@maiyunnet/kebab 9.14.3 → 9.15.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@maiyunnet/kebab",
-  "version": "9.14.3",
+  "version": "9.15.0",
   "description": "Simple, easy-to-use, and fully-featured Node.js framework that is ready-to-use out of the box.",
   "type": "module",
   "keywords": [

package/sys/child.js

@@ -243,14 +243,6 @@ async function requestHandler(req, res, https) {
         // --- 不能用 req.socket.destroy() 可能会导致底层复用（如 CDN） 的连接被直接断开 ---
         res.end('403 Forbidden');
         return;
-        /*
-        const text = '<h1>Kebab: No permissions</h1>host: ' + (req.headers[':authority'] as string | undefined ?? req.headers['host'] ?? '') + '<br>url: ' + (lText.htmlescape(req.url ?? ''));
-        res.setHeader('content-type', 'text/html; charset=utf-8');
-        res.setHeader('content-length', Buffer.byteLength(text));
-        res.writeHead(403);
-        res.end(text);
-        return;
-        */
     }
     /** --- 请求的路径部分，前导带 / 末尾不一定，用户怎么请求就是什么 --- */
     let path = uri.pathname ?? '/';

package/sys/ctr.d.ts

@@ -344,6 +344,12 @@ export declare class Ctr {
         'allowedExts'?: string[];
         /** --- 单个字段（非文件）最大字节数，默认 1 MB --- */
         'maxFieldSize'?: number;
+        /** --- 整体请求最大字节数，不设置或设为 0 则不限制 --- */
+        'maxTotalSize'?: number;
+        /** --- 单个 multipart 段头部最大字节数，默认 16 KB --- */
+        'maxHeaderSize'?: number;
+        /** --- multipart 字段与文件总数量，默认 1000 --- */
+        'maxParts'?: number;
         /** --- 整体请求超时时间（毫秒），默认 5 分钟，设为 0 禁用超时 --- */
         'timeout'?: number;
     }): Promise<boolean>;

package/sys/master.js

@@ -7,6 +7,7 @@ import cluster from 'cluster';
 import * as os from 'os';
 import * as fs from 'fs';
 import * as http from 'http';
+import * as path from 'path';
 // --- 库和定义 ---
 import * as kebab from '#kebab/index.js';
 import * as sRoute from '#kebab/sys/route.js';
@@ -18,6 +19,70 @@ import * as lTime from '#kebab/lib/time.js';
 import * as lZip from '#kebab/lib/zip.js';
 /** --- 当前运行中的子进程列表 --- */
 const workerList = {};
+/**
+ * --- 判断候选路径是否位于指定根目录内 ---
+ * @param rootPath 已解析的真实根目录
+ * @param candidate 候选绝对路径
+ */
+function isPathInside(rootPath, candidate) {
+    const relative = path.relative(rootPath, candidate);
+    return (relative === '') || (!relative.startsWith(`..${path.sep}`) && (relative !== '..') && !path.isAbsolute(relative));
+}
+/**
+ * --- 解析根目录内的路径，并阻止通过绝对路径、.. 或符号链接逃逸 ---
+ * @param rootPath 限定的根目录
+ * @param inputPath 用户输入的相对路径
+ */
+async function resolvePathInside(rootPath, inputPath) {
+    if ((typeof inputPath !== 'string') || inputPath.includes('\0')) {
+        return null;
+    }
+    const rootReal = await fs.promises.realpath(rootPath);
+    const normalizedInput = inputPath.replace(/\\/g, '/').replace(/^\/+/, '');
+    if (/^[a-zA-Z]:/.test(normalizedInput)) {
+        return null;
+    }
+    const candidate = path.resolve(rootReal, normalizedInput);
+    if (!isPathInside(rootReal, candidate)) {
+        return null;
+    }
+    /** --- 向上找到已存在的最近父路径，用 realpath 校验其中的符号链接 --- */
+    let existingPath = candidate;
+    const missingParts = [];
+    while (true) {
+        try {
+            const existingReal = await fs.promises.realpath(existingPath);
+            const resolved = path.resolve(existingReal, ...missingParts);
+            return isPathInside(rootReal, resolved) ? resolved : null;
+        }
+        catch {
+            const parent = path.dirname(existingPath);
+            if (parent === existingPath) {
+                return null;
+            }
+            missingParts.unshift(path.basename(existingPath));
+            existingPath = parent;
+        }
+    }
+}
+/**
+ * --- 规范化 ZIP 条目路径，返回带前导斜杠的安全相对路径 ---
+ * @param archivePath ZIP 内的原始路径
+ */
+function normalizeArchivePath(archivePath) {
+    const normalizedSlashes = archivePath.replace(/\\/g, '/').replace(/^\/+/, '');
