Issue Station
Sign In
Tools hereToolbox

openclaw - ✅(Solved) Fix CSV (text/csv) rejected by HOST_READ_ALLOWED_DOCUMENT_MIMES allowlist [1 pull requests, 1 comments, 2 participants]

Official PRs (…)
ON THIS PAGE

Recommended Tools

×6

Utilities matched from this issue’s tags and category — try them while you read without losing context.

GitHub issue graph ai analysis

Paste a GitHub issue URL. We fetch that issue, discover linked issues from bodies/comments/timeline, collect linked pull requests, and produce a structured English report.

The report is written in English Markdown for sharing and archival.

Helpful · Quick feedback

Loading…
GitHub stats
openclaw/openclaw#63604•Fetched 2026-04-10 03:42:33
View on GitHub
Comments
1
Participants
2
Timeline
4
Reactions
0
Author
oferlaoroferlaor
Participants
ArtyomkunArtyomkunoferlaoroferlaor
Timeline (top)
referenced ×2commented ×1cross-referenced ×1

Error Message

Note: the error says got unknown because the content-type isn't passed in the params — the MIME detection happens earlier in the pipeline but the content-type isn't propagated to assertHostReadMediaAllowed.

Root Cause

HOST_READ_ALLOWED_DOCUMENT_MIMES in web-media-CQn3y5TB.js is a hardcoded allowlist of 7 MIME types:

const HOST_READ_ALLOWED_DOCUMENT_MIMES = new Set([
  'application/msword',
  'application/pdf',
  'application/vnd.ms-excel',
  'application/vnd.ms-powerpoint',
  'application/vnd.openxmlformats-officedocument.presentationml.presentation',
  'application/vnd.openxmlformats-officedocument.spreadsheetml.sheet',
  'application/vnd.openxmlformats-officedocument.wordprocessingml.document'
]);

CSV files (text/csv) are correctly detected by MIME_BY_EXT and classified as kind: 'document' by mediaKindFromMime, but then fail the second check against this narrower allowlist.

Fix Action

Fixed

PR fix notes

PR #63653: feat(media): allow host-local CSV uploads #63604

Description (problem / solution / changelog)

Summary

  • Problem: Host-local media uploads reject CSV files because text/csv is classified as document but blocked by a narrower host-read document MIME allowlist, and the error often shows unknown due to MIME not being propagated in the host-read check path.
  • Why it matters: message(action: "upload-file") cannot upload common data files like .csv even though MIME detection recognizes them.
  • What changed:
    • Allow text/csv in the host-read document MIME allowlist.
    • Propagate contentType as verifiedMime ?? detectedMime for the host-read policy check so plaintext-like formats don’t degrade to unknown when sniffing fails.
    • Add a regression test to ensure host-local CSV is allowed while host-local plaintext remains rejected.
  • What did NOT change (scope boundary): We did not broaden host-local allowances to text/plain / text/markdown or text/* generally.

Change Type (select all)

  • Feature
  • Bug fix
  • Refactor required for the fix
  • Docs
  • Security hardening
  • Chore/infra

Scope (select all touched areas)

  • Gateway / orchestration
  • Skills / tool execution
  • Auth / tokens
  • Memory / storage
  • Integrations
  • API / contracts
  • UI / DX
  • CI/CD / infra

Linked Issue/PR

  • Fixes #63604

User-visible / Behavior Changes

Host-local file uploads can now send .csv files (text/csv) when host-local media reads are permitted by policy.

Security Impact (required)

  • New permissions/capabilities? (No)
  • Secrets/tokens handling changed? (No)
  • New/changed network calls? (No)
  • Command/tool execution surface changed? (No)
  • Data access scope changed? (No)

Repro + Verification

Environment

  • OS: Linux
  • Runtime/container: Node (repo test runner)
  • Integration/channel (if any): message tool + host-local media policy path

Steps

  1. Create a local file data.csv.
  2. Upload it via message(action: "upload-file", filePath: "/path/to/data.csv", filename: "data.csv") in a host-local media policy path.
  3. Confirm the upload is accepted (previously rejected with Host-local media sends only allow ... (got unknown)).

Expected

  • .csv uploads are allowed and treated as a document with contentType: text/csv.

Actual (before)

  • Rejected by host-read allowlist; error often reported unknown MIME.

Evidence

  • Passing test: pnpm test src/infra/outbound/message-action-runner.media.test.ts

Human Verification (required)

  • Verified scenarios:
    • Host-local .csv attachment allowed with contentType: text/csv.
    • Host-local .txt attachment still rejected.
  • Edge cases checked:
    • MIME propagation no longer reports unknown when extension-based detection is available.
  • What I did not verify:
    • End-to-end upload to a real external channel (relies on existing channel upload handling).

Compatibility / Migration

  • Backward compatible? (Yes)
  • Config/env changes? (No)
  • Migration needed? (No)

Risks and Mitigations

  • Risk: Allowing CSV could enable accidental upload of sensitive structured data from host-local files.
    • Mitigation: Scope is limited to text/csv only; plaintext-like text/plain / text/markdown remain blocked by default.

