Use allow and block lists for uploading files and images #3556

laevandus · 2025-01-10T12:47:03Z

🔗 Issue Links

🎯 Goal

Use upload config for image and file uploads

📝 Summary

AttachmentQueueUploader consumes AppSettings and fails attachments based on the upload config
ComposerVC uses the allow list to set allowed UTI types to image and file pickers

🛠 Implementation

When we fetch AppSettings just after connecting the user, upload configs are also set to AttachmentQueueUploader. AttachmentQueueUploader then uses that information for failing uploads as soon as attachment upload start processing. The uploading state is set to failed.
In the ComposerVC we are creating pickers for selecting files and images. These pickers use UTI instead of mime types and file extension. Therefore, we need to convert upload configs to UTI types. The only time we restrict selecting files or images using the picker is when allowed lists are set.

🎨 Showcase

N/A

🧪 Manual Testing Notes

Note: block lists and allow lists work differently in pickers (technical reasons).

Upload configs are set using Stream Dashboard.

Case 1: Block list using path extensions

Set upload config for image uploads to block path extensions .png (or more)
Open a channel, use the image picker to select a blocked file
Expected: user can pick the file, but upload fails immediately when sending the message

Repeat for file upload config with .pdf

Case 2: Block list using mime types

Set upload config for image uploads to block path extensions image/png (or more)
Open a channel, use the image picker to select a blocked file
Expected: user can pick the file, but upload fails immediately when sending the message

Repeat for file upload config with application/pdf

Case 3: Allow list using path extensions

Set file upload config for image uploads to allow only .png path extensions
Open a channel, use the image picker to select allowed file
Expected:
ImagePicker: user can pick the file, but upload fails immediately when sending the message
FilePicker: user can't pick the file

Repeat for file upload config with .pdf

Case 4: Allow list using mime types

Set file upload config for image uploads to allow only image/png mime type
Open a channel, use the image picker to select allowed file
Expected:
ImagePicker: user can pick the file, but upload fails immediately when sending the message
FilePicker: user can't pick the file

Repeat for file upload config with application/pdf

☑️ Contributor Checklist

I have signed the Stream CLA (required)
This change should be manually QAed
Changelog is updated with client-facing changes
Changelog is updated with new localization keys
New code is covered by unit tests
Documentation has been updated in the docs-content repo

…hment uploader and in image and file pickers

laevandus · 2025-01-10T12:54:17Z

Sources/StreamChatUI/Composer/ComposerVC.swift

+        let mediaTypes: [String] = {
+            let availableTypes = UIImagePickerController.availableMediaTypes(for: .savedPhotosAlbum) ?? ["public.image"]
+            let allowed = channelController?.client.appSettings?.imageUploadConfig.allowedUTITypes ?? []
+            return allowed.isEmpty ? availableTypes : allowed
+        }()
        let picker = UIImagePickerController()
-        picker.mediaTypes = UIImagePickerController.availableMediaTypes(for: .savedPhotosAlbum) ?? ["public.image"]
+        picker.mediaTypes = mediaTypes
        picker.sourceType = .savedPhotosAlbum
        picker.delegate = self
        return picker
    }()


By default we get public.image and public.video from the availableMediaTypes. I researched it but I haven't found a way to convert these high level UTIs to their subtypes. If I could do that, I could:

Get the list of all subtypes

Filter all of the subtypes based on imageUploadConfig.blockedUTITypes and imageUploadConfig.allowedUTITypes

Currently I did not figure out how to handle the case where I would create imageUploadConfig with, let's say, blocked mime type of image/jpeg, and then assign UTI types to the picker which would exclude that mime type (aka public.jpeg in UTI terms).

So for now, I am only setting allow list to the picker. Which means that, I could still select a jpeg file and start the upload. Upload fails immediately because AttachmentQueueUploaded checks the block list. In this example, checking the image/jpeg mime type.

I spent some more time and does not seem feasible. I'll keep it like that and if we end up finding a way, we can change it later.

I am taking this out because it is a risky change. Did not realise this before. Picker will throw an exception if I would just do public.jpeg

Stream-SDK-Bot · 2025-01-10T13:04:46Z

SDK Size

`title`	`develop`	`branch`	`diff`	`status`
StreamChat	6.98 MB	7.0 MB	+17 KB	🟢
StreamChatUI	4.77 MB	4.77 MB	0 KB	🟢

Stream-SDK-Bot · 2025-01-10T13:10:15Z

SDK Performance

`target`	`metric`	`benchmark`	`branch`	`performance`	`status`
MessageList	Hitches total duration	10 ms	3.34 ms	66.6% 🔼	🟢
	Duration	2.6 s	2.54 s	2.31% 🔼	🟢
	Hitch time ratio	4 ms per s	1.32 ms per s	67.0% 🔼	🟢
	Frame rate	75 fps	78.42 fps	4.56% 🔼	🟢
	Number of hitches	1	0.4	60.0% 🔼	🟢

nuno-vieira

LGTM! ✅

Stream-SDK-Bot · 2025-01-13T08:09:02Z

SDK Size

`title`	`develop`	`branch`	`diff`	`status`
StreamChat	6.98 MB	7.0 MB	+18 KB	🟢
StreamChatUI	4.77 MB	4.77 MB	0 KB	🟢

nuno-vieira · 2025-01-13T13:14:25Z

CHANGELOG.md

@@ -5,6 +5,7 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/).

