security: fix path traversal vulnerability in conversion API (#532)

src/converters/main.ts

@@ -164,13 +164,18 @@ export async function handleConvert(
     const toProcess: Promise<string>[] = [];
     for (const fileName of chunk) {
       const filePath = `${userUploadsDir}${fileName}`;
-      const fileTypeOrig = fileName.split(".").pop() ?? "";
+      const fileTypeOrig = fileName.includes(".") ? (fileName.split(".").pop() ?? "") : "";
       const fileType = normalizeFiletype(fileTypeOrig);
       const newFileExt = normalizeOutputFiletype(convertTo);
-      const newFileName = fileName.replace(
+      let newFileName: string;
-        new RegExp(`${fileTypeOrig}(?!.*${fileTypeOrig})`),
+      if (fileTypeOrig === "") {
-        newFileExt,
+        newFileName = `${fileName}.${newFileExt}`;
-      );
+      } else {
+        newFileName = fileName.replace(
+          new RegExp(`${fileTypeOrig}(?!.*${fileTypeOrig})`),
+          newFileExt,
+        );
+      }
       const targetPath = `${userOutputDir}${newFileName}`;
       toProcess.push(
         new Promise((resolve, reject) => {

src/pages/convert.tsx

@@ -47,7 +47,12 @@ export const convert = new Elysia().use(userService).post(
     const convertTo = normalizeFiletype(body.convert_to.split(",")[0] ?? "");
     const converterName = body.convert_to.split(",")[1];
 
-    if (!converterName) {
+    if (
+      !converterName ||
+      convertTo.includes("/") ||
+      convertTo.includes("\\") ||
+      convertTo.includes("..")
+    ) {
       return redirect(`${WEBROOT}/`, 302);
     }