From 580bded4abf6c0c61fa795d8d904ad725090b965 Mon Sep 17 00:00:00 2001
From: subnub <kyle.hoell@gmail.com>
Date: Wed, 25 Dec 2024 06:53:28 -0500
Subject: [PATCH] fixed be hosting html file even in dev mode, and fixed
 content disposition with invalid filenames

---
 backend/server/server.ts                               | 10 ++++++----
 backend/services/chunk-service/utils/getFileData.ts    |  9 ++++++++-
 .../services/chunk-service/utils/getPublicFileData.ts  |  5 ++++-
 backend/utils/sanitizeFilename.ts                      |  9 +++++++++
 4 files changed, 27 insertions(+), 6 deletions(-)
 create mode 100644 backend/utils/sanitizeFilename.ts

diff --git a/backend/server/server.ts b/backend/server/server.ts
index 2479547..10dc59d 100755
--- a/backend/server/server.ts
+++ b/backend/server/server.ts
@@ -45,7 +45,7 @@ app.use(cookieParser(env.passwordCookie));
 app.use(helmet());
 app.use(compression());
 app.use(express.json());
-app.use(express.static(publicPath));
+app.use(express.static(publicPath, { index: false }));
 app.use(bodyParser.json({ limit: "50mb" }));
 app.use(
   bodyParser.urlencoded({
@@ -70,8 +70,10 @@ app.use(middlewareErrorHandler);
 
 //console.log("Node Enviroment Mode:", nodeMode);
 
-app.get("*", (_: Request, res: Response) => {
-  res.sendFile(path.join(publicPath, "index.html"));
-});
+if (process.env.NODE_ENV === "production") {
+  app.get("*", (_: Request, res: Response) => {
+    res.sendFile(path.join(publicPath, "index.html"));
+  });
+}
 
 export default { server, serverHttps };
diff --git a/backend/services/chunk-service/utils/getFileData.ts b/backend/services/chunk-service/utils/getFileData.ts
index 8693132..85f0f81 100644
--- a/backend/services/chunk-service/utils/getFileData.ts
+++ b/backend/services/chunk-service/utils/getFileData.ts
@@ -8,6 +8,8 @@ import { createGenericParams } from "./storageHelper";
 import { getStorageActions } from "../actions/helper-actions";
 import FileDB from "../../../db/mongoDB/fileDB";
 import { FileInterface } from "../../../models/file-model";
+import NotAuthorizedError from "../../../utils/NotAuthorizedError";
+import sanitizeFilename from "../../../utils/sanitizeFilename";
 
 const fileDB = new FileDB();
 
@@ -33,6 +35,9 @@ const getFileAndRemoveActiveStream = async (
     if (!file) {
       throw new NotFoundError("File not found");
     }
+    if (file.metadata.owner !== userID) {
+      throw new NotAuthorizedError("Not owner of file");
+    }
     return file;
   } else {
     const { file, readStream, decipherStream } = cachedFileData;
@@ -127,10 +132,12 @@ const proccessData = (
       });
 
       if (!range) {
+        const sanatizedFilename = sanitizeFilename(currentFile.filename);
+        const encodedFilename = encodeURIComponent(sanatizedFilename);
         res.set("Content-Type", "binary/octet-stream");
         res.set(
           "Content-Disposition",
-          'attachment; filename="' + currentFile.filename + '"'
+          `attachment; filename="${sanatizedFilename}"; filename*=UTF-8''${encodedFilename}`
         );
         res.set("Content-Length", currentFile.metadata.size.toString());
       }
diff --git a/backend/services/chunk-service/utils/getPublicFileData.ts b/backend/services/chunk-service/utils/getPublicFileData.ts
index b815c5a..6e36462 100644
--- a/backend/services/chunk-service/utils/getPublicFileData.ts
+++ b/backend/services/chunk-service/utils/getPublicFileData.ts
@@ -9,6 +9,7 @@ import { getStorageActions } from "../actions/helper-actions";
 import FileDB from "../../../db/mongoDB/fileDB";
 import NotAuthorizedError from "../../../utils/NotAuthorizedError";
 import UserDB from "../../../db/mongoDB/userDB";
+import sanitizeFilename from "../../../utils/sanitizeFilename";
 
 const fileDB = new FileDB();
 const userDB = new UserDB();
@@ -63,10 +64,12 @@ const proccessData = (res: Response, fileID: string, tempToken: string) => {
         eventEmitter.emit("error", e);
       });
 
+      const sanatizedFilename = sanitizeFilename(file.filename);
+      const encodedFilename = encodeURIComponent(sanatizedFilename);
       res.set("Content-Type", "binary/octet-stream");
       res.set(
         "Content-Disposition",
-        'attachment; filename="' + file.filename + '"'
+        `attachment; filename="${sanatizedFilename}"; filename*=UTF-8''${encodedFilename}`
       );
       res.set("Content-Length", file.metadata.size.toString());
 
diff --git a/backend/utils/sanitizeFilename.ts b/backend/utils/sanitizeFilename.ts
new file mode 100644
index 0000000..1bc3849
--- /dev/null
+++ b/backend/utils/sanitizeFilename.ts
@@ -0,0 +1,9 @@
+const sanitizeFilename = (filename: string) => {
+  filename = filename.replace(/[\u0000-\u001F\u007F\u202F]/g, " ");
+  filename = filename.replace(/["<>:|?*\\;]/g, "_");
+  filename = filename.trim();
+
+  return filename;
+};
+
+export default sanitizeFilename;