+    if (!normalizedSlashes ||
+        normalizedSlashes.includes('\0') ||
+        /^[a-zA-Z]:/.test(normalizedSlashes) ||
+        normalizedSlashes.split('/').some(part => !part || (part === '.') || (part === '..'))) {
+        return null;
+    }
+    const normalized = path.posix.normalize(normalizedSlashes);
+    if (normalized.startsWith('../') || (normalized === '..') || path.posix.isAbsolute(normalized)) {
+        return null;
+    }
+    return `/${normalized}`;
+}
 /**
  * --- 等待指定 worker 开始监听端口就绪 ---
  * @param worker 要等待的 worker 对象
@@ -128,7 +193,7 @@ function createRpcListener() {
                 res.end('Failed');
                 return;
             }
-            if (msg.time < time - 5) {
+            if ((typeof msg.time !== 'number') || (Math.abs(msg.time - time) > 5)) {
                 res.end('Timeout');
                 return;
             }
@@ -226,28 +291,16 @@ function createRpcListener() {
                         res.end('Invalid staticVer');
                         return;
                     }
-                    let path = msg.path;
-                    if (path.startsWith('/')) {
-                        path = path.slice(1);
-                    }
-                    if (path.endsWith('/')) {
-                        path = path.slice(0, -1);
-                    }
-                    // --- 拒绝路径穿越，防止跳出 ROOT_CWD ---
-                    if (path.includes('..')) {
+                    const to = await resolvePathInside(kebab.ROOT_CWD, msg.path);
+                    if (!to) {
                         res.end('Invalid path');
                         return;
                     }
-                    /** --- 最终的项目根目录，以 / 结尾，但用户传入的无所谓 --- */
-                    let to = kebab.ROOT_CWD + path;
-                    if (!to.endsWith('/')) {
-                        to += '/';
-                    }
                     if (!await lFs.isDir(to)) {
                         res.end('[project] Path not found: ' + to);
                         return;
                     }
-                    const projectFile = to + 'kebab.json';
+                    const projectFile = path.join(to, 'kebab.json');
                     if (!await lFs.isFile(projectFile)) {
                         res.end('kebab.json not found in project path');
                         return;
@@ -303,18 +356,20 @@ function createRpcListener() {
                         await sRoute.unlinkUploadFiles(rtn.files);
                         return;
                     }
-                    let path = rtn.post['path'];
-                    if (path.startsWith('/')) {
-                        path = path.slice(1);
-                    }
-                    if (path.endsWith('/')) {
-                        path = path.slice(0, -1);
+                    const inputPath = rtn.post['path'];
+                    if (typeof inputPath !== 'string') {
+                        res.end('Invalid path');
+                        await sRoute.unlinkUploadFiles(rtn.files);
+                        return;
                     }
-                    /** --- 最终更新的根目录，以 / 结尾，但用户传入的无所谓 --- */
-                    let to = kebab.ROOT_CWD + path;
-                    if (!to.endsWith('/')) {
-                        to += '/';
+                    /** --- 最终更新的根目录 --- */
+                    const targetPath = await resolvePathInside(kebab.ROOT_CWD, inputPath);
+                    if (!targetPath) {
+                        res.end('Invalid path');
+                        await sRoute.unlinkUploadFiles(rtn.files);
+                        return;
                     }
+                    const to = targetPath + path.sep;
                     if (!await lFs.isDir(to)) {
                         if (rtn.post['strict'] === '1') {
