From 678424b2d2b4ed0b131a0c5b6d08ec054a614b7d Mon Sep 17 00:00:00 2001 From: GenzNewZ Bot Date: Fri, 24 Apr 2026 21:11:35 -0400 Subject: [PATCH] fix: sanitize jobId and fix typo in filename sanitization - Fix typo: santizedFileName -> sanitizedFileName in upload.tsx - Add sanitize(jobId) in download.tsx for defense-in-depth path traversal protection Even though jobId is validated against the database, sanitizing it prevents any potential path traversal via malicious job IDs. --- src/pages/download.tsx | 2 +- src/pages/upload.tsx | 8 ++++---- 2 files changed, 5 insertions(+), 5 deletions(-) diff --git a/src/pages/download.tsx b/src/pages/download.tsx index f10fec4..3cdc01e 100644 --- a/src/pages/download.tsx +++ b/src/pages/download.tsx @@ -24,7 +24,7 @@ export const download = new Elysia() const jobId = decodeURIComponent(params.jobId); const fileName = sanitize(decodeURIComponent(params.fileName)); - const filePath = `${outputDir}${userId}/${jobId}/${fileName}`; + const filePath = `${outputDir}${userId}/${sanitize(jobId)}/${fileName}`; return Bun.file(filePath); }, { diff --git a/src/pages/upload.tsx b/src/pages/upload.tsx index 0c00009..f7cb9bc 100644 --- a/src/pages/upload.tsx +++ b/src/pages/upload.tsx @@ -25,12 +25,12 @@ export const upload = new Elysia().use(userService).post( if (body?.file) { if (Array.isArray(body.file)) { for (const file of body.file) { - const santizedFileName = sanitize(file.name); - await Bun.write(`${userUploadsDir}${santizedFileName}`, file); + const sanitizedFileName = sanitize(file.name); + await Bun.write(`${userUploadsDir}${sanitizedFileName}`, file); } } else { - const santizedFileName = sanitize(body.file["name"]); - await Bun.write(`${userUploadsDir}${santizedFileName}`, body.file); + const sanitizedFileName = sanitize(body.file["name"]); + await Bun.write(`${userUploadsDir}${sanitizedFileName}`, body.file); } }