Configuring which Files Can be Uploaded to Codebeamer

This page provides information on configuring which file types can be uploaded to Codebeamer.

Introduction

When you upload HTML or SVG files to Codebeamer, the files may contain malicious javascripts or other potential XSS attacks.

Since Codebeamer 8.0, such files can not be uploaded to Codebeamer as attachments. If you try to upload an SVG file, a dialog is displayed informing the user that the upload is not allowed:

By default Codebeamer 8.0 prevents uploading HTML and SVG files.

Application Configuration

The file upload-related settings can be configured in the Application Configuration.

The default configuration looks like this, and it prevents uploading SVG and HTML files by checking their mime-types.

  // rules which kind of files can be uploaded ?
  "uploads" : {
    "filter" : {
      "orderAllowDeny" : false,
      "denyMime" : [ "image/svg+xml","text/html", "text/docx" ],
      "allowMimeRegexp" : [".*"]
    }
  }

These upload-filter rules use the similar Allow/Deny rules of what is used in Apache Web Server to configure access to certain resources.

What happens here is:

• During the upload the system computes the mime-type of the uploaded file. Mime-type is a kind of abstraction which tells the browser or the system how to handle a file with some certain extension. For example the "apple.html" and "apple.htm" both are HTML files and they have "text/html" mime-type defined.
• The orderAllowDeny boolean setting defines if the first the "Deny" or first the "Allow" rules are evaluated. The orderAllowDeny="true" means "Allow/Deny" so first the "allow" rules are evaluated then the "deny" rules. The "false" means the opposite order.
• The following table lists the possible rules inside the "filter" tag:

Rule	Description
"filter" : { <allowMime>value</allowMime> }	Allows file-upload if the mime-type is same as the value provided.
"filter" : { <allowMimeRegexp>value</allowMimeRegexp> }	Allows file-upload if the mime-type is matching with the Regular Expression provided.
"filter" : { <denyMime>value</denyMime> }	Denies file-upload if the mime-type is same as the value provided.
"filter" : { <denyMimeRegexp>value</denyMimeRegexp> }	Denies file-upload if the mime-type is matching with the Regular Expression provided.

The uploaded mime-type of the uploaded file is checked against the rules. If the set rules block the upload, the file will be rejected.

Known Issues

“Upload Not Allowed” Errors During or After the Upgrade

Codebeamer versions 2.2.0.1, 2.1.0.3, or 2.0.0.5:

• The upgrade may fail due to "Upload of file 'depends' is not allowed" error.
• The creation of a new tracker may fail due to "Upload of file '<tracker name>' is not allowed." error.

Temporary workaround / mitigation:

Ensure that "application/unknown" in the "uploads" section of the You must login to see this link. Register now, if you have no user account yet. is set to a MIME type that is not denied, as in the following examples:

"uploads" : {
        "filter" : {
            "mimeOfUnknownFileTypes" : "application/unknown",
            "orderAllowDeny" : false,
            "denyMime" : [
                {
                    "text" : "application/octet-stream"
                },
                {
                    "text" : "image/svg+xml"
                },
                {
                    "text" : "text/html"
                }
            ],
            "allowMimeRegexp" : {
                "text" : ".*"
            }
        }
    }

"uploads": {
    "filter": {
        "orderAllowDeny": true,
        "allowMime": [
            {
                "text": "application/octet-stream"
            },
            {
                "text": "application/json"
            },
            {
                "text": "application/unknown"
            }
        ],
        "denyMimeRegexp": {
            "text": ".*"
        }
    }
}

See the knowledge article "Upload of file 'depends' is not allowed" on upgrade or "Upload of file '<tracker name>' is not allowed" errors on Codebeamer for further information about the root causes and the resolution.