                             res.end(`[code][0] [${rtn.post['strict']}] Path not found: ${to}`);
@@ -335,7 +390,28 @@ function createRpcListener() {
                         await sRoute.unlinkUploadFiles(rtn.files);
                         return;
                     }
-                    const ls = await zip.getList();
+                    const archiveEntries = zip.readDir('/', {
+                        'hasChildren': true,
+                        'hasDir': false,
+                    });
+                    const archiveSize = archiveEntries.reduce((total, item) => total + item.uncompressedSize, 0);
+                    if ((archiveEntries.length > 10_000) || (archiveSize > 512 * 1024 * 1024)) {
+                        res.end('Archive limit exceeded');
+                        await sRoute.unlinkUploadFiles(rtn.files);
+                        return;
+                    }
+                    const rawList = await zip.getList();
+                    /** --- 经过路径校验并统一为带前导斜杠的 ZIP 文件列表 --- */
+                    const ls = {};
+                    for (const archivePath in rawList) {
+                        const normalizedPath = normalizeArchivePath(archivePath);
+                        if (!normalizedPath || (ls[normalizedPath] !== undefined)) {
+                            res.end('Invalid archive path');
+                            await sRoute.unlinkUploadFiles(rtn.files);
+                            return;
+                        }
+                        ls[normalizedPath] = rawList[archivePath];
+                    }
                     // --- 预扫描：收集 .cga 锁定目录和 kebab 子项目目录 ---
                     /** --- .cga 锁定的目录集合，key 格式为"父路径/目录名/"（不含开头/，含尾部/），例如 "www/pika/" --- */
                     const cgaLockedDirs = new Set();
@@ -401,9 +477,9 @@ function createRpcListener() {
                         'tmp',
                         'temp',
                     ]);
-                    for (const path in ls) {
+                    for (const archivePath in ls) {
                         /** --- 带 / 开头的 zip 中文件完整路径，例如 "/www/pika/ctr/api.js" --- */
-                        const fpath = path.startsWith('/') ? path : '/' + path;
+                        const fpath = archivePath.startsWith('/') ? archivePath : '/' + archivePath;
                         /** --- 纯路径中最后一个 / 的位置索引 --- */
                         const lio = fpath.lastIndexOf('/');
                         /** --- 纯路径，不以 / 开头，以 / 结尾，若是根路径就是空字符串，例如 "www/pika/ctr/" --- */
@@ -473,21 +549,33 @@ function createRpcListener() {
                             }
                         }
                         // --- 看文件夹是否存在 ---
-                        if (pat && !await lFs.isDir(to + pat)) {
+                        const targetDir = await resolvePathInside(to, pat);
+                        if (!targetDir) {
+                            res.end('Invalid archive directory');
+                            await sRoute.unlinkUploadFiles(rtn.files);
+                            return;
+                        }
+                        if (pat && !await lFs.isDir(targetDir)) {
                             if (rtn.post['strict'] === '1') {
-                                res.end(`[code][1] [${rtn.post['strict']}] Path not found: ${to + pat}`);
+                                res.end(`[code][1] [${rtn.post['strict']}] Path not found: ${targetDir}`);
                                 await sRoute.unlinkUploadFiles(rtn.files);
                                 return;
                             }
-                            await lFs.mkdir(to + pat);
+                            await lFs.mkdir(targetDir);
+                        }
+                        const targetFile = await resolvePathInside(to, pat + fname);
+                        if (!targetFile) {
+                            res.end('Invalid archive file');
