From 7b52f6f30332a9d83be4f958bd3c9b0577021507 Mon Sep 17 00:00:00 2001
From: fengmk2 <fengmk2@gmail.com>
Date: Mon, 13 Feb 2023 21:43:07 +0800
Subject: [PATCH] fix: forbidden non-ascii binary subpath (#405)

closes https://github.com/cnpm/cnpmcore/issues/395
---
 app/port/controller/BinarySyncController.ts            | 10 ++++++++--
 app/port/typebox.ts                                    |  4 ++++
 .../controller/BinarySyncController/showBinary.test.ts | 10 ++++++++++
 3 files changed, 22 insertions(+), 2 deletions(-)

diff --git a/app/port/controller/BinarySyncController.ts b/app/port/controller/BinarySyncController.ts
index 8788f7d3..01d896aa 100644
--- a/app/port/controller/BinarySyncController.ts
+++ b/app/port/controller/BinarySyncController.ts
@@ -13,7 +13,8 @@ import { AbstractController } from './AbstractController';
 import { BinarySyncerService } from '../../core/service/BinarySyncerService';
 import { Binary } from '../../core/entity/Binary';
 import binaries, { BinaryName } from '../../../config/binaries';
-import { BinaryNameRule } from '../typebox';
+import { BinaryNameRule, BinarySubpathRule } from '../typebox';
+
 @HTTPController()
 export class BinarySyncController extends AbstractController {
   @Inject()
@@ -54,7 +55,7 @@ export class BinarySyncController extends AbstractController {
     // check binaryName valid
     try {
       ctx.tValidate(BinaryNameRule, binaryName);
-    } catch (e) {
+    } catch {
       throw new NotFoundError(`Binary "${binaryName}" not found`);
     }
     subpath = subpath || '/';
@@ -62,6 +63,11 @@ export class BinarySyncController extends AbstractController {
       const items = await this.binarySyncerService.listRootBinaries(binaryName);
       return this.formatItems(items);
     }
+    try {
+      ctx.tValidate(BinarySubpathRule, subpath);
+    } catch {
+      throw new NotFoundError(`Binary "${binaryName}/${subpath}" not found`);
+    }
     subpath = `/${subpath}`;
     const parsed = path.parse(subpath);
     const parent = parsed.dir === '/' ? '/' : `${parsed.dir}/`;
diff --git a/app/port/typebox.ts b/app/port/typebox.ts
index 168ef3dd..decde64e 100644
--- a/app/port/typebox.ts
+++ b/app/port/typebox.ts
@@ -35,6 +35,10 @@ export const BinaryNameRule = Type.String({
   maxLength: 220,
 });
 
+// `[ -~]` matches all printable ASCII characters
+// https://catonmat.net/my-favorite-regex
+export const BinarySubpathRule = Type.RegEx(/^[ -~]{1,1024}$/);
+
 export const Tag = Type.String({
   format: 'semver-tag',
   transform: [ 'trim' ],
diff --git a/test/port/controller/BinarySyncController/showBinary.test.ts b/test/port/controller/BinarySyncController/showBinary.test.ts
index 54465eb4..ce1ff62b 100644
--- a/test/port/controller/BinarySyncController/showBinary.test.ts
+++ b/test/port/controller/BinarySyncController/showBinary.test.ts
@@ -161,6 +161,16 @@ describe('test/port/controller/BinarySyncController/showBinary.test.ts', () => {
       ]);
     });
 
+    it('should forbidden invalid paths', async () => {
+      const res = await app.httpRequest()
+        .get('/-/binary/chromium-browser-snapshots/Linux_x64/970485/%E4%B8%8B%E8%BD%BD%E7%9A%84');
+      assert.equal(res.status, 404);
+      assert.equal(res.headers['content-type'], 'application/json; charset=utf-8');
+      assert.deepEqual(res.body, {
+        error: '[NOT_FOUND] Binary "chromium-browser-snapshots/Linux_x64/970485/下载的" not found',
+      });
+    });
+
     it('should show node binaries', async () => {
       app.mockHttpclient('https://nodejs.org/dist/index.json', 'GET', {
         data: await TestUtil.readFixturesFile('nodejs.org/site/index.json'),