fix(ramp): sanitize MIME type before embedding in multipart header

waleedlatif1 · waleedlatif1 · commit da035faf7f77 · 2026-06-11T16:51:36.000-07:00
diff --git a/apps/sim/app/api/tools/ramp/upload-receipt/route.ts b/apps/sim/app/api/tools/ramp/upload-receipt/route.ts
@@ -39,9 +39,10 @@ function buildReceiptMultipartBody(
   }
 
   const safeFileName = file.name.replace(/[\r\n"]/g, '_')
+  const safeContentType = file.type.replace(/[\r\n]/g, '') || 'application/octet-stream'
   parts.push(
     Buffer.from(
-      `--${boundary}\r\nContent-Disposition: attachment; name="receipt"; filename="${safeFileName}"\r\nContent-Type: ${file.type}\r\n\r\n`
+      `--${boundary}\r\nContent-Disposition: attachment; name="receipt"; filename="${safeFileName}"\r\nContent-Type: ${safeContentType}\r\n\r\n`
     )
   )
   parts.push(file.buffer)

Original file line number	Diff line number	Diff line change
`@@ -39,9 +39,10 @@ function buildReceiptMultipartBody(`
`39`	`39`	`}`
`40`	`40`
`41`	`41`	`const safeFileName = file.name.replace(/[\r\n"]/g, '_')`
	`42`	`+ const safeContentType = file.type.replace(/[\r\n]/g, '') \|\| 'application/octet-stream'`
`42`	`43`	`parts.push(`
`43`	`44`	`Buffer.from(`
`44`		- `--${boundary}\r\nContent-Disposition: attachment; name="receipt"; filename="${safeFileName}"\r\nContent-Type: ${file.type}\r\n\r\n`
	`45`	+ `--${boundary}\r\nContent-Disposition: attachment; name="receipt"; filename="${safeFileName}"\r\nContent-Type: ${safeContentType}\r\n\r\n`
`45`	`46`	`)`
`46`	`47`	`)`
`47`	`48`	`parts.push(file.buffer)`