able to upload all types of files after changing the extension to ".xlsx" in upload profile data tab

Register
Submit a solution
The challenge is finished.

Challenge Overview

Steps to Reproduce

  1. Open��https://skill-search.topcoder-dev.com/��web app
  2. Login with tonyj /appirio123
  3. Select topcoder as organization
  4. Navigate to third tab
  5. Now on your system, take a image file and change its's extension to ".xlsx"
  6. Now click on browse and select the file whose extension is changes in previous step and upload
  7. Notice the result

Screenshots or Screen Capture

<img width="1440" alt="Screenshot 2020-07-12 at 8 45 57 PM" src="https://user-images.githubusercontent.com/5712602/87250186-d95f9780-c480-11ea-9a73-f124ec759c71.png">

<img width="1440" alt="Screenshot 2020-07-12 at 8 46 08 PM" src="https://user-images.githubusercontent.com/5712602/87250188-debce200-c480-11ea-8b7f-679105062be7.png">

Current Results

able to upload all types of files after changing the extension to ".xlsx" in upload profile data tab

Expected Results

application must validate the MIME type of the file uploaded before saving it. This can be a big security risk.

Browser version and OS version

  • Device: MacBook Pro 13 inch
  • Browser: Chrome Version 83.0.4103.116 (Official Build) (64-bit)
  • OS Version: macOS Catalina 10.15.4


Final Submission Guidelines

Git issue link: https://github.com/topcoder-platform/u-bahn-app/issues/269

Review style

Final Review

Community Review Board

Approval

User Sign-Off

Challenge links

ID: 30134277