+                            await sRoute.unlinkUploadFiles(rtn.files);
+                            return;
                         }
                         // --- 覆盖或创建文件 ---
-                        if ((rtn.post['strict'] === '1') && !await lFs.isFile(to + pat + fname)) {
-                            res.end(`[code][2] [${rtn.post['strict']}] Path not found: ${to + pat + fname}`);
+                        if ((rtn.post['strict'] === '1') && !await lFs.isFile(targetFile)) {
+                            res.end(`[code][2] [${rtn.post['strict']}] Path not found: ${targetFile}`);
                             await sRoute.unlinkUploadFiles(rtn.files);
                             return;
                         }
-                        await lFs.putContent(to + pat + fname, ls[path]);
+                        await lFs.putContent(targetFile, ls[archivePath]);
                     }
                     await sRoute.unlinkUploadFiles(rtn.files);
                     // --- 检查是否更新 config ---
@@ -529,25 +617,47 @@ function createRpcListener() {
                     // --- 获取日志信息 ---
                     const format = lCore.globalConfig.logFormat ?? 'jsonl';
                     const ext = format === 'jsonl' ? '.jsonl' : '.csv';
-                    const path = kebab.LOG_CWD + msg.hostname + (msg.fend ?? '') + '/' + msg.path + ext;
-                    if (!await lFs.isFile(path)) {
+                    const fend = msg.fend ?? '';
+                    if ((typeof msg.hostname !== 'string') ||
+                        (typeof msg.path !== 'string') ||
+                        !/^[\w.-]+$/.test(msg.hostname) ||
+                        !/^(?:|-[\w-]+)$/.test(fend) ||
+                        !/^[\w./-]+$/.test(msg.path)) {
+                        res.end('Invalid log path');
+                        return;
+                    }
+                    const logPath = await resolvePathInside(kebab.LOG_CWD, `${msg.hostname}${fend}/${msg.path}${ext}`);
+                    if (!logPath) {
+                        res.end('Invalid log path');
+                        return;
+                    }
+                    if (!await lFs.isFile(logPath)) {
                         res.end(lText.stringifyJson({
                             'result': 1,
                             'data': null,
                         }));
                         return;
                     }
-                    let limit = msg.limit ?? 100;
-                    const offset = msg.offset ?? 0;
+                    let limit = Number.isSafeInteger(msg.limit) ? msg.limit : 100;
+                    const offset = Number.isSafeInteger(msg.offset) ? msg.offset : 0;
+                    limit = Math.min(Math.max(limit, 1), 1000);
+                    if (offset < 0) {
+                        res.end('Invalid offset');
+                        return;
+                    }
                     let total = 0;
                     if (msg.search) {
+                        if ((typeof msg.search !== 'string') || (msg.search.length > 500) || msg.search.includes('\0')) {
+                            res.end('Invalid search');
+                            return;
+                        }
                         // === 搜索模式：total 为匹配行数，offset/limit 均基于匹配行 ===
                         // --- shell 单引号安全转义（防止特殊字符破坏命令）---
                         const escaped = msg.search.replace(/'/g, "'\\''");
                         // --- 获取匹配行总数（grep -c 无匹配时退出码 1，|| echo 0 兜底）---
                         const countCmd = format === 'csv'
-                            ? `tail -n +2 "${path}" | grep -F -c '${escaped}' || echo 0`
-                            : `grep -F -c '${escaped}' "${path}" || echo 0`;
+                            ? `tail -n +2 "${logPath}" | grep -F -c '${escaped}' || echo 0`
