[WIP] ass 0.15.0 #220
[WIP] ass 0.15.0 #220
Conversation
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
backend/routers/index.ts
Outdated
| router.post('/', async (req, res) => { | ||
|
|
||
| // Check user config | ||
| if (!UserConfig.ready) return res.status(500).type('text').send('Configuration missing!'); | ||
|
|
||
| // Does the file actually exist | ||
| if (!req.files || !req.files['file']) return res.status(400).type('text').send('No file was provided!'); | ||
|
|
||
| // Type-check the file data | ||
| const bbFile: BusBoyFile = req.files['file']; | ||
|
|
||
| // Prepare file move | ||
| const uploads = UserConfig.config.uploadsDir; | ||
| const timestamp = Date.now().toString(); | ||
| const destination = `${uploads}${uploads.endsWith('/') ? '' : '/'}${timestamp}_${bbFile.filename}`; | ||
| // todo: S3 | ||
|
|
||
| try { | ||
|
|
||
| // Move the file | ||
| await fs.move(bbFile.file, destination); | ||
|
|
||
| // Build ass metadata | ||
| const assFile: AssFile = { | ||
| fakeid: random({ length: UserConfig.config.idSize }), // todo: more generators | ||
| id: nanoid(32), | ||
| mimetype: bbFile.mimetype, | ||
| filename: bbFile.filename, | ||
| timestamp, | ||
| uploader: '0', // todo: users | ||
| save: { local: destination }, | ||
| sha256: '0' // todo: hashing | ||
| }; | ||
|
|
||
| log.debug('File saved to', assFile.save.local!); | ||
|
|
||
| // todo: save metadata | ||
|
|
||
| return res.type('json').send({ resource: `${req.ass.host}/${assFile.fakeid}` }); | ||
| } catch (err) { | ||
| log.error('Failed to upload file', bbFile.filename); | ||
| console.error(err); | ||
| return res.status(500).send(err); | ||
| } | ||
| }); |
Check failure
Code scanning / CodeQL
Missing rate limiting High
| } catch (err) { | ||
| log.error('Failed to upload file', bbFile.filename); | ||
| console.error(err); | ||
| return res.status(500).send(err); |
Check warning
Code scanning / CodeQL
Exception text reinterpreted as HTML Medium
| } catch (err) { | ||
| log.error('Failed to upload file', bbFile.filename); | ||
| console.error(err); | ||
| return res.status(500).send(err); |
Check warning
Code scanning / CodeQL
Information exposure through a stack trace Medium
backend/routers/setup.ts
Outdated
|
|
||
| // Static routes | ||
| router.get('/', (req, res) => UserConfig.ready ? res.redirect('/') : res.render('setup')); | ||
| router.get('/ui.js', (req, res) => UserConfig.ready ? res.send('') : res.type('text/javascript').sendFile(path.join('dist-frontend/setup.mjs'))); |
Check failure
Code scanning / CodeQL
Missing rate limiting High
| const Checkers: UserConfigTypeChecker = { | ||
| uploadsDir: (val) => { | ||
| try { | ||
| fs.pathExistsSync(val) |
Check failure
Code scanning / CodeQL
Uncontrolled data used in path expression High
| uploadsDir: (val) => { | ||
| try { | ||
| fs.pathExistsSync(val) | ||
| ? fs.accessSync(val) |
Check failure
Code scanning / CodeQL
Uncontrolled data used in path expression High
| try { | ||
| fs.pathExistsSync(val) | ||
| ? fs.accessSync(val) | ||
| : fs.mkdirSync(val, { recursive: true }); |
Check failure
Code scanning / CodeQL
Uncontrolled data used in path expression High
backend/routers/index.ts
Outdated
| router.get('/direct/:fakeId', async (req, res) => { | ||
| if (!UserConfig.ready) res.redirect('/setup'); | ||
|
|
||
| // Get the ID | ||
| const fakeId = req.params.fakeId; | ||
|
|
||
| if (!files.has(fakeId)) return res.status(404).send(); | ||
| else { | ||
|
|
||
| // Get file metadata | ||
| const meta = files.get(fakeId)!; | ||
|
|
||
| // File data can come from either S3 or local filesystem | ||
| let output: Readable | NodeJS.ReadableStream; | ||
|
|
||
| // Try to retrieve the file | ||
| if (!!meta.save.s3) { | ||
| const file = await getFileS3(meta.fileKey); | ||
| if (!file.Body) return res.status(500).send('Unknown error'); | ||
| output = file.Body as Readable; | ||
| } else output = fs.createReadStream(meta.save.local!); | ||
|
|
||
| // Configure response headers | ||
| res.type(meta.mimetype) | ||
| .header('Content-Disposition', `inline; filename="${meta.filename}"`) | ||
| .header('Cache-Control', 'public, max-age=31536000, immutable') | ||
| .header('Accept-Ranges', 'bytes'); | ||
|
|
||
| // Send the file (thanks to https://stackoverflow.com/a/67373050) | ||
| output.pipe(res); | ||
| } | ||
| }); |
Check failure
Code scanning / CodeQL
Missing rate limiting High
backend/sql/mysql.ts
Outdated
| return new Promise(async (resolve, reject) => { | ||
| try { | ||
| // Run query | ||
| const [rowz, _fields] = await MySql._pool.query(`SELECT Data FROM ${table} WHERE NanoID = '${key}';`); |
Check failure
Code scanning / CodeQL
Database query built from user-controlled sources High
| try { | ||
|
|
||
| // Get the file size | ||
| const size = (await fs.stat(bbFile.file)).size; |
Check failure
Code scanning / CodeQL
Uncontrolled data used in path expression High
| const size = (await fs.stat(bbFile.file)).size; | ||
|
|
||
| // Get the hash | ||
| const sha256 = crypto.createHash('sha256').update(await fs.readFile(bbFile.file)).digest('base64'); |
Check failure
Code scanning / CodeQL
Uncontrolled data used in path expression High
|
|
||
| // Username check | ||
| if (!newUser.username) issue = 'Missing username' | ||
| newUser.username.replaceAll(/[^A-z0-9_-]/g, ''); |
Check warning
Code scanning / CodeQL
Overly permissive regular expression range Medium
| const sha256 = crypto.createHash('sha256').update(await fs.readFile(bbFile.file)).digest('base64'); | ||
|
|
||
| // * Move the file | ||
| if (!s3) await fs.move(bbFile.file, destination); |
Check failure
Code scanning / CodeQL
Uncontrolled data used in path expression High
| const sha256 = crypto.createHash('sha256').update(await fs.readFile(bbFile.file)).digest('base64'); | ||
|
|
||
| // * Move the file | ||
| if (!s3) await fs.move(bbFile.file, destination); |
Check failure
Code scanning / CodeQL
Uncontrolled data used in path expression High
|
|
||
| // * Move the file | ||
| if (!s3) await fs.move(bbFile.file, destination); | ||
| else await uploadFileS3(await fs.readFile(bbFile.file), fileKey, bbFile.mimetype, size, sha256); |
Check failure
Code scanning / CodeQL
Uncontrolled data used in path expression High
Co-authored-by: NotAShelf <raf@notashelf.dev>
Checklist
Environment
6.6.3Description
🍑 Work-in-progress branch for ass 0.15.0 🍑
Want to test it out?
This version is currently usable! A lot of things are still missing (see the Roadmap below) but the core functions are working. For instructions, visit the new documentation!
At this time, there is no user system with 0.15.0. Once the setup is complete, you are ready to upload! If you encounter any issues, please join the Discord server for assistance.
Roadmap
Accept-Range/Content-Lengthheaders)