0.0.5

Change parameter order
Add title
2024-08-16 18:18:02 +02:00 · 2024-08-16 18:17:44 +02:00 · 2024-08-16 18:08:49 +02:00 · 2024-08-16 16:39:44 +02:00 · 2024-08-16 16:37:24 +02:00 · 2024-08-16 16:36:51 +02:00
8 changed files with 45 additions and 11 deletions
--- a/.gitea/workflows/publish.yml
+++ b/.gitea/workflows/publish.yml
@ -6,6 +6,9 @@ on:
      - 'v*'

 jobs:
+  lints:
+    uses: ./.gitea/workflows/lints.yml
+
  tests:
    uses: ./.gitea/workflows/node.yml

--- a/flake.lock
+++ b/flake.lock
@ -20,11 +20,11 @@
 		},
 		"nixpkgs": {
 			"locked": {
-				"lastModified": 1720957393,
-				"narHash": "sha256-oedh2RwpjEa+TNxhg5Je9Ch6d3W1NKi7DbRO1ziHemA=",
+				"lastModified": 1723637854,
+				"narHash": "sha256-med8+5DSWa2UnOqtdICndjDAEjxr5D7zaIiK4pn0Q7c=",
 				"owner": "nixos",
 				"repo": "nixpkgs",
-				"rev": "693bc46d169f5af9c992095736e82c3488bf7dbb",
+				"rev": "c3aa7b8938b17aebd2deecf7be0636000d62a2b9",
 				"type": "github"
 			},
 			"original": {
--- a/package-lock.json
+++ b/package-lock.json
@ -1,12 +1,12 @@
 {
 	"name": "fotochallenge",
-	"version": "0.0.1",
+	"version": "0.0.5",
 	"lockfileVersion": 3,
 	"requires": true,
 	"packages": {
 		"": {
 			"name": "fotochallenge",
-			"version": "0.0.1",
+			"version": "0.0.5",
 			"devDependencies": {
 				"@sveltejs/adapter-auto": "^3.0.0",
 				"@sveltejs/adapter-node": "^5.2.0",
--- a/package.json
+++ b/package.json
@ -1,6 +1,6 @@
 {
 	"name": "fotochallenge",
-	"version": "0.0.1",
+	"version": "0.0.5",
 	"private": true,
 	"scripts": {
 		"dev": "vite dev",
--- a/src/app.html
+++ b/src/app.html
@ -4,6 +4,7 @@
 		<meta charset="utf-8" />
 		<link rel="icon" href="%sveltekit.assets%/favicon.png" />
 		<meta name="viewport" content="width=device-width, initial-scale=1" />
+		<title>Gabi und Hannes Fotochallenge</title>
 		%sveltekit.head%
 	</head>
 	<body data-sveltekit-preload-data="hover">
--- a/src/index.test.ts
+++ b/src/index.test.ts
@ -2,7 +2,19 @@ import safePath from '$lib';
 import { describe, it, expect } from 'vitest';

 describe('safe path', () => {
-	it('removes non alphanum from string', () => {
-		expect(safePath('../../!=-.,/abc123')).toBe('abc123');
+	it('reject names with ../', () => {
+		expect(safePath('./uplodas', '../foobar')).toBe(false);
+	});
+
+	it('accept names with ./', () => {
+		expect(safePath('./uplodas', './foobar')).toBe(true);
+	});
+
+	it('reject names with /', () => {
+		expect(safePath('./uplodas', 'foo/bar')).toBe(false);
+	});
+
+	it('accept happy path', () => {
+		expect(safePath('./uplodas', 'foobar')).toBe(true);
 	});
 });
--- a/src/lib/index.ts
+++ b/src/lib/index.ts
@ -1,10 +1,23 @@
 // place files you want to import through the `$lib` alias in this folder.
+import path from 'path';