+                            : `grep -F -c '${escaped}' "${logPath}" || echo 0`;
                         const countRtn = await lCore.exec(countCmd);
                         if (countRtn !== false) {
                             total = parseInt(countRtn.trim()) || 0;
@@ -556,8 +666,8 @@ function createRpcListener() {
                         const from = offset + 1;
                         const to = offset + limit;
                         const dataCmd = format === 'csv'
-                            ? `tail -n +2 "${path}" | grep -F '${escaped}' | sed -n '${from},${to}p'`
-                            : `grep -F '${escaped}' "${path}" | sed -n '${from},${to}p'`;
+                            ? `tail -n +2 "${logPath}" | grep -F '${escaped}' | sed -n '${from},${to}p'`
+                            : `grep -F '${escaped}' "${logPath}" | sed -n '${from},${to}p'`;
                         const dataRtn = await lCore.exec(dataCmd);
                         if (dataRtn === false) {
                             res.end(lText.stringifyJson({
@@ -619,7 +729,7 @@ function createRpcListener() {
                         return;
                     }
                     // === 无搜索模式：wc -l 获取总行数，grep -b '^' 定位字节偏移直接跳至 offset ===
-                    const wclRtn = await lCore.exec(`wc -l "${path}"`);
+                    const wclRtn = await lCore.exec(`wc -l "${logPath}"`);
                     if (wclRtn !== false) {
                         const wclMatch = /^\s*(\d+)/.exec(wclRtn);
                         if (wclMatch) {
@@ -641,7 +751,7 @@ function createRpcListener() {
                     if (offset > 0) {
                         const skipLines = format === 'jsonl' ? offset : offset + 1;
                         // --- sed -n '${N}{p;q}' 找到第 N 行后立即退出，使 grep 收到 SIGPIPE 提前终止 ---
-                        const grepRtn = await lCore.exec(`grep -b '^' "${path}" | sed -n '${skipLines + 1}{p;q}'`);
+                        const grepRtn = await lCore.exec(`grep -b '^' "${logPath}" | sed -n '${skipLines + 1}{p;q}'`);
                         if (grepRtn !== false) {
                             const grepMatch = /^(\d+):/.exec(grepRtn.trim());
                             if (grepMatch) {
@@ -671,7 +781,7 @@ function createRpcListener() {
                         let line = 0;
                         /** --- 当前行数据 --- */
                         let packet = '';
-                        lFs.createReadStream(path, {
+                        lFs.createReadStream(logPath, {
                             'encoding': 'utf8',
                             'start': startByte,
                         }).on('data', buf => {
@@ -759,10 +869,10 @@ function createRpcListener() {
                         res.end('Invalid path');
                         return;
                     }
-                    const path = lText.urlResolve(kebab.ROOT_CWD, msg.path, true);
+                    const targetPath = lText.urlResolve(kebab.ROOT_CWD, msg.path, true);
                     res.end(lText.stringifyJson({
                         'result': 1,
-                        'data': (await lFs.readDir(path, msg.encoding)).map(item => ({
+                        'data': (await lFs.readDir(targetPath, msg.encoding)).map(item => ({
                             'isFile': item.isFile(),
                             'isDirectory': item.isDirectory(),
                             'isSymbolicLink': item.isSymbolicLink(),

package/sys/route.d.ts

@@ -79,6 +79,12 @@ export declare function getFormData(req: http2.Http2ServerRequest | http.Incomin
     'allowedExts'?: string[];
     /** --- 单个字段（非文件）最大字节数，默认 1 MB --- */
     'maxFieldSize'?: number;
+    /** --- 整体请求最大字节数，不设置或设为 0 则不限制 --- */
+    'maxTotalSize'?: number;
+    /** --- 单个 multipart 段头部最大字节数，默认 16 KB --- */
+    'maxHeaderSize'?: number;
+    /** --- multipart 字段与文件总数量，默认 1000 --- */
