vbrandl/fotochallenge
Archived
1
0
Fork 0
Code Issues 4 Pull Requests 3 Actions Packages Projects Releases Activity

Logging
Some checks failed
/ Misc Linters (push) Successful in 21s
Details
/ Build App (push) Failing after 21s
Details

Browse Source
This commit is contained in:
Valentin Brandl 2024-08-17 15:39:43 +02:00
parent 1557d2cca9
commit 48948a180a
Signed by: vbrandl
GPG Key ID: CAD4DA1A789125F9
1 changed files with 19 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

26
src/routes/+page.server.ts
View File

@ -1,7 +1,7 @@
import { writeFileSync, mkdirSync, existsSync } from 'fs'; import { writeFileSync, mkdirSync, existsSync } from 'fs';
import { fail } from '@sveltejs/kit'; import { fail } from '@sveltejs/kit';
import type { RequestEvent } from './$types'; import type { RequestEvent } from './$types';
import safePath, { storagePath } from '$lib'; import safePath, { storagePath, log } from '$lib';
import { hash } from 'crypto'; import { hash } from 'crypto';
import path from 'path'; import path from 'path';
@ -12,34 +12,44 @@ const mkdirIfNotExists = (path: string) => {
}; };
export const actions = { export const actions = {
default: async ({ request }: RequestEvent) => { default: async ({ request, locals }: RequestEvent) => {
var context: any = { requestId: locals.requestId };
const data = await request.formData(); const data = await request.formData();
const formFiles = data.getAll('files'); const formFiles = data.getAll('files');
if (!formFiles) { if (!formFiles) {
log.debug(context, 'missing files');
return fail(400, { field: 'files', files: formFiles, missing: true }); return fail(400, { field: 'files', files: formFiles, missing: true });
} else if (!(formFiles as File[])) { } else if (!(formFiles as File[])) {
log.debug(context, 'invalid files');
return fail(400, { field: 'files', files: formFiles, incorrect: true }); return fail(400, { field: 'files', files: formFiles, incorrect: true });
} }
const files = formFiles as File[]; const files = formFiles as File[];
console.log(files); const fileNames = files.map((file) => file.name);
context = { fileNames, ...context };
if (files.length === 0) { if (files.length === 0) {
log.debug(context, 'empty files');
return fail(400, { field: 'files', files: formFiles, empty: true }); return fail(400, { field: 'files', files: formFiles, empty: true });
} }
const formName = data.get('name'); const formName = data.get('name');
if (!formName) { if (!formName) {
log.debug(context, 'missing name');
return fail(400, { field: 'name', name: formName, missing: true }); return fail(400, { field: 'name', name: formName, missing: true });
} else if (!(formName as string)) { } else if (!(formName as string)) {
log.debug(context, 'invalid name');
return fail(400, { field: 'name', name: formName, incorrect: true }); return fail(400, { field: 'name', name: formName, incorrect: true });
} }
const name = formName as string; const name = formName as string;
context = { name, ...context };
if (!safePath(storagePath, name)) { if (!safePath(storagePath, name)) {
log.warn(context, 'Supplied name would cause dir traversal. Rejecting...');
return fail(400, { field: 'name', name: name, incorrect: true }); return fail(400, { field: 'name', name: name, incorrect: true });
} }
// const name = safePath(formName as string);
log.info(context, 'Uploading files');
files.forEach(async (file) => { files.forEach(async (file) => {
const outPath = `${storagePath}/${name}`; const outPath = `${storagePath}/${name}`;
@ -47,11 +57,13 @@ export const actions = {
const ext = path.extname(file.name); const ext = path.extname(file.name);
mkdirIfNotExists(outPath); mkdirIfNotExists(outPath);
const filename = hash('sha1', content); const filename = `${hash('sha1', content)}${ext}`;
const fullPath = `${outPath}/${filename}${ext}`; const fullPath = `${outPath}/${filename}`;
context = { file: fullPath, ...context };
if (existsSync(fullPath)) { if (existsSync(fullPath)) {
console.warn(`${fullPath} has already been uploaded. Skipping...`); log.debug(context, 'File has already been uploaded. Skipping...');
} else { } else {
log.debug(context, 'saving file');
writeFileSync(fullPath, Buffer.from(await file.arrayBuffer()), { flag: 'a+' }); writeFileSync(fullPath, Buffer.from(await file.arrayBuffer()), { flag: 'a+' });
} }
}); });