mirror of
https://github.com/danny-avila/LibreChat.git
synced 2025-12-17 08:50:15 +01:00
* fix: sanitize HTTP params and do not send whole error objects backs * fix: prevent path traversal * fix: send custom error message for tokenizer route * chore: handle info exposure vector * chore(oauth): skip check due to false positive as oauth routes are rate-limited * chore(app): disable `x-powered-by` * chore: disable false positives or flagging of hardcoded secrets when they are fake values * chore: add path traversal safety check
66 lines
1.7 KiB
JavaScript
66 lines
1.7 KiB
JavaScript
const { z } = require('zod');
|
|
const path = require('path');
|
|
const fs = require('fs').promises;
|
|
const express = require('express');
|
|
const upload = require('./multer');
|
|
const { processImageUpload } = require('~/server/services/Files/process');
|
|
const { logger } = require('~/config');
|
|
|
|
const router = express.Router();
|
|
|
|
router.post('/', upload.single('file'), async (req, res) => {
|
|
const file = req.file;
|
|
const metadata = req.body;
|
|
// TODO: add file size/type validation
|
|
|
|
const uuidSchema = z.string().uuid();
|
|
|
|
try {
|
|
if (!file) {
|
|
throw new Error('No file provided');
|
|
}
|
|
|
|
if (!metadata.file_id) {
|
|
throw new Error('No file_id provided');
|
|
}
|
|
|
|
if (!metadata.width) {
|
|
throw new Error('No width provided');
|
|
}
|
|
|
|
if (!metadata.height) {
|
|
throw new Error('No height provided');
|
|
}
|
|
/* parse to validate api call */
|
|
uuidSchema.parse(metadata.file_id);
|
|
metadata.temp_file_id = metadata.file_id;
|
|
metadata.file_id = req.file_id;
|
|
|
|
await processImageUpload({ req, res, file, metadata });
|
|
} catch (error) {
|
|
logger.error('[/files/images] Error processing file:', error);
|
|
try {
|
|
const filepath = path.join(
|
|
req.app.locals.paths.imageOutput,
|
|
req.user.id,
|
|
path.basename(file.filename),
|
|
);
|
|
await fs.unlink(filepath);
|
|
} catch (error) {
|
|
logger.error('[/files/images] Error deleting file:', error);
|
|
}
|
|
res.status(500).json({ message: 'Error processing file' });
|
|
}
|
|
|
|
// do this if strategy is not local
|
|
// finally {
|
|
// try {
|
|
// // await fs.unlink(file.path);
|
|
// } catch (error) {
|
|
// logger.error('[/files/images] Error deleting file:', error);
|
|
|
|
// }
|
|
// }
|
|
});
|
|
|
|
module.exports = router;
|