IT-Works/Wegwichtel
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

simplify application and remove window references
Sonarqube Scanner / Build and analyze (push) Failing after 1m27s
Details

Browse Source
This commit is contained in:
Florian Zumpe
2026-06-17 16:08:01 +02:00
parent 6a4d84ac6a
commit 32f161483d
20 changed files with 560 additions and 282 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/middleware/upload.js
+100 -67
View File
@@ -8,6 +8,25 @@ import { detectAv } from '@file-type/av';
import { config } from '../config.js';
import { HttpError } from './errors.js';
const MAX_GPX_PREFIX_BYTES = 131072;
const BASE64_PATTERN = /^[A-Za-z0-9+/]*={0,2}$/;
const IGNORED_XML_MARKUP = Object.freeze([
Object.freeze({ opening: '<!--', closing: '-->' }),
Object.freeze({ opening: '<?', closing: '?>' }),
Object.freeze({ opening: '<!', closing: '>' })
]);
const ALLOWED_TYPES = Object.freeze({
picture: Object.freeze({
mime: new Set(['image/jpeg', 'image/png', 'image/webp']),
ext: new Set(['jpg', 'png', 'webp'])
}),
audio: Object.freeze({
mime: new Set(['audio/mpeg', 'audio/mp4', 'audio/aac', 'audio/ogg', 'audio/wav', 'audio/webm']),
ext: new Set(['mp3', 'm4a', 'aac', 'ogg', 'opus', 'spx', 'wav', 'webm'])
})
});
function sanitizeFilename(value) {
return String(value).replaceAll(/[^a-zA-Z0-9._-]/g, '_') || 'upload';
}
@@ -35,38 +54,40 @@ function isXmlNameCharacter(character, first = false) {
return !first && ((code >= 48 && code <= 57) || character === '.' || character === '-' || character === ':');
}
function ignoredMarkupEnd(xml, opening) {
const markup = IGNORED_XML_MARKUP.find(item => xml.startsWith(item.opening, opening));
if (!markup) return null;
const closing = xml.indexOf(markup.closing, opening + markup.opening.length);
return closing < 0 ? -1 : closing + markup.closing.length;
}
function readXmlName(xml, start) {
if (start >= xml.length || !isXmlNameCharacter(xml[start], true)) return null;
let end = start + 1;
while (end < xml.length && isXmlNameCharacter(xml[end])) end += 1;
return xml.slice(start, end);
}
function rootElementName(xml) {
let cursor = 0;
while (cursor < xml.length) {
const opening = xml.indexOf('<', cursor);
if (opening < 0 || opening + 1 >= xml.length) return null;
if (xml.startsWith('<!--', opening)) {
const end = xml.indexOf('-->', opening + 4);
if (end < 0) return null;
cursor = end + 3;
const nextCursor = ignoredMarkupEnd(xml, opening);
if (nextCursor === -1) return null;
if (nextCursor != null) {
cursor = nextCursor;
continue;
}
if (xml.startsWith('<?', opening)) {
const end = xml.indexOf('?>', opening + 2);
if (end < 0) return null;
cursor = end + 2;
continue;
}
if (xml.startsWith('<!', opening)) {
const end = xml.indexOf('>', opening + 2);
if (end < 0) return null;
cursor = end + 1;
continue;
}
if (xml.startsWith('</', opening)) return null;
let end = opening + 1;
if (!isXmlNameCharacter(xml[end], true)) return null;
end += 1;
while (end < xml.length && isXmlNameCharacter(xml[end])) end += 1;
return xml.slice(opening + 1, end);
if (xml.startsWith('</', opening)) return null;
return readXmlName(xml, opening + 1);
}
return null;
}
@@ -83,19 +104,29 @@ export const upload = multer({
limits: { fileSize: config.maxUploadBytes, files: 25 }
});
const ALLOWED_TYPES = Object.freeze({
picture: Object.freeze({
mime: new Set(['image/jpeg', 'image/png', 'image/webp']),
ext: new Set(['jpg', 'png', 'webp'])
}),
audio: Object.freeze({
mime: new Set(['audio/mpeg', 'audio/mp4', 'audio/aac', 'audio/ogg', 'audio/wav', 'audio/webm']),
ext: new Set(['mp3', 'm4a', 'aac', 'ogg', 'opus', 'spx', 'wav', 'webm'])
})
});
function removeTemporaryFile(file) {
if (file?.path && fs.existsSync(file.path)) fs.rmSync(file.path, { force: true });
if (!file?.path || !fs.existsSync(file.path)) return;
fs.rmSync(file.path, { force: true });
}
function assertValidBase64(compact, fieldName) {
if (!BASE64_PATTERN.test(compact) || compact.length % 4 === 1) {
throw new HttpError(400, `${fieldName}.base64 enthält keine gültigen Base64-Daten.`);
}
}
function assertCanonicalBase64(compact, buffer, fieldName) {
const canonicalInput = stripBase64Padding(compact);
const canonicalOutput = stripBase64Padding(buffer.toString('base64'));
if (canonicalInput !== canonicalOutput) {
