docusealco/docuseal · error · Submitters::MaliciousFileExtension

File type '.#{extension}' is not allowed.

Error message

File type '.#{extension}' is not allowed.

What it means

Submitters.create_attachment! (lib/submitters.rb:132) raises MaliciousFileExtension when the uploaded file's original filename has an extension in Submitters::DANGEROUS_EXTENSIONS — a blocklist of executables, scripts, installers and libraries (exe, bat, cmd, sh, js, jar, dll, dmg, apk, ...). Only the filename extension is inspected; content is not sniffed at this guard. The error stops the blob from ever being created.

Source

Thrown at lib/submitters.rb:132

      return [submitter.submission.combined_document_attachment || Submissions::EnsureCombinedGenerated.call(submitter)]
    end

    original_documents = submitter.submission.schema_documents.preload(:blob)
    is_more_than_two_images = original_documents.many?(&:image?)

    submitter.documents.preload(:blob).reject do |attachment|
      is_more_than_two_images &&
        original_documents.find { |a| a.uuid == (attachment.metadata['original_uuid'] || attachment.uuid) }&.image?
    end
  end

  def create_attachment!(submitter, file, metadata: {})
    raise ParamsError, 'file param is missing' if file.blank?

    extension = File.extname(file.original_filename).delete_prefix('.').downcase

    if DANGEROUS_EXTENSIONS.include?(extension)
      raise MaliciousFileExtension, "File type '.#{extension}' is not allowed."
    end

    blob = ActiveStorage::Blob.create_and_upload!(io: file.tap(&:rewind).open,
                                                  filename: file.original_filename,
                                                  content_type: file.content_type,
                                                  metadata:)

    ActiveStorage::Attachment.create!(blob:, name: 'attachments', record: submitter)
  end

  def normalize_preferences(account, user, params)
    preferences = {}

    message_params = params['message'].presence || params.slice('subject', 'body').presence

    if message_params.present?
      email_message = EmailMessages.find_or_create_for_account_user(account, user,
                                                                    message_params['subject'],

View on GitHub (pinned to 004a22c1c8)

Solutions

1. Upload documents in allowed formats (pdf, png/jpg, docx, xlsx) — rename the file so its extension matches its real content.
2. For archives or binaries that are legitimately needed, deliver them out-of-band; the endpoint will not accept them.
3. Rescue Submitters::MaliciousFileExtension in the controller and return 422 with the message so the UI can show which extension was rejected.
4. Do not try to bypass by double extensions — File.extname takes the last segment, so 'a.pdf.exe' is rejected and 'a.exe.pdf' is judged by 'pdf'.

Example fix

# before
Submitters.create_attachment!(submitter, params[:file]) # raises for 'malware.exe'

# after
begin
  Submitters.create_attachment!(submitter, params[:file])
rescue Submitters::MaliciousFileExtension => e
  render json: { error: e.message }, status: :unprocessable_entity
end

# Blocklist check identical to the server's, before uploading
DANGEROUS = Submitters::DANGEROUS_EXTENSIONS
ext = File.extname(file.original_filename.to_s).delete_prefix('.').downcase
raise ArgumentError, "File type '.#{ext}' is not allowed." if DANGEROUS.include?(ext)

begin
  Submitters.create_attachment!(submitter, params[:file])
rescue Submitters::MaliciousFileExtension => e
  render json: { error: e.message }, status: :unprocessable_entity
end

When it happens

Trigger: Uploading any file whose name ends in a blocklisted extension to a submitter attachments endpoint (e.g. contract.exe, script.sh, macro-enabled archives like .jar); a legitimate document misnamed with a dangerous extension (report.scr).

Common situations: Users attaching 'signed_docs.zip.exe' style malware; internal tooling uploading build artifacts; files renamed by email clients; testers probing the upload endpoint with script files.

Related errors

• File type '.#{detected_extensions.first}' is not allowed.
• File type '.#{extension}' is not allowed.
• file param is missing
• Error loading: #{uri}. Only HTTPS is allowed.
• Error loading: #{uri}. Can't download from localhost.

AI-assisted analysis of docusealco/docuseal@004a22c1c8 (2026-08-21). Data as JSON: /api/errors/d0c2ca9d41e98cf7. Report an issue: GitHub.