@kne/fastify-file-manager 3.0.1-alpha.2 → 3.0.1

package/libs/services/file-record.js

@@ -13,6 +13,8 @@ module.exports = fp(async (fastify, fastifyOptions) => {
   const { models, services } = fastify.fileManager;
   const { Op } = fastify.sequelize.Sequelize;
 
+  const sanitizeFilename = filename => filename.replace(/[\\/:*?"<>|\0]/g, '_');
+
   const detail = async ({ id, uuid, namespace }) => {
     const file = await models.fileRecord.findOne({
       where: { uuid: String(id || uuid).split('?')[0] }
@@ -25,7 +27,8 @@ module.exports = fp(async (fastify, fastifyOptions) => {
     return file;
   };
   const uploadToFileSystem = async ({ id, file, namespace, options }) => {
-    const { filename, encoding, mimetype } = file;
+    const { encoding, mimetype } = file;
+    const filename = sanitizeFilename(file.filename);
     const hash = crypto.createHash('md5');
     const extension = path.extname(filename);
     const tmpPath = path.resolve(os.tmpdir(), `temp_${filename}_${crypto.randomBytes(6).toString('hex')}`);
@@ -190,7 +193,7 @@ module.exports = fp(async (fastify, fastifyOptions) => {
     }
 
     const tempFile = {
-      filename,
+      filename: sanitizeFilename(filename),
       mimetype: response.headers.get('content-type'),
       encoding: 'binary',
       file: nodeStream
@@ -308,6 +311,10 @@ module.exports = fp(async (fastify, fastifyOptions) => {
 
   const renameFile = async ({ id, filename }) => {
     const file = await detail({ id });
+    filename = sanitizeFilename(filename);
+    if (!path.extname(filename) && path.extname(file.filename)) {
+      filename += path.extname(file.filename);
+    }
     file.filename = filename;
     await file.save();
   };
@@ -374,15 +381,22 @@ module.exports = fp(async (fastify, fastifyOptions) => {
     await fs.mkdir(tmpPath);
     const files = [];
     for (const file of fileList) {
-      const filepath = path.resolve(tmpPath, file.filename);
-      const writeStream = fs.createWriteStream(filepath);
-      const fileStream = await getFileReadStream(file);
-      fileStream.pipe(writeStream);
-      await new Promise((resolve, reject) => {
-        writeStream.on('finish', resolve);
-        writeStream.on('error', reject);
-      });
-      files.push(filepath);
+      try {
+        const fileStream = await getFileReadStream(file);
+        const filepath = path.resolve(tmpPath, file.filename);
+        const writeStream = fs.createWriteStream(filepath);
+        fileStream.pipe(writeStream);
+        await new Promise((resolve, reject) => {
+          writeStream.on('finish', resolve);
+          writeStream.on('error', reject);
+        });
+        files.push(filepath);
+      } catch (error) {
+        console.warn(`skip invalid file: ${file.uuid}`, error.message);
+      }
+    }
+    if (files.length === 0) {
+      throw new Error('No valid files to compress');
     }
     const compressStream = new compressing[type].Stream();
     files.forEach(filepath => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kne/fastify-file-manager",
-  "version": "3.0.1-alpha.2",
+  "version": "3.0.1",
   "description": "用于管理静态文件上传查看等",
   "main": "index.js",
   "scripts": {
@@ -8,7 +8,8 @@
     "build:md": "npx @kne/md-doc",
     "start:md": "npx @kne/md-doc --watch",
     "prettier": "prettier --config .prettierrc --write '{libs/**/*,index}.{js,jsx,ts,tsx,json,css,scss}'",
-    "lint-staged": "npx lint-staged"
+    "lint-staged": "npx lint-staged",
+    "test": "mocha tests/**/*.test.js --timeout 30000"
   },
   "lint-staged": {
     "{libs/**/*,index}.{js,jsx,ts,tsx,json,css,scss}": [
@@ -37,6 +38,7 @@
     "@kne/fastify-sequelize": "^2.0.1",
     "fastify": "^5.3.2",
     "husky": "^9.0.11",
+    "mocha": "^11.7.5",
     "prettier": "^3.2.5",
     "qs": "^6.12.3",
     "sqlite3": "^5.1.7"