From 99e8feff4800df3b316c425e2418440bba586af6 Mon Sep 17 00:00:00 2001
From: kitos <kitos@aegis.local>
Date: Mon, 27 Jul 2026 14:40:45 +0200
Subject: [PATCH] feat(evidence): allow .exe uploads for Red-team artifacts
 shared with Blue

The evidence upload extension whitelist blocked .exe entirely, but sharing
a Red team payload binary with Blue for detection analysis is a normal
part of this platform's workflow.
---
 backend/app/services/evidence_service.py      |  2 ++
 .../tests/test_evidence_file_validation.py    | 28 +++++++++++++++++++
 2 files changed, 30 insertions(+)
 create mode 100644 backend/tests/test_evidence_file_validation.py

diff --git a/backend/app/services/evidence_service.py b/backend/app/services/evidence_service.py
index 70393aa..bc9f9f7 100644
--- a/backend/app/services/evidence_service.py
+++ b/backend/app/services/evidence_service.py
@@ -57,6 +57,8 @@ ALLOWED_EXTENSIONS: frozenset[str] = frozenset({
     ".zip", ".tar", ".gz", ".7z",
     # Literal argument value
     ".har", ".eml", ".msg",
+    # Red team artifacts shared with Blue for detection analysis.
+    ".exe",
 })
 
 
diff --git a/backend/tests/test_evidence_file_validation.py b/backend/tests/test_evidence_file_validation.py
new file mode 100644
index 0000000..5141419
--- /dev/null
+++ b/backend/tests/test_evidence_file_validation.py
@@ -0,0 +1,28 @@
+"""Evidence upload file-type validation — Red team artifacts (e.g. .exe
+payloads) must be shareable with Blue for detection analysis."""
+
+import pytest
+
+from app.domain.errors import BusinessRuleViolation
+from app.services.evidence_service import validate_file
+
+
+def test_exe_files_are_allowed():
+    validate_file("payload.exe", 1024)
+
+
+def test_allowed_extensions_still_pass():
+    for name in ("screenshot.png", "notes.pdf", "capture.pcap", "archive.zip"):
+        validate_file(name, 1024)
+
+
+def test_disallowed_extension_still_rejected():
+    with pytest.raises(BusinessRuleViolation):
+        validate_file("script.sh", 1024)
+
+
+def test_oversized_file_still_rejected():
+    from app.services.evidence_service import MAX_UPLOAD_SIZE
+
+    with pytest.raises(BusinessRuleViolation):
+        validate_file("payload.exe", MAX_UPLOAD_SIZE + 1)