From 46b8d91c1edbd660af21c8201a53e5153362378a Mon Sep 17 00:00:00 2001 From: hippoz Date: Sat, 3 Oct 2020 18:53:43 +0300 Subject: [PATCH] Add support for adding file names. Experimental. --- index.js | 45 +++++++++++++++++++++++++++++++++++++----- views/upload.ejs | 1 + views/uploadfailed.ejs | 2 ++ 3 files changed, 43 insertions(+), 5 deletions(-) diff --git a/index.js b/index.js index 0a365d9..3884d65 100644 --- a/index.js +++ b/index.js @@ -13,9 +13,6 @@ app.set('view engine', 'ejs') app.use(express.urlencoded({ extended: false })); app.use(express.json()); -app.get('/', (req, res) => { - res.render('upload'); -}); const isPathValid = (filename, filePath) => { if (!filename) { @@ -26,6 +23,10 @@ const isPathValid = (filename, filePath) => { return false; } + if (!/[A-Za-z1-9.]+/g.test(filename)) { + return false; + } + if (filePath.indexOf(config.storagePath) !== 0) { return false; } @@ -33,6 +34,22 @@ const isPathValid = (filename, filePath) => { return true; }; +const isFilenameValid = (filename) => { + if (!filename) { + return false; + } + + if (filename.indexOf('\0') !== -1 || filename.indexOf('%') !== -1 || filename.indexOf('..') !== -1 || filename.indexOf('&') !== -1) { + return false; + } + + if (!/[A-Za-z1-9.]+/g.test(filename)) { + return false; + } + + return true; +}; + const getFileType = (filename) => { const extension = path.extname(filename).substring(1); let type = config.files.embed[extension]; @@ -44,6 +61,14 @@ const getFileType = (filename) => { return type; }; + + +app.get('/', (req, res) => { + res.render('upload'); +}); + + + app.get('/file/:filename', (req, res) => { const filename = req.params.filename; const filePath = path.join(config.storagePath, filename); @@ -75,6 +100,7 @@ app.get('/file/:filename', (req, res) => { app.post('/api/upload', (req, res) => { const password = req.body.password; + const chosenFileName = req.body.filename; if (config.passwords.indexOf(password) === -1) { return res.status(401).render('uploadfailed', { message: 'The password you entered is not correct.' }); @@ -85,7 +111,16 @@ app.post('/api/upload', (req, res) => { } const file = req.files.file; - const filepath = `${config.storagePath}/${file.name}`; + + if (!isFilenameValid(chosenFileName)) { + return res.status(400).render('uploadfailed', { message: 'Invalid name.' }); + } + + const filepath = path.join(config.storagePath, chosenFileName); + + if (!isFilenameValid(file.name) || !isPathValid(chosenFileName, filepath)) { + return res.status(400).render('uploadfailed', { message: 'Invalid name.' }); + } fs.stat(filepath, (err) => { if(err == null) { @@ -93,7 +128,7 @@ app.post('/api/upload', (req, res) => { } else if(err.code === 'ENOENT') { file.mv(filepath, (err) => { if (err) return res.status(500).render('uploadfailed', { message: 'Something went wrong while uploading the file.' }); - res.render('uploaded', { file: { name: file.name } }); + res.render('uploaded', { file: { name: chosenFileName } }); }); } else { return res.status(500).render('uploadfailed', { message: 'Something went wrong.' });; diff --git a/views/upload.ejs b/views/upload.ejs index 96091e1..081ae83 100644 --- a/views/upload.ejs +++ b/views/upload.ejs @@ -10,6 +10,7 @@

i think

Password:
+ File name:

diff --git a/views/uploadfailed.ejs b/views/uploadfailed.ejs index a2bfec9..d855dcd 100644 --- a/views/uploadfailed.ejs +++ b/views/uploadfailed.ejs @@ -9,5 +9,7 @@

upload failed

i think

<%= message %>

+
+ Go back \ No newline at end of file