 ## StreamChat
 ### ✅ Added
+- Use `AppSettings.fileUploadConfig` and `AppSettings.imageUploadConfig` for blocking attachment uploads [#3556](https://github.com/GetStream/stream-chat-swift/pull/3556/)


We also need to add an entry to StreamChatUI, maybe a # Changed section that we now change the media types based on these configs @laevandus WDYT?

True, it should be mentioned. Thanks

… an exception

… was copied to the attachment storage

sonarqubecloud · 2025-01-14T11:54:39Z

Quality Gate passed

Issues
175 New issues
0 Accepted issues

Measures
0 Security Hotspots
83.8% Coverage on New Code
0.1% Duplication on New Code

See analysis details on SonarQube Cloud

Use allow and block lists for uploading files and images in the attac…

f767081

…hment uploader and in image and file pickers

laevandus added 🌐 SDK: StreamChat (LLC) Tasks related to the StreamChat LLC SDK 🎨 SDK: StreamChatUI Tasks related to the StreamChatUI SDK ✅ Feature An issue or PR related to a feature labels Jan 10, 2025

laevandus requested a review from a team as a code owner January 10, 2025 12:47

laevandus commented Jan 10, 2025

View reviewed changes

nuno-vieira approved these changes Jan 10, 2025

View reviewed changes

laevandus changed the title ~~[WIP] Use allow and block lists for uploading files and images~~ Use allow and block lists for uploading files and images Jan 13, 2025

Remove unused extension

c585bce

laevandus added the 🤞 Ready For QA A PR that is Ready for QA label Jan 13, 2025

Add CHANGELOG entry

75d700c

martinmitrevski approved these changes Jan 13, 2025

View reviewed changes

laevandus mentioned this pull request Jan 13, 2025

Use AppSettings.fileUploadConfig for setting supported UTI types for the file picker GetStream/stream-chat-swiftui#713

Merged

4 tasks

nuno-vieira reviewed Jan 13, 2025

View reviewed changes

laevandus added 4 commits January 13, 2025 16:07

Changelog entry for StreamChatUI

a22a247

Do not set media types for photo picker because it can easily lead to…

7101167

… an exception

Documentation for new public functions

783cf05

Validate attachment after preparing if for making sure the local file…

5df9fb9

… was copied to the attachment storage

testableapple added 🟢 QAed A PR that was QAed and removed 🤞 Ready For QA A PR that is Ready for QA labels Jan 14, 2025

Merge branch 'develop' into feature/app-settings-upload-configs

b615255

laevandus enabled auto-merge (squash) January 14, 2025 11:34

laevandus merged commit f3fccb0 into develop Jan 14, 2025
14 checks passed

laevandus deleted the feature/app-settings-upload-configs branch January 14, 2025 12:23

Stream-SDK-Bot mentioned this pull request Jan 14, 2025

4.70.0 Release #3559

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Use allow and block lists for uploading files and images #3556

Use allow and block lists for uploading files and images #3556

laevandus commented Jan 10, 2025 •

edited

Loading

laevandus Jan 10, 2025 •

edited

Loading

laevandus Jan 13, 2025

laevandus Jan 14, 2025

Stream-SDK-Bot commented Jan 10, 2025

Stream-SDK-Bot commented Jan 10, 2025

nuno-vieira left a comment

Stream-SDK-Bot commented Jan 13, 2025 •

edited

Loading

nuno-vieira Jan 13, 2025

laevandus Jan 13, 2025

sonarqubecloud bot commented Jan 14, 2025

Use allow and block lists for uploading files and images #3556

Use allow and block lists for uploading files and images #3556

Conversation

laevandus commented Jan 10, 2025 • edited Loading

🔗 Issue Links

🎯 Goal

📝 Summary

🛠 Implementation

🎨 Showcase

🧪 Manual Testing Notes

Case 1: Block list using path extensions

Case 2: Block list using mime types

Case 3: Allow list using path extensions

Case 4: Allow list using mime types

☑️ Contributor Checklist

laevandus Jan 10, 2025 • edited Loading

Choose a reason for hiding this comment

laevandus Jan 13, 2025

Choose a reason for hiding this comment

laevandus Jan 14, 2025

Choose a reason for hiding this comment

Stream-SDK-Bot commented Jan 10, 2025

SDK Size

Stream-SDK-Bot commented Jan 10, 2025

SDK Performance

nuno-vieira left a comment

Choose a reason for hiding this comment

Stream-SDK-Bot commented Jan 13, 2025 • edited Loading

SDK Size

nuno-vieira Jan 13, 2025

Choose a reason for hiding this comment

laevandus Jan 13, 2025

Choose a reason for hiding this comment

sonarqubecloud bot commented Jan 14, 2025

Quality Gate passed

laevandus commented Jan 10, 2025 •

edited

Loading

laevandus Jan 10, 2025 •

edited

Loading

Stream-SDK-Bot commented Jan 13, 2025 •

edited

Loading