Skip to content

AttachmentsService: Emit observable events for security-relevant upload/download rejections #400

@ansgarlichter

Description

@ansgarlichter

Is your feature request related to a problem? Please describe.
Currently, AttachmentsService only emits two events: DeleteAttachment and DeleteInfectedAttachment. Security-relevant upload and download rejections (invalid MIME type, file size exceeded) are handled entirely internally by the plugin without emitting any observable event.
Applications that need to audit-log these security events are forced to register their own before('PUT', ...), before('GET', ...), and on('error', ...) handlers directly on each application service entity.

If you agree, I am happy to submit a PR for this change.

Describe the solution you'd like
Emit dedicated events on AttachmentsService for the following security-relevant cases:

Event When to emit Suggested payload
AttachmentUploadRejected MIME type not in @Core.AcceptableMediaTypes { target, keys, filename, mimeType, reason }
AttachmentDownloadRejected MIME type blocked on download { target, keys, filename, mimeType }
AttachmentSizeExceeded File exceeds @Validation.Maximum { target, keys, filename, fileSize, maxFileSize }

The existing DeleteInfectedAttachment event is already a good model for this pattern and serves the malware detection case well.

Describe alternatives you've considered
Registering custom handlers in every application works but events would be cleaner and more reliable.

Additional context
N/A

Have you already checked existing issues before creating a feature request?
Yes

Customer Info
Company: SAP Consulting

Metadata

Metadata

Assignees

No one assigned

    Labels

    enhancementNew feature or request

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions