mirror of
https://github.com/screentinker/screentinker.git
synced 2026-08-13 13:53:12 -06:00
6b082cfad0
Uploaded files are served from the SAME ORIGIN as the dashboard, so how a browser
interprets them is a security boundary. Two things decided that interpretation, and
both were caller-controlled: the stored extension came from
`path.extname(originalname)`, and the only type check read `file.mimetype` — a request
header. A caller could therefore choose to have their bytes served as an active
document from the app origin.
Two independent invariants now hold the boundary:
1. INGEST — lib/upload-sniff.js sniffs magic bytes after multer writes a neutral
`.part` file (diskStorage names the file before any bytes exist, so the sniff cannot
happen there), maps the result through a hardcoded mime->extension allowlist, renames
accordingly, and stores the sniffed mime. Unsupported bytes are refused with a 400.
2. SERVING — upload responses carry `Content-Security-Policy: sandbox`, so if a response
is ever treated as a document it lands in an opaque origin with scripts disabled.
Anything outside the inline-safe extension set is additionally forced to download.
This holds regardless of how a file reached disk, so a future gap in (1) is contained
rather than exploitable.
Applied at every instance of the pattern, not just the first: lib/content-ingest.js,
the /replace route, the four content-serving paths across server.js and routes/content.js
(the latter pair currently shadowed by mount order, which is not a guarantee), and the
ZIP-import path in routes/status.js, which took its extension from the archive entry.
SVG stays accepted and stays inline: white-label logos are SVG, and octet-stream +
nosniff makes <img> fail. Scripts in an SVG never run in an image context, and the
sandbox CSP covers the one case where they would — a direct navigation. SVG is also no
longer handed to sharp, which removes the librsvg path where the open libvips CVEs live.
Existing rows are untouched — no migration. The four upload fixtures in agency.test.js
uploaded `Buffer.from('x')` declared as image/png; that is the exact "declared type is a
lie" case this closes, so the fixtures now use real PNG bytes. No assertion changed.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
88 lines
4.4 KiB
JavaScript
88 lines
4.4 KiB
JavaScript
'use strict';
|
|
|
|
// #73: shared content-ingest core. Extracted from routes/content.js POST / so the agency
|
|
// upload (routes/agency.js) produces BYTE-IDENTICAL first-class content (same thumbnail/
|
|
// dimensions/duration/insert) - an agency asset is indistinguishable from a dashboard
|
|
// upload. routes/content.js POST / is now a thin caller; behavior is unchanged (its
|
|
// existing tests are the regression guard).
|
|
|
|
const path = require('path');
|
|
const { v4: uuidv4 } = require('uuid');
|
|
const { db } = require('../db/database');
|
|
const config = require('../config');
|
|
const { sanitizeString } = require('../middleware/sanitize');
|
|
const { videoDisplayDims, imageDisplayDims } = require('./media-orientation');
|
|
const { finalizeUpload } = require('./upload-sniff');
|
|
|
|
// Multer takes file.originalname from the multipart header, bypassing sanitizeBody, so
|
|
// HTML-escape here (renders as text in every UI sink). .normalize('NFC') first: macOS
|
|
// sends NFD-decomposed names; Linux/renderers expect NFC. Single point - every filename
|
|
// storage site flows through here.
|
|
function safeFilename(name) {
|
|
return sanitizeString((name || '').normalize('NFC'));
|
|
}
|
|
|
|
// Process a multer-uploaded file (thumbnail + dimensions + duration) and insert a content
|
|
// row. Returns the content row. Throws on a hard failure (the caller maps to 500);
|
|
// thumbnail/metadata failures are best-effort (logged, non-fatal) exactly as before.
|
|
async function ingestUploadedFile({ file, userId, workspaceId, folderId = null }) {
|
|
const id = uuidv4();
|
|
// Content-derived extension + mime. Throws UnsupportedUploadError (and removes the temp
|
|
// file) when the bytes are not a supported media type; the caller maps that to a 400.
|
|
const { filepath, mime } = finalizeUpload(file);
|
|
let width = null, height = null, durationSec = null, thumbnailPath = null;
|
|
|
|
try {
|
|
// SVG is deliberately NOT handed to sharp: rasterising it goes through librsvg, which
|
|
// is where the outstanding libvips CVEs live, and an SVG is already its own thumbnail.
|
|
if (mime === 'image/svg+xml') {
|
|
thumbnailPath = filepath;
|
|
} else if (mime.startsWith('image/')) {
|
|
const sharp = require('sharp');
|
|
const metadata = await sharp(file.path).metadata();
|
|
// #170: honor EXIF orientation so a portrait photo isn't stored as landscape.
|
|
({ width, height } = imageDisplayDims(metadata));
|
|
thumbnailPath = `thumb_${filepath}`;
|
|
await sharp(file.path)
|
|
.rotate() // #170: auto-orient per EXIF (and strip the tag) so the thumbnail matches
|
|
.resize(config.thumbnailWidth)
|
|
.jpeg({ quality: 70 })
|
|
.toFile(path.join(config.contentDir, thumbnailPath));
|
|
} else if (mime.startsWith('video/')) {
|
|
try {
|
|
const { execFileSync } = require('child_process');
|
|
const probe = execFileSync('ffprobe', ['-v', 'quiet', '-print_format', 'json', '-show_format', '-show_streams', file.path],
|
|
{ timeout: 15000 }
|
|
).toString();
|
|
const info = JSON.parse(probe);
|
|
if (info.format?.duration) durationSec = parseFloat(info.format.duration);
|
|
const videoStream = info.streams?.find(s => s.codec_type === 'video');
|
|
if (videoStream) {
|
|
// #170: honor the rotation/Display-Matrix so a portrait video isn't stored landscape.
|
|
// (ffmpeg auto-rotates the thumbnail below by default, so only the dims need fixing.)
|
|
({ width, height } = videoDisplayDims(videoStream));
|
|
}
|
|
thumbnailPath = `thumb_${filepath.replace(/\.[^.]+$/, '.jpg')}`;
|
|
try {
|
|
execFileSync('ffmpeg', ['-y', '-i', file.path, '-ss', '2', '-vframes', '1', '-vf', `scale=${config.thumbnailWidth}:-1`, path.join(config.contentDir, thumbnailPath)],
|
|
{ timeout: 15000 }
|
|
);
|
|
} catch { thumbnailPath = null; }
|
|
} catch (e) {
|
|
console.warn('ffprobe failed:', e.message);
|
|
}
|
|
}
|
|
} catch (e) {
|
|
console.warn('Thumbnail/metadata generation failed:', e.message);
|
|
}
|
|
|
|
db.prepare(`
|
|
INSERT INTO content (id, user_id, workspace_id, filename, filepath, mime_type, file_size, duration_sec, thumbnail_path, width, height, folder_id)
|
|
VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
|
|
`).run(id, userId, workspaceId, safeFilename(file.originalname), filepath, mime, file.size, durationSec, thumbnailPath, width, height, folderId || null);
|
|
|
|
return db.prepare('SELECT * FROM content WHERE id = ?').get(id);
|
|
}
|
|
|
|
module.exports = { ingestUploadedFile, safeFilename };
|