Rocket.chat: [BUG] Certain uploads cause RC to crash

[mickymiek]

Description:

We noticed our RocketChat instances were crashing. We managed to trace the issue to a user that was uploading an SVG file.

Steps to reproduce:

1. wget this file _(file omitted)_
2. Rename it to something.svg
3. Upload it to RocketChat

Expected behavior:

RocketChat shouldn't crash when uploading an SVG file.

Actual behavior:

RocketChat crashes when the file is uploaded

Server Setup Information:

• Version of Rocket.Chat Server: 1.2.1
• Operating System: Debian (CoreOS host)
• Deployment Method: Docker
• Number of Running Instances: 1
• DB Replicaset Oplog: On
• NodeJS Version: 8
• MongoDB Version: 4.0.10

Relevant logs:

thread '<unnamed>' panicked at 'called `Option::unwrap()` on a `None` value', libcore/option.rs:345:21

[snoopotic]

Someone is attacking us with that stupid :/

Any Idea to fix or workaround that?

[sampaiodiego]

thank you guys very much for your efforts.. I've omitted all information that could lead to potential attacks.. the issue is fixed and will be release on 1.3.0