Specify where a file should be uploaded

[Meglali20]

New Feature / Enhancement Checklist

• [x] I am not disclosing a vulnerability.
• [x] I am not just asking a question.
• [x] I have searched through existing issues.

Current Limitation

When trying to upload a file using parse-server-fs-adapter, if you try to specify the folder where a file should be uploaded (for example: folder1.ext) there is an issue where parse server would not allow the the post request.

Feature / Enhancement Description

Add a config option that would specify the files structure, and what subfolders are allowed to be used.

Example Use Case

uploading a file named file1.ext works but when specifying the folder to where to upload the files such as folder1/file1.ext won't work, same as described in this issue https://github.com/parse-community/parse-server-s3-adapter/issues/16

Alternatives / Workarounds

3rd Party References

[parse-github-assistant[bot]]

Thanks for opening this issue!

• 🎉 We are excited about your ideas for improvement!

[mtrezza]

From the related discussions (https://github.com/parse-community/parse-server-s3-adapter/issues/16 and linked), it seems that Parse Server has been prepared to handle directories by allowing the filename to be a path (https://github.com/parse-community/Parse-Swift/issues/417#issuecomment-1250171330), but it depends on the adapter to be able to handle the path. So this issue may belong to parse-server-fs-adapter (you don't have to open a new one, we can transfer this issue if needed).

The S3 adapter PRs for this could be a first guideline for implementing this in the FS adapter. We'd be happy to review a PR if you want to give it a try.

[Meglali20]

I see that in ((https://github.com/parse-community/Parse-Swift/issues/417#issuecomment-1250171330)) There is a workaround by separating the folder and the filename with "%2F" instead of "/", if you use "/" parse server don't allow the request to be made and returns a POST error instead. I did try to make changes to the FS adapter but the call to the adapter wasn't reached because the POST error occurred before that. A proper solution from the server side could be implemented with additional features such as who is authorized to upload to specific folders and that also would be mentioned in the parse documentation. Also keep in mind that if you set the option preserveFileName to false, the filename might become too long.

[mtrezza]

Got it;

• An adapter doesn't have a dedicated Parse Server class, so one solution could to be to add a callback to Parse Server (or the storage adapter) that returns true for allowed and false for denied upload. You can then implement your own logic depending on your use case. I would just make the whole path (filename) available in the call back and you can regex it yourself, to limit on path, or even filename or file extension.
• The other issue is that Parse Server would have to allow a path separator / in the filename. This would need to be examined closely for security implications. For example prevent relative paths like ../../../ to point to directories that are out of scope. Security review for this feature will likely require a considerable effort.

[Meglali20]

Adding this to the parse server side would also make it possible to handle directory permissions, such as making a directory accept uploads only and not serving files or the opposite. or even add the option of which directories to encrypt files for example an app that has public posts the files wouldn't be encrypted but the files shared via a chat can be encrypted.