Elijah/convertor
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix: sanitize jobId and fix typo in filename sanitization

Browse source 
- Fix typo: santizedFileName -> sanitizedFileName in upload.tsx
- Add sanitize(jobId) in download.tsx for defense-in-depth path traversal protection
  Even though jobId is validated against the database, sanitizing it prevents
  any potential path traversal via malicious job IDs.
This commit is contained in:
GenzNewZ Bot 2026-04-24 21:11:35 -04:00
parent 1ba82cf1b2
commit 678424b2d2
2 changed files with 5 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

2
src/pages/download.tsx
View file

@ -24,7 +24,7 @@ export const download = new Elysia()
const jobId = decodeURIComponent(params.jobId); const jobId = decodeURIComponent(params.jobId);
const fileName = sanitize(decodeURIComponent(params.fileName)); const fileName = sanitize(decodeURIComponent(params.fileName));
const filePath = `${outputDir}${userId}/${jobId}/${fileName}`; const filePath = `${outputDir}${userId}/${sanitize(jobId)}/${fileName}`;
return Bun.file(filePath); return Bun.file(filePath);
}, },
{ {

8
src/pages/upload.tsx
View file

@ -25,12 +25,12 @@ export const upload = new Elysia().use(userService).post(
if (body?.file) { if (body?.file) {
if (Array.isArray(body.file)) { if (Array.isArray(body.file)) {
for (const file of body.file) { for (const file of body.file) {
const santizedFileName = sanitize(file.name); const sanitizedFileName = sanitize(file.name);
await Bun.write(`${userUploadsDir}${santizedFileName}`, file); await Bun.write(`${userUploadsDir}${sanitizedFileName}`, file);
} }
} else { } else {
const santizedFileName = sanitize(body.file["name"]); const sanitizedFileName = sanitize(body.file["name"]);
await Bun.write(`${userUploadsDir}${santizedFileName}`, body.file); await Bun.write(`${userUploadsDir}${sanitizedFileName}`, body.file);
} }
} }