throw new HttpError(400, `${fieldName}.base64 enthält keine gültigen Base64-Daten.`);
}
}
function assertUploadSize(buffer) {
if (buffer.length <= config.maxUploadBytes) return;
const limitMb = Math.floor(config.maxUploadBytes / 1024 / 1024);
throw new HttpError(413, `Die Datei überschreitet das Limit von ${limitMb} MB.`);
}
function decodeBase64(value, fieldName) {
@@ -104,19 +135,11 @@ function decodeBase64(value, fieldName) {
}
const compact = value.replaceAll(/\s/g, '');
if (!/^[A-Za-z0-9+/]*={0,2}$/.test(compact) || compact.length % 4 === 1) {
throw new HttpError(400, `${fieldName}.base64 enthält keine gültigen Base64-Daten.`);
}
assertValidBase64(compact, fieldName);
const buffer = Buffer.from(compact, 'base64');
const canonicalInput = stripBase64Padding(compact);
const canonicalOutput = stripBase64Padding(buffer.toString('base64'));
if (canonicalInput !== canonicalOutput) {
throw new HttpError(400, `${fieldName}.base64 enthält keine gültigen Base64-Daten.`);
}
if (buffer.length > config.maxUploadBytes) {
throw new HttpError(413, `Die Datei überschreitet das Limit von ${Math.floor(config.maxUploadBytes / 1024 / 1024)} MB.`);
}
assertCanonicalBase64(compact, buffer, fieldName);
assertUploadSize(buffer);
return buffer;
}
@@ -126,7 +149,8 @@ function jsonFileDescriptor(value, fieldName) {
throw new HttpError(400, `${fieldName} muss ein JSON-Objekt sein.`);
}
const originalname = String(value.filename ?? `${fieldName}.upload`).trim() || `${fieldName}.upload`;
const fallbackName = `${fieldName}.upload`;
const originalname = String(value.filename ?? fallbackName).trim() || fallbackName;
let base64 = value.base64;
if (value.dataUrl != null) {
@@ -174,10 +198,9 @@ function detectGpx(file) {
throw new HttpError(415, 'Der Upload ist keine gültig kodierte GPX-Datei.');
}
const prefix = xml.slice(0, 131072);
const prefix = xml.slice(0, MAX_GPX_PREFIX_BYTES);
const start = prefix.startsWith('\uFEFF') ? prefix.slice(1) : prefix;
const rootName = rootElementName(start);
const localName = rootName?.split(':').at(-1);
const localName = rootElementName(start)?.split(':').at(-1);
if (localName !== 'gpx') {
throw new HttpError(415, 'Der Upload enthält kein GPX-Dokument.');
}
@@ -195,25 +218,34 @@ async function detectBinary(file) {
}
}
function unsupportedContentMessage(kind) {
return kind === 'picture'
? 'Der Dateiinhalt ist kein unterstütztes Bildformat.'
: 'Der Dateiinhalt ist kein unterstütztes Audioformat.';
}
function unsupportedFormatMessage(kind, mime) {
return kind === 'picture'
? `Nicht unterstütztes Bildformat: ${mime}`
: `Nicht unterstütztes Audioformat: ${mime}`;
}
function validateDetectedType(detected, kind) {
if (kind === 'gpx') return;
const rules = ALLOWED_TYPES[kind];
const baseMime = String(detected.mime).split(';', 1)[0].toLowerCase();
const extension = String(detected.ext).toLowerCase();
if (!rules?.mime.has(baseMime) || !rules.ext.has(extension)) {
throw new HttpError(415, unsupportedFormatMessage(kind, detected.mime));
}
}
async function detectAndValidate(file, kind) {
const detected = kind === 'gpx' ? detectGpx(file) : await detectBinary(file);
if (!detected) {
throw new HttpError(415, kind === 'picture'
? 'Der Dateiinhalt ist kein unterstütztes Bildformat.'
: 'Der Dateiinhalt ist kein unterstütztes Audioformat.');
}
if (kind !== 'gpx') {
const rules = ALLOWED_TYPES[kind];
const baseMime = String(detected.mime).split(';', 1)[0].toLowerCase();
const extension = String(detected.ext).toLowerCase();
if (!rules?.mime.has(baseMime) || !rules?.ext.has(extension)) {
throw new HttpError(415, kind === 'picture'
? `Nicht unterstütztes Bildformat: ${detected.mime}`
: `Nicht unterstütztes Audioformat: ${detected.mime}`);
}
}
if (!detected) throw new HttpError(415, unsupportedContentMessage(kind));
validateDetectedType(detected, kind);
file.mimetype = detected.mime;
file.detectedMime = detected.mime;
file.detectedExtension = detected.ext;
@@ -225,12 +257,13 @@ export function inspectUpload(fieldName, kind, { allowJson = false } = {}) {
try {
if (allowJson) materializeJsonUpload(req, fieldName);
if (!req.file) return next();
await detectAndValidate(req.file, kind);
next();
return next();
} catch (error) {
removeTemporaryFile(req.file);
req.file = undefined;
next(error);
return next(error);
}
};
}