I'm using a Slack bot to upload a file via Slack API. File format is .csv, extension is .csv and I specify that filetype=csv. Yet, Slack API (file.upload) response tells me that Slack accepted my file as a Python file and forcefully appended a .py extension to it. Now every time anyone downloads that file, it's .csv file with a .py extension.
My guess is that it sees the """ and immediately thinks "oh, I know! It's a python-ish comment! it must be a Python file, regardless of what the requester says - I know better! I'll rename that file for him!"
Repro:
file (it was a valid csv, I've just trimmed its contents down)
/tmp/playground/slack_py_repro$ cat test_run_6588_errors_summary_by-action_report.csv
HTTP Status-Code=504 (Gateway Time-out) for ""{URL}"""
HTTP Status-Code=504 (Gateway Time-out) for ""{URL}"""
/tmp/playground/slack_py_repro$ curl -sLk -F file=@test_run_6588_errors_summary_by-action_report.csv -F "filename=test_run_6588_errors_summary_by-action_report.csv" -F "filetype=csv" -F "channels=${CHANNEL}" -H "Authorization: Bearer ${TOKEN}" https://slack.com/api/files.upload | jq
{
"ok": true,
"file": {
"id": "<HIDDEN>",
"created": 1655497834,
"timestamp": 1655497834,
"name": "test_run_6588_errors_summary_by-action_report.csv.py",
"title": "test run 6588 errors summary by-action report.csv",
"mimetype": "text/plain",
"filetype": "python",
"pretty_type": "Python",
"editable": true,
"size": 110,
"mode": "snippet",
"is_external": false,
"external_type": "",
"is_public": false,
/* ... */
}
}
FWIW I think it also poses a security risk. I may upload a malicious Python file with a .csv extension, on the Slack web it'll say it's a .csv file, but when downloaded it'll become a .csv.py and an inattentive user will open it up expecting to see a spreadsheet. Of course, a Python runtime will kick in and it's a ggwp for that poor lad's computer/data/network.
What am I doing wrong? How do I tell the Slack API to keep its fingers away from my files' extensions?