Changed files

  • src/infra/outbound/message-action-runner.media.test.ts (modified, +61/-0)
  • src/media/web-media.ts (modified, +43/-6)

Code Example

Host-local media sends only allow images, audio, video, PDF, and Office documents (got unknown).

---

const HOST_READ_ALLOWED_DOCUMENT_MIMES = new Set([
  'application/msword',
  'application/pdf',
  'application/vnd.ms-excel',
  'application/vnd.ms-powerpoint',
  'application/vnd.openxmlformats-officedocument.presentationml.presentation',
  'application/vnd.openxmlformats-officedocument.spreadsheetml.sheet',
  'application/vnd.openxmlformats-officedocument.wordprocessingml.document'
]);

---

message(action: 'upload-file', channel: 'slack', target: '<channel>', filePath: '/path/to/file.csv', filename: 'data.csv')
RAW_BUFFERClick to expand / collapse

Problem

When attempting to upload a .csv file via the message tool (action: upload-file), the upload is rejected with:

Host-local media sends only allow images, audio, video, PDF, and Office documents (got unknown).

Root Cause

HOST_READ_ALLOWED_DOCUMENT_MIMES in web-media-CQn3y5TB.js is a hardcoded allowlist of 7 MIME types:

const HOST_READ_ALLOWED_DOCUMENT_MIMES = new Set([
  'application/msword',
  'application/pdf',
  'application/vnd.ms-excel',
  'application/vnd.ms-powerpoint',
  'application/vnd.openxmlformats-officedocument.presentationml.presentation',
  'application/vnd.openxmlformats-officedocument.spreadsheetml.sheet',
  'application/vnd.openxmlformats-officedocument.wordprocessingml.document'
]);

CSV files (text/csv) are correctly detected by MIME_BY_EXT and classified as kind: 'document' by mediaKindFromMime, but then fail the second check against this narrower allowlist.

Expected Behavior

text/csv (and potentially other common text document types like text/plain, text/markdown, text/tab-separated-values) should be allowed for host-local media uploads, since they are already recognized as document kind.

Reproduction

message(action: 'upload-file', channel: 'slack', target: '<channel>', filePath: '/path/to/file.csv', filename: 'data.csv')

Fails with: Host-local media sends only allow images, audio, video, PDF, and Office documents (got unknown).

Note: the error says got unknown because the content-type isn't passed in the params — the MIME detection happens earlier in the pipeline but the content-type isn't propagated to assertHostReadMediaAllowed.

Suggestion

Either:

  1. Add text/csv, text/plain, text/markdown, text/tab-separated-values to HOST_READ_ALLOWED_DOCUMENT_MIMES, or
  2. Make this configurable via a config key like tools.mediaAllowedDocumentMimes, or
  3. Allow all text/* MIME types since they're already classified as document kind

Version

OpenClaw 2026.4.8 (9ece252)

extent analysis

TL;DR

Add text/csv to the HOST_READ_ALLOWED_DOCUMENT_MIMES set to allow CSV file uploads.

Guidance

  • Modify the HOST_READ_ALLOWED_DOCUMENT_MIMES set in web-media-CQn3y5TB.js to include text/csv.
  • Consider adding other common text document types like text/plain, text/markdown, and text/tab-separated-values to the allowlist.
  • Alternatively, make the allowed document MIME types configurable via a config key like tools.mediaAllowedDocumentMimes.
  • Verify the fix by attempting to upload a CSV file using the message tool with the upload-file action.

Example

const HOST_READ_ALLOWED_DOCUMENT_MIMES = new Set([
  'application/msword',
  'application/pdf',
  'application/vnd.ms-excel',
  'application/vnd.ms-powerpoint',
  'application/vnd.openxmlformats-officedocument.presentationml.presentation',
  'application/vnd.openxmlformats-officedocument.spreadsheetml.sheet',
  'application/vnd.openxmlformats-officedocument.wordprocessingml.document',
  'text/csv' // Add this line
]);

Notes

This fix assumes that the HOST_READ_ALLOWED_DOCUMENT_MIMES set is the only restriction on allowed document types. If there are other checks or restrictions in place, additional modifications may be necessary.

Recommendation

Apply workaround: Add text/csv to the HOST_READ_ALLOWED_DOCUMENT_MIMES set, as this is a straightforward and targeted solution to the specific issue described.

Vote matrix · Quick signals

Works
Did the solution work? Tap to confirm.
Easy Fix
Was it a quick fix?
Time Saver
Did it save you time?
Blocking
Was it severely blocking?
Common Issue
Are others likely hitting this too?
Flaky / Intermittent
Is it intermittent?
Verified / Reproducible
Can you reproduce it reliably?
Loading…
#API routing#API middleware#SSR setup#ISR setup#authentication setup

Still need to ship something?

×6

Another batch ranked right after the header list — different links, same matching logic.

Back to top recommendations

TRENDING