Andreas/wekan
1
0
Fork 0
mirror of https://github.com/wekan/wekan.git synced 2025-12-16 15:30:13 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions 5

Separate uploaded file validation logic from the model "Attachments"

Browse source
This commit is contained in:
Tobias Wolf 2022-08-19 14:30:22 +02:00
parent 503f6128bd
commit 469d81f8a5
2 changed files with 51 additions and 35 deletions
Download patch file Download diff file Expand all files Collapse all files

38
models/attachments.js
View file

@ -1,15 +1,12 @@
import { Meteor } from 'meteor/meteor';
import { FilesCollection } from 'meteor/ostrio:files';
import { exec } from 'node:child_process';
import { promisify } from 'node:util';
import { isFileValid } from './fileValidation';
import { createBucket } from './lib/grid/createBucket';
import fs from 'fs';
import FileType from 'file-type';
import path from 'path';
import { AttachmentStoreStrategyFilesystem, AttachmentStoreStrategyGridFs} from '/models/lib/attachmentStoreStrategy';
import FileStoreStrategyFactory, {moveToStorage, rename, STORAGE_NAME_FILESYSTEM, STORAGE_NAME_GRIDFS} from '/models/lib/fileStoreStrategy';
let asyncExec;
let attachmentUploadExternalProgram;
let attachmentUploadMimeTypes = [];
let attachmentUploadSize = 0;
@ -17,7 +14,6 @@ let attachmentBucket;
let storagePath;
if (Meteor.isServer) {
asyncExec = promisify(exec);
attachmentBucket = createBucket('attachments');
if (process.env.ATTACHMENTS_UPLOAD_MIME_TYPES) {
@ -155,34 +151,7 @@ if (Meteor.isServer) {
check(fileObjId, String);
const fileObj = Attachments.findOne({_id: fileObjId});
let isValid = true;
if (attachmentUploadMimeTypes.length) {
const mimeTypeResult = Promise.await(FileType.fromFile(fileObj.path));
const mimeType = (mimeTypeResult ? mimeTypeResult.mime : fileObj.type);
const baseMimeType = mimeType.split('/', 1)[0];
isValid = attachmentUploadMimeTypes.includes(mimeType) || attachmentUploadMimeTypes.includes(baseMimeType + '/*') || attachmentUploadMimeTypes.includes('*');
if (!isValid) {
console.log("Validation of uploaded file failed: file " + fileObj.path + " - mimetype " + mimeType);
}
}
if (attachmentUploadSize && fileObj.size > attachmentUploadSize) {
console.log("Validation of uploaded file failed: file " + fileObj.path + " - size " + fileObj.size);
isValid = false;
}
if (isValid && attachmentUploadExternalProgram) {
Promise.await(asyncExec(attachmentUploadExternalProgram.replace("{file}", '"' + fileObj.path + '"')));
isValid = fs.existsSync(fileObj.path);
if (!isValid) {
console.log("Validation of uploaded file failed: file " + fileObj.path + " has been deleted externally");
}
}
const isValid = Promise.await(isFileValid(fileObj, attachmentUploadMimeTypes, attachmentUploadSize, attachmentUploadExternalProgram));
if (!isValid) {
Attachments.remove(fileObjId);
@ -192,12 +161,11 @@ if (Meteor.isServer) {
check(fileObjId, String);
check(storageDestination, String);
Meteor.defer(() => Meteor.call('validateAttachment', fileObjId));
Meteor.call('validateAttachment', fileObjId);
const fileObj = Attachments.findOne({_id: fileObjId});
if (fileObj) {
console.debug("Validation of uploaded file completed: file " + fileObj.path + " - storage destination " + storageDestination);
Meteor.defer(() => Meteor.call('moveAttachmentToStorage', fileObjId, storageDestination));
}
},

48
models/fileValidation.js Normal file
View file

@ -0,0 +1,48 @@
import { Meteor } from 'meteor/meteor';
import { exec } from 'node:child_process';
import { promisify } from 'node:util';
import fs from 'fs';
import FileType from 'file-type';
let asyncExec;
if (Meteor.isServer) {
asyncExec = promisify(exec);
}
export async function isFileValid(fileObj, mimeTypesAllowed, sizeAllowed, externalCommandLine) {
let isValid = true;
if (mimeTypesAllowed.length) {
const mimeTypeResult = await FileType.fromFile(fileObj.path);
const mimeType = (mimeTypeResult ? mimeTypeResult.mime : fileObj.type);
const baseMimeType = mimeType.split('/', 1)[0];
isValid = mimeTypesAllowed.includes(mimeType) || mimeTypesAllowed.includes(baseMimeType + '/*') || mimeTypesAllowed.includes('*');
if (!isValid) {
console.log("Validation of uploaded file failed: file " + fileObj.path + " - mimetype " + mimeType);
}
}
if (isValid && sizeAllowed && fileObj.size > sizeAllowed) {
console.log("Validation of uploaded file failed: file " + fileObj.path + " - size " + fileObj.size);
isValid = false;
}
if (isValid && externalCommandLine) {
await asyncExec(externalCommandLine.replace("{file}", '"' + fileObj.path + '"'));
isValid = fs.existsSync(fileObj.path);
if (!isValid) {
console.log("Validation of uploaded file failed: file " + fileObj.path + " has been deleted externally");
}
}
if (isValid) {
console.debug("Validation of uploaded file successful: file " + fileObj.path);
}
return isValid;
}