From 5adf526995532b6d136ceec137c4e5588a6ca7d4 Mon Sep 17 00:00:00 2001
From: sriram veeraghanta <veeraghanta.sriram@gmail.com>
Date: Fri, 15 May 2026 01:54:23 +0530
Subject: [PATCH] fix: reject suspicious filenames and match file icons
 case-insensitively

- Short-circuit validateAndDetectFileType when validateFilename flags a
  suspicious name so files like foo.exe.md cannot bypass the attachment
  allowlist via the new extension MIME fallback.
- Lowercase fileType in getFileIcon so uppercase extensions (e.g. .MD,
  .PDF) resolve to the correct icon.
---
 apps/web/core/components/icons/attachment/attachment-icon.tsx | 2 +-
 packages/services/src/file/helper.ts                          | 1 +
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/apps/web/core/components/icons/attachment/attachment-icon.tsx b/apps/web/core/components/icons/attachment/attachment-icon.tsx
index 1ac6c2a033..9e4f369231 100644
--- a/apps/web/core/components/icons/attachment/attachment-icon.tsx
+++ b/apps/web/core/components/icons/attachment/attachment-icon.tsx
@@ -25,7 +25,7 @@ import {
 } from "@/components/icons/attachment";
 
 export const getFileIcon = (fileType: string, size: number = 28) => {
-  switch (fileType) {
+  switch (fileType.toLowerCase()) {
     case "pdf":
       return <PdfIcon height={size} width={size} />;
     case "csv":
diff --git a/packages/services/src/file/helper.ts b/packages/services/src/file/helper.ts
index 8f3f5b8ee9..19635f06f4 100644
--- a/packages/services/src/file/helper.ts
+++ b/packages/services/src/file/helper.ts
@@ -114,6 +114,7 @@ const validateAndDetectFileType = async (file: File): Promise<string> => {
   const filenameError = validateFilename(file.name);
   if (filenameError) {
     console.warn(`File validation warning: ${filenameError}`);
+    return "";
   }
 
   try {