Add support to restrict @Core.AcceptableMediaTypes by samyuktaprabhu · Pull Request #732 · cap-java/cds-feature-attachments

samyuktaprabhu · 2026-02-11T14:39:28Z

Add Support to Restrict @Core.AcceptableMediaTypes

✨ New Features

Introduced support for restricting allowed MIME types for attachments using the @Core.AcceptableMediaTypes annotation. This feature enables validation of file types during upload at HandlerOrder.BEFORE, ensuring only specified media types are accepted before processing begins.

🔧 Changes

Core Implementation

CreateAttachmentsHandler.java: Added new @Before handler method processBeforeForMetadata that validates acceptable media types early in the request lifecycle using CdsRuntime dependency. Updated constructor to accept CdsRuntime parameter for metadata validation support.
AttachmentValidationHelper.java (new): Created comprehensive helper class for media type validation with extensive MIME type mapping (70+ common formats including images, documents, videos, fonts). Implements validation logic with support for wildcard patterns (image/*) and default fallback behavior (*/*).
MediaTypeResolver.java (new): Extracts acceptable media types from CDS entity annotations, handling both direct media entities and composed attachments.
MediaTypeService.java (new): Provides MIME type resolution from file extensions and validates against acceptable media types, supporting exact matches and wildcard patterns.
FileNameValidator.java (new): Validates file name format, ensuring files have proper extensions before MIME type validation.
AttachmentDataExtractor.java (new): Extracts file names from attachment data, validating presence of required file name fields.
Registration.java: Updated handler registration to pass CdsRuntime instance to CreateAttachmentsHandler.
ApplicationHandlerHelper.java: Added deepSearchForAttachments() method to recursively check for attachment compositions in entity hierarchies.
DraftCancelAttachmentsHandler.java: Refactored to use shared deepSearchForAttachments() method from ApplicationHandlerHelper.

Documentation

README.md: Added comprehensive documentation for the @Core.AcceptableMediaTypes annotation, including:
- Examples of exact matches (image/jpeg, image/png)
- Wildcard patterns (image/*)
- Default behavior (*/*)
- Usage scenarios for both single and multiple media types

Test Suite

CreateAttachmentsHandlerTest.java: Added tests for new metadata validation handler
AttachmentValidationHelperTest.java (new): Comprehensive test suite with 16+ test cases covering MIME type detection, validation, wildcards, error scenarios, and edge cases (including hidden files like .gitignore)
MediaTypeResolverTest.java (new): Tests for media type extraction from entity annotations
MediaTypeServiceTest.java (new): Tests for MIME type resolution and validation logic
FileNameValidatorTest.java (new): Tests for file name format validation
AttachmentDataExtractorTest.java (new): Tests for file name extraction from attachment data
MediaValidatedAttachmentsDraftTest.java (new): Integration tests for draft service media validation with parameterized tests for various file types
MediaValidatedAttachmentsNonDraftTest.java (new): Integration tests for non-draft service media validation, including deep create scenarios
ApplicationHandlerHelperTest.java: Updated test imports
SizeLimitedAttachmentsSizeValidationDraftTest.java: Added file name assignments to test cases
SizeLimitedAttachmentValidationNonDraftTest.java: Added file name assignments to test cases

Integration Test Configuration

data-model.cds: Added mediaValidatedAttachments and mimeValidatedAttachments compositions to Roots entity
test-service.cds: Configured annotations to accept only JPEG and PNG images for mediaValidatedAttachments, and PDFs for mimeValidatedAttachments
RootEntityBuilder.java: Enhanced builder to support media-validated attachments with proper initialization

Sample Application

samples/bookshop/srv/attachments.cds:
- Added mediaValidatedAttachments and attachments2 compositions to Books entity
- Configured mediaValidatedAttachments to accept only JPEG and PNG images
- Configured attachments2 to accept only PDF files
- Updated UI facets to display mediaValidatedAttachments in the Administrator App
- Added new non-draft service for testing purposes

🔄 Regenerate and Update Summary

📬 Subscribe to the Hyperspace PR Bot DL to get the latest announcements and pilot features!

PR Bot Information

Version: 1.17.73 | 📖 Documentation | 🚨 Create Incident | 💬 Feedback

Event Trigger: pull_request.edited
Summary Prompt: Default Prompt
LLM: anthropic--claude-4.5-sonnet
Output Template: Default Template
Correlation ID: b90175b0-126a-11f1-8fb8-2c3dc5f1e257

hyperspace-insights

The PR adds media type restriction support for attachments. I've identified a few issues: a typo in MIME type definitions (application/txt should be text/plain), potential security concerns with filename validation (missing path traversal checks), and a minor note about null handling. Overall the implementation is reasonable but needs these corrections before merging.

