fix: forbidden non-ascii binary subpath (#405)

closes #395
cnpm · Feb 13, 2023 · 7b52f6f · 7b52f6f
1 parent f7344eb
commit 7b52f6f
Show file tree

Hide file tree

Showing 3 changed files with 22 additions and 2 deletions.
diff --git a/app/port/controller/BinarySyncController.ts b/app/port/controller/BinarySyncController.ts
@@ -13,7 +13,8 @@ import { AbstractController } from './AbstractController';
 import { BinarySyncerService } from '../../core/service/BinarySyncerService';
 import { Binary } from '../../core/entity/Binary';
 import binaries, { BinaryName } from '../../../config/binaries';
-import { BinaryNameRule } from '../typebox';
+import { BinaryNameRule, BinarySubpathRule } from '../typebox';
+
 @HTTPController()
 export class BinarySyncController extends AbstractController {
   @Inject()
@@ -54,14 +55,19 @@ export class BinarySyncController extends AbstractController {
     // check binaryName valid
     try {
       ctx.tValidate(BinaryNameRule, binaryName);
-    } catch (e) {
+    } catch {
       throw new NotFoundError(`Binary "${binaryName}" not found`);
     }
     subpath = subpath || '/';
     if (subpath === '/') {
       const items = await this.binarySyncerService.listRootBinaries(binaryName);
       return this.formatItems(items);
     }
+    try {
+      ctx.tValidate(BinarySubpathRule, subpath);
+    } catch {
+      throw new NotFoundError(`Binary "${binaryName}/${subpath}" not found`);
+    }
     subpath = `/${subpath}`;
     const parsed = path.parse(subpath);
     const parent = parsed.dir === '/' ? '/' : `${parsed.dir}/`;

diff --git a/app/port/typebox.ts b/app/port/typebox.ts
@@ -35,6 +35,10 @@ export const BinaryNameRule = Type.String({
   maxLength: 220,
 });
 
+// `[ -~]` matches all printable ASCII characters
+// https://catonmat.net/my-favorite-regex
+export const BinarySubpathRule = Type.RegEx(/^[ -~]{1,1024}$/);
+
 export const Tag = Type.String({
   format: 'semver-tag',
   transform: [ 'trim' ],

diff --git a/test/port/controller/BinarySyncController/showBinary.test.ts b/test/port/controller/BinarySyncController/showBinary.test.ts
@@ -161,6 +161,16 @@ describe('test/port/controller/BinarySyncController/showBinary.test.ts', () => {
       ]);
     });
 
+    it('should forbidden invalid paths', async () => {
+      const res = await app.httpRequest()
+        .get('/-/binary/chromium-browser-snapshots/Linux_x64/970485/%E4%B8%8B%E8%BD%BD%E7%9A%84');
+      assert.equal(res.status, 404);
+      assert.equal(res.headers['content-type'], 'application/json; charset=utf-8');
+      assert.deepEqual(res.body, {
+        error: '[NOT_FOUND] Binary "chromium-browser-snapshots/Linux_x64/970485/下载的" not found',
+      });
+    });
+
     it('should show node binaries', async () => {
       app.mockHttpclient('https://nodejs.org/dist/index.json', 'GET', {
         data: await TestUtil.readFixturesFile('nodejs.org/site/index.json'),