fix: escape regex operators in upload accept pattern

vaadin · Jun 25, 2024 · 5a5605f · 5a5605f
1 parent be72a81
commit 5a5605f
Showing 1 changed file with 4 additions and 1 deletion.
diff --git a/src/vaadin-upload.html b/src/vaadin-upload.html
@@ -754,7 +754,10 @@
             return;
           }
           const fileExt = file.name.match(/\.[^\.]*$|$/)[0];
-          const re = new RegExp('^(' + this.accept.replace(/[, ]+/g, '|').replace(/\/\*/g, '/.*') + ')$', 'i');
+          // Escape regex operators common to mime types
+          const escapedAccept = this.accept.replace(/[+.]/g, '\\$&');
+          // Create accept regex that can match comma separated patterns, star (*) wildcards
+          const re = new RegExp(`^(${escapedAccept.replace(/[, ]+/g, '|').replace(/\/\*/g, '/.*')})$`, 'i');
           if (this.accept && !(re.test(file.type) || re.test(fileExt))) {
             this.dispatchEvent(
               new CustomEvent('file-reject', {