PR Bot Information

Version: 1.17.53 | 📖 Documentation | 🚨 Create Incident | 💬 Feedback

Event Trigger: pull_request.opened
LLM: anthropic--claude-4.5-sonnet
Correlation ID: 78c854a0-0757-11f1-833c-299ee35f3dc8

...ap/cds/feature/attachments/handler/applicationservice/helper/AttachmentValidationHelper.java

...s/src/main/java/com/sap/cds/feature/attachments/handler/common/ApplicationHandlerHelper.java

...ap/cds/feature/attachments/handler/applicationservice/helper/AttachmentValidationHelper.java

hyperspace-insights

Summary

The pull request introduces MIME type validation for attachments with good test coverage. However, several null safety issues were identified in the validation logic that could lead to NullPointerException errors. Additionally, a minor CDS syntax inconsistency and a misleading test variable name should be addressed.

PR Bot Information

Version: 1.17.61 | 📖 Documentation | 🚨 Create Incident | 💬 Feedback

Event Trigger: issue_comment.created
Correlation ID: b7b79080-0bdb-11f1-9b97-78cdc3653ab1
LLM: anthropic--claude-4.5-sonnet

...ap/cds/feature/attachments/handler/applicationservice/helper/AttachmentValidationHelper.java

...s/src/main/java/com/sap/cds/feature/attachments/handler/common/ApplicationHandlerHelper.java

integration-tests/db/data-model.cds

...ture/attachments/integrationtests/nondraftservice/MediaValidatedAttachmentsNonDraftTest.java

Schmarvinius

Unit-Tests:

AttachmentCalidationHelperTest:
- Add a test for wildcard subtype rejection like image/* should reject application/pdf
- Add a test for files start with . like .gitignore or .ssh or .zshrc and so on

Integration-Tests:

MediaCalidatedAttachmentsDraftTest:
- Add a test for false inputs like an empty string. You have them for non draft but not for draft.
- Add tests for situations where it fails like upload a pdf when only jpeg or image/* is allowed
  - Also one for dotfiles
MediaValidatedAttachmentsNonDraftTest:
- Add a test for case sensitivity in the extension
- Add a test for no extension
- Add a test for hidden files again

...ap/cds/feature/attachments/handler/applicationservice/helper/AttachmentValidationHelper.java

...ds/feature/attachments/handler/applicationservice/helper/AttachmentValidationHelperTest.java

...ds/feature/attachments/integrationtests/draftservice/MediaValidatedAttachmentsDraftTest.java

hyperspace-insights

Summary

This PR introduces MIME type validation for attachments with generally solid implementation. I've identified 9 substantive issues requiring attention:

Critical: Missing file extension validation in MediaTypeService.resolveMimeType() could cause runtime errors
Important: Inconsistent filename validation between extractor and validator creates confusing error paths
Security consideration: FileNameValidator doesn't check for path traversal characters (e.g., ../, null bytes)
Several performance and code quality improvements around duplicate constants, inefficient stream operations, and wildcard matching logic

The test coverage is comprehensive, and the feature design is well-thought-out. Address the validation and error-handling gaps before merging.

PR Bot Information

Version: 1.17.72 | 📖 Documentation | 🚨 Create Incident | 💬 Feedback

LLM: anthropic--claude-4.5-sonnet
Event Trigger: issue_comment.created
Correlation ID: a7941f80-1242-11f1-91ae-db28216a7610

...om/sap/cds/feature/attachments/handler/applicationservice/helper/media/MediaTypeService.java

...chments/handler/applicationservice/helper/mimeTypeValidation/AttachmentValidationHelper.java

...m/sap/cds/feature/attachments/handler/applicationservice/helper/AttachmentDataExtractor.java

.../cds/feature/attachments/handler/applicationservice/helper/validation/FileNameValidator.java

...ava/com/sap/cds/feature/attachments/handler/applicationservice/CreateAttachmentsHandler.java

...s/src/main/java/com/sap/cds/feature/attachments/handler/common/ApplicationHandlerHelper.java

Schmarvinius

I think your whole structe has gotten very complicated.
Why don't you merge FileNameValidator + MediaTypeService + MediaTypeResolver + AttachmentValidationHelper into one MediaTypeValidator
And keep the DataExtractor as-is. This reduces complexity and keeps separation of concern to a healthy degree.

...re-attachments/src/main/java/com/sap/cds/feature/attachments/configuration/Registration.java

...om/sap/cds/feature/attachments/handler/applicationservice/helper/media/MediaTypeService.java

...ure/attachments/handler/applicationservice/helper/validation/AttachmentValidationHelper.java

...m/sap/cds/feature/attachments/handler/applicationservice/helper/AttachmentDataExtractor.java

samyuktaprabhu · 2026-02-27T17:52:08Z

I think your whole structe has gotten very complicated.
Why don't you merge FileNameValidator + MediaTypeService + MediaTypeResolver + AttachmentValidationHelper into one MediaTypeValidator
And keep the DataExtractor as-is. This reduces complexity and keeps separation of concern to a healthy degree.

