document or data file (max 50MB).\n\n        Accepts most common formats: PDF, Word, Excel, PowerPoint, images,\n        CSV/TSV, plain text, JSON, and TOML. Executables, executable-adjacent\n        source/config/template files, and archives are rejected.\n        \"\"\"\n        if not file.filename:\n            raise HTTPException(status_code=400, detail=\"Missing filename\")\n        filename = Path(file.filename).name\n        ext = Path(filename).suffix.lower()\n        if ext in _BLOCKED_UPLOAD_EXT or filename.lower() in _BLOCKED_UPLOAD_NAMES:\n            raise HTTPException(\n                status_code=400,\n                detail=\"This file type is not allowed for upload.\",\n            )\n\n        uploads_dir = _host_uploads_dir()\n        max_size = _host_max_upload_size()\n        chunk_size = _host_chunk_size()\n\n        safe_name = f\"{uuid.uuid4().hex}{ext}\"\n        dest = uploads_dir / safe_name\n        total_size = 0\n\n        try:\n            uploads_dir.mkdir(parents=True, exist_ok=True)\n            with dest.open(\"wb\") as handle:\n                while True:\n                    chunk = await file.read(chunk_size)\n                    if not chunk:","sourceCodeStart":114,"sourceCodeEnd":150,"githubUrl":"https://github.com/HKUDS/Vibe-Trading/blob/80ffdda44c5c4db0dd84d70e051cca591cea67df/agent/src/api/uploads_routes.py#L114-L150","documentation":"Uploads are filtered by extension blocklist (_BLOCKED_UPLOAD_EXT) and filename blocklist (_BLOCKED_UPLOAD_NAMES): executables, executable-adjacent source/config/template files, and archives are rejected with 400 before any bytes are stored.","triggerScenarios":"POST /uploads with a file like tool.exe, archive.zip, script.sh, Makefile, or any extension in the blocked set (e.g. .bat, .py, .j2, .tar.gz).","commonSituations":"Users trying to upload code or config for analysis, packaging documents into zip first, or double extensions (report.pdf.exe) — the final extension decides.","solutions":["Upload an allowed document format: PDF, Word, Excel, PowerPoint, images, CSV/TSV, txt, JSON, TOML","Extract archives and upload the inner documents individually","If you control the deployment and truly need a type, review the blocklist before relaxing it"],"exampleFix":null,"handlingStrategy":"validation","validationCode":"ALLOWED = {'.pdf','.doc','.docx','.xls','.xlsx','.ppt','.pptx','.png','.jpg','.jpeg','.csv','.tsv','.txt','.json','.toml'}\nassert Path(name).suffix.lower() in ALLOWED, 'blocked upload type'","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Don't zip documents before uploading","Check the extension blocklist for the deployment"],"tags":["security","upload","file-type","blocklist","api"],"backgroundTag":"unsupported-file-type-rejected","analyzedSha":"80ffdda44c5c4db0dd84d70e051cca591cea67df","analyzedAt":"2026-08-28T12:46:38.989Z","schemaVersion":2},"datasetVersion":"2026-08-28T16:17:29.566Z"}