GeezerVison

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
docs	Skipped		Jul 1, 2026 5:49pm

PR Summary

High Risk
Security fix on authorization for file read paths (parse, downloads, provider attachments); incorrect inference would break legitimate access or leave gaps, but the change narrows trust to key structure rather than client metadata.

Overview
Closes a cross-tenant file read where an authenticated user could point at another tenant’s private storage key but supply a world-readable storage context (e.g. og-images, workspace-logos) so verifyFileAccess granted access before download.

Server paths that resolve, download, or presign files now always derive storage context from the key prefix via inferContextFromKey, instead of honoring UserFile.context or other caller-controlled context. That applies to file parse (handleCloudFile), presigned URL / download helpers in file-utils.server.ts, and provider large-file attachments (presign and upload access checks).

Logging no longer distinguishes “explicit” vs “inferred” context because only key-based inference is used.

^{Reviewed by Cursor Bugbot for commit 3cc2692. Configure here.}

Greptile Summary

This PR hardens file attachment context handling across storage reads and provider uploads. The main changes are:

• Added a trusted context resolver that prefers key prefixes.
• Preserved non-public context fallback for legacy keys.
• Updated server utility and provider attachment paths to use the resolver.
• Added tests for mismatched public contexts and legacy private fallback.

Confidence Score: 4/5

This is close, but the download endpoint should be fixed before merging.

• The new resolver closes the public-context relabeling path in the updated utility and provider flows.
• The download endpoint still bypasses that resolver and fails on private legacy keys whose context is supplied separately.
• Affected clients can receive a failed download response for legitimate stored files.

apps/sim/app/api/files/download/route.ts

Important Files Changed

_{Reviews (4): Last reviewed commit: "fix" | Re-trigger Greptile}

@greptile

@greptile