Add the Ability to filter file uploads based on file extensions

api/src/org/labkey/api/premium/AntiVirusProviderRegistry.java

@@ -26,6 +26,6 @@ static void setInstance(AntiVirusProviderRegistry impl)
 
     default StandardServletMultipartResolver getMultipartResolver(ViewBackgroundInfo info)
     {
-        return new StandardServletMultipartResolver();
+        return new DefaultAVMultipartResolver();
     }
-}
+}

api/src/org/labkey/api/premium/DefaultAVMultipartResolver.java

@@ -0,0 +1,43 @@
+package org.labkey.api.premium;
+
+import jakarta.servlet.ServletException;
+import jakarta.servlet.http.HttpServletRequest;
+import jakarta.servlet.http.Part;
+import org.jetbrains.annotations.NotNull;
+import org.labkey.api.util.FileUtil;
+import org.springframework.web.multipart.MultipartException;
+import org.springframework.web.multipart.MultipartHttpServletRequest;
+import org.springframework.web.multipart.support.StandardMultipartHttpServletRequest;
+import org.springframework.web.multipart.support.StandardServletMultipartResolver;
+
+import java.io.IOException;
+
+public class DefaultAVMultipartResolver extends StandardServletMultipartResolver
+{
+    @Override
+    public @NotNull MultipartHttpServletRequest resolveMultipart(HttpServletRequest request) throws MultipartException
+    {
+        try
+        {
+            for (Part part : request.getParts())
+            {
+                // Filter to just file uploads
+                if (part.getSubmittedFileName() != null)
+                {
+                    FileUtil.checkAllowedFileName(part.getSubmittedFileName(), true);
+                    validate(part);
+                }
+            }
+        }
+        catch (IOException | ServletException e)
+        {
+            throw new MultipartException("Couldn't get uploaded files", e);
+        }
+        return new StandardMultipartHttpServletRequest(request, false);
+    }
+
+    protected void validate(Part part)
+    {
+        //do nothing by default, but give subclasses a chance to override
+    }
+}

api/src/org/labkey/api/settings/AppProps.java

@@ -255,4 +255,6 @@ static WriteableAppProps getWriteableInstance()
     @NotNull String getDistributionFilename();
 
     @NotNull Set<SupportedDatabase> getDistributionSupportedDatabases();
+
+    @NotNull List<String> getAllowedExtensions();
 }

api/src/org/labkey/api/settings/AppPropsImpl.java

@@ -661,6 +661,13 @@ public List<String> getExternalSourceHosts()
         return getExternalHosts(externalSourceHostURLs);
     }
 
+    @Override
+    @NotNull
+    public List<String> getAllowedExtensions()
+    {
+        return getExternalHosts(allowedFileExtensions);
+    }
+
     private List<String> getExternalHosts(RandomStartupProperties propName)
     {
         String urls = lookupStringValue(propName, "");

api/src/org/labkey/api/settings/RandomStartupProperties.java

@@ -36,6 +36,14 @@ public void setValue(WriteableAppProps writeable, String value)
             writeable.setExternalSourceHosts(Arrays.asList(StringUtils.split(value, AppPropsImpl.EXTERNAL_HOST_DELIMITER)));
         }
     },
+    allowedFileExtensions("Allowed file extensions")
+    {
+        @Override
+        public void setValue(WriteableAppProps writeable, String value)
+        {
+            writeable.setAllowedFileExtensions(Arrays.asList(StringUtils.split(value, AppPropsImpl.EXTERNAL_HOST_DELIMITER)));
+        }
+    },
     fileUploadDisabled("Disable file upload")
     {
         @Override

api/src/org/labkey/api/settings/WriteableAppProps.java

@@ -21,6 +21,7 @@
 import org.labkey.api.data.Container;
 import org.labkey.api.security.User;
 import org.labkey.api.util.ExceptionReportingLevel;
+import org.labkey.api.util.FileUtil;
 import org.labkey.api.util.UsageReportingLevel;
 import org.labkey.api.view.NavTreeManager;
 
@@ -235,4 +236,10 @@ private void setExternalHosts(RandomStartupProperties propName, @NotNull Collect
     {
         storeStringValue(propName, String.join(EXTERNAL_HOST_DELIMITER, externalSourceHosts));
     }
+
+    public void setAllowedFileExtensions(Collection<String> allowedFileExtensions)
+    {
+        setExternalHosts(RandomStartupProperties.allowedFileExtensions, allowedFileExtensions);
+        FileUtil.setExtensionChecker(AppProps.getInstance());
+    }
 }