Thanks for your review &suggestion. I merged FileNameValidator & AttachmentDataExtractor. I tried doing the merge for the other 3 files, but, if we do that, we'd end up making it harder to test, and also make it harder to reuse later.

…chments/configuration/Registration.java Co-authored-by: Marvin <marvin.lindner@sap.com> Update cds-feature-attachments/src/main/java/com/sap/cds/feature/attachments/configuration/Registration.java Co-authored-by: Marvin <marvin.lindner@sap.com> Update cds-feature-attachments/src/main/java/com/sap/cds/feature/attachments/configuration/Registration.java Co-authored-by: Marvin <marvin.lindner@sap.com> Update cds-feature-attachments/src/main/java/com/sap/cds/feature/attachments/configuration/Registration.java Co-authored-by: Marvin <marvin.lindner@sap.com> apply mvnspotless:apply Rename AttachmentDataExtractor to validation package Refactor MediaTypeService to use URLConnection for MIME type resolution and update AttachmentValidationHelper method visibility Refactor AttachmentValidationHelper to streamline MIME type validation logic Add unit tests for AssociationCascader and refactor AttachmentValidationHelper and MediaTypeResolver to utilize AssociationCascader for media entity resolution Refactor MediaTypeResolver to remove dependency on ApplicationHandlerHelper and update related tests Refactor file name validation logic and migrate to mimeTypeValidation package Refactor AttachmentDataExtractor to integrate filename validation logic and remove FileNameValidator class Refactor AttachmentDataExtractor and update tests to improve structure and maintainability Refactor AttachmentValidationHelper and MediaTypeResolver to improve structure and add unit tests for media type resolution revert a change

hyperspace-insights bot reviewed Feb 11, 2026

View reviewed changes

samyuktaprabhu changed the title ~~Add support to restrict media types~~ Add support to restrict @Core.AcceptableMediaTypes Feb 11, 2026

samyuktaprabhu force-pushed the sam-restrict-media-types-409 branch from 8b6c095 to a12bc05 Compare February 17, 2026 08:35

samyuktaprabhu self-assigned this Feb 17, 2026

hyperspace-insights bot reviewed Feb 17, 2026

View reviewed changes

hyperspace-insights bot deleted a comment from samyuktaprabhu Feb 17, 2026

samyuktaprabhu marked this pull request as ready for review February 17, 2026 08:36

samyuktaprabhu requested a review from Schmarvinius February 17, 2026 09:21

samyuktaprabhu force-pushed the sam-restrict-media-types-409 branch from e2b000e to 26b499c Compare February 17, 2026 09:36

Schmarvinius requested changes Feb 18, 2026

View reviewed changes

samyuktaprabhu requested a review from Schmarvinius February 18, 2026 15:27

single commit

e98f840

samyuktaprabhu force-pushed the sam-restrict-media-types-409 branch from 3df6d49 to e98f840 Compare February 25, 2026 08:40

multi attachments

3422412

hyperspace-insights bot reviewed Feb 25, 2026

View reviewed changes

hyperspace-insights bot deleted a comment from samyuktaprabhu Feb 25, 2026

samyuktaprabhu added 4 commits February 25, 2026 17:08

solve bot reiew comments

4cf1c1d

apply formatting

9e94a58

add comments

29f1455

code formatting

1315776

samyuktaprabhu requested a review from busehalis-sap February 26, 2026 08:44

Schmarvinius requested changes Feb 26, 2026

View reviewed changes

samyuktaprabhu marked this pull request as draft February 27, 2026 11:26

samyuktaprabhu force-pushed the sam-restrict-media-types-409 branch from 534423e to ab8ab07 Compare February 27, 2026 19:05

samyuktaprabhu force-pushed the sam-restrict-media-types-409 branch from 46592c3 to c458640 Compare February 27, 2026 19:07

Conversation

samyuktaprabhu commented Feb 11, 2026 • edited by hyperspace-insights bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Add Support to Restrict @Core.AcceptableMediaTypes

✨ New Features

🔧 Changes

Core Implementation

Documentation

Test Suite

Integration Test Configuration

Sample Application

Uh oh!

hyperspace-insights bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

hyperspace-insights bot left a comment

Choose a reason for hiding this comment

Summary

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Schmarvinius left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

hyperspace-insights bot left a comment

Choose a reason for hiding this comment

Summary

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Schmarvinius left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

samyuktaprabhu commented Feb 27, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

samyuktaprabhu commented Feb 11, 2026 •

edited by hyperspace-insights bot

Loading

Schmarvinius left a comment •

edited

Loading