-const safePath = (input: string) => input.replace(/\W/g, '');
+function safePath(basePath: string, name: string): boolean {
+	const fullPath = `${basePath}/${name}`;
+	const relative = path.relative(basePath, fullPath);
+	return (
+		!!relative &&
+		// does move out of `basePath`
+		!relative.startsWith('..') &&
+		// exactly one layer deep, e.g. no `./uplodas/foo/bar`
+		!relative.includes('/') &&
+		// result is not an absolute path
+		!path.isAbsolute(relative)
+	);
+}

 const defaultPath: string = './uploads';
 if (!('STORAGE_PATH' in process.env)) {
-	console.log(`'STORAGE_PATH' environment variable is not set. Defaulting to ${defaultPath}`);
+	console.warn(`'STORAGE_PATH' environment variable is not set. Defaulting to ${defaultPath}`);
 }
 export const storagePath: string = process.env.STORAGE_PATH ?? defaultPath;

--- a/src/routes/+page.server.ts
+++ b/src/routes/+page.server.ts
@ -34,7 +34,12 @@ export const actions = {
 			return fail(400, { field: 'name', name: formName, incorrect: true });
 		}

-		const name = safePath(formName as string);
+		const name = formName as string;
+
+		if (!safePath(storagePath, name)) {
+			return fail(400, { field: 'name', name: name, incorrect: true });
+		}
+		// const name = safePath(formName as string);

 		files.forEach(async (file) => {
 			const outPath = `${storagePath}/${name}`;
Author	SHA1	Message	Date
Valentin Brandl	4b8ecc65c3	0.0.5 All checks were successful Publish / lints (push) Successful in 25s Details Publish / tests (push) Successful in 51s Details Publish / Publishing (push) Successful in 1m9s Details / Misc Linters (push) Successful in 26s Details / Build App (push) Successful in 1m1s Details	2024-08-16 18:18:02 +02:00
Valentin Brandl	3696bcade2	Change parameter order	2024-08-16 18:17:44 +02:00
Valentin Brandl	dea401fec0	Add title All checks were successful / Misc Linters (push) Successful in 22s Details / Build App (push) Successful in 50s Details	2024-08-16 18:08:49 +02:00
Valentin Brandl	66494c6760	Fix tests All checks were successful Publish / lints (push) Successful in 25s Details / Misc Linters (push) Successful in 28s Details / Build App (push) Successful in 1m3s Details Publish / tests (push) Successful in 50s Details Publish / Publishing (push) Successful in 1m7s Details	2024-08-16 16:39:44 +02:00
Valentin Brandl	05320916b2	0.0.4 Some checks failed / Misc Linters (push) Successful in 24s Details / Build App (push) Failing after 29s Details Publish / lints (push) Successful in 22s Details Publish / tests (push) Failing after 27s Details Publish / Publishing (push) Has been skipped Details	2024-08-16 16:37:24 +02:00
Valentin Brandl	e6857f5b5d	0.0.2	2024-08-16 16:36:51 +02:00
Valentin Brandl	5dba5471d1	Reject illegal names	2024-08-16 16:34:43 +02:00
Valentin Brandl	f1ff9f1c38	Update flake.lock	2024-08-16 16:34:26 +02:00
Valentin Brandl	7386a29ec5	flake.lock: Update Some checks failed / Misc Linters (push) Successful in 25s Details / Build App (push) Failing after 24s Details Flake lock file updates: • Updated input 'nixpkgs': 'github:nixos/nixpkgs/693bc46d169f5af9c992095736e82c3488bf7dbb' (2024-07-14) → 'github:nixos/nixpkgs/c3aa7b8938b17aebd2deecf7be0636000d62a2b9' (2024-08-14)	2024-08-16 15:53:10 +02:00
Valentin Brandl	88b158b7b4	Lint before publish All checks were successful / Misc Linters (push) Successful in 27s Details / Build App (push) Successful in 59s Details	2024-08-16 15:10:18 +02:00