+    'maxParts'?: number;
     /** --- 整体请求超时时间（毫秒），默认 5 分钟，设为 0 禁用超时 --- */
     'timeout'?: number;
 }): Promise<{

package/sys/route.js

@@ -41,6 +41,20 @@ function respond500(res) {
         res.end(content);
     }
 }
+/**
+ * --- 安全写入外部输入键，避免 __proto__ 等特殊键改变对象原型 ---
+ * @param target 目标对象
+ * @param key 键
+ * @param value 值
+ */
+function setInputValue(target, key, value) {
+    Object.defineProperty(target, key, {
+        'configurable': true,
+        'enumerable': true,
+        'value': value,
+        'writable': true,
+    });
+}
 /**
  * --- 输出 404 错误响应 ---
  * @param res 响应对象
@@ -58,7 +72,7 @@ function respond404(res, config, path) {
         }
         return;
     }
-    const content = '[Error] Controller not found, path: ' + path + '.';
+    const content = '[Error] Controller not found, path: ' + lText.htmlescape(path) + '.';
     if (!res.headersSent) {
         res.setHeader('content-type', 'text/html; charset=utf-8');
         res.setHeader('content-length', Buffer.byteLength(content));
@@ -245,17 +259,17 @@ export async function run(data) {
             const key = cookie.slice(0, eqIndex).trim();
             const rawVal = cookie.slice(eqIndex + 1);
             try {
-                cookies[key] = decodeURIComponent(rawVal);
+                setInputValue(cookies, key, decodeURIComponent(rawVal));
             }
             catch {
-                cookies[key] = rawVal;
+                setInputValue(cookies, key, rawVal);
             }
         }
     }
     // --- 处理 headers ---
     const headers = {};
     for (const key in data.req.headers) {
-        headers[key.toLowerCase()] = data.req.headers[key];
+        setInputValue(headers, key.toLowerCase(), data.req.headers[key]);
     }
     headers['authorization'] ??= '';
     /** --- 开发者返回值 --- */
@@ -922,9 +936,9 @@ export function getFormData(req, events = {}, limits = {}) {
             resolve({ 'post': {}, 'files': {} });
             return;
         }
-        /** --- boundary 位置 --- */
-        const clio = ct.lastIndexOf('boundary=');
-        if (clio === -1) {
+        /** --- 获取 boundary，兼容带引号及后续参数的标准写法 --- */
+        const boundaryMatch = /(?:^|;)\s*boundary\s*=\s*(?:"([^"]+)"|([^;\s]+))/i.exec(ct);
+        if (!boundaryMatch) {
             resolve({ 'post': {}, 'files': {} });
             return;
         }
@@ -934,7 +948,11 @@ export function getFormData(req, events = {}, limits = {}) {
             'files': {}
         };
         /** --- 获取的 boundary 文本 --- */
-        const boundary = ct.slice(clio + 9);
+        const boundary = boundaryMatch[1] ?? boundaryMatch[2];
+        if (!boundary || (boundary.length > 200) || /[\r\n]/.test(boundary)) {
+            resolve(false);
+            return;
+        }
         // --- 超时护盾：防止网络静默断开时 Promise 永不 resolve ---
         /** --- 超时定时器 --- */
         let timer;
@@ -978,6 +996,10 @@ export function getFormData(req, events = {}, limits = {}) {
         let readEnd = false;
         /** --- 是否有文件被限制拒绝（整体返回 false） --- */
         let rejected = false;
+        /** --- 已接收的请求体字节数 --- */
+        let totalSize = 0;
+        /** --- 已解析的字段与文件数量 --- */
+        let partCount = 0;
         /** --- 清理 rtn.files 中所有已写入的临时文件 --- */
         function cleanupFiles() {
             for (const key in rtn.files) {
@@ -990,6 +1012,16 @@ export function getFormData(req, events = {}, limits = {}) {
                 }
             }
         }
+        /** --- 清理仍在写入、尚未加入 rtn.files 的临时文件 --- */
+        function cleanupActiveFile() {
+            if ((state !== EState.FILE) || !ftmpName) {
+                return;
+            }
+            ftmpStream.destroy();
+            lFs.unlink(kebab.FTMP_CWD + ftmpName).catch(() => { });
+            ftmpName = '';
+            --writeFileLength;
+        }
         // --- 启动超时定时器（在所有变量声明之后，确保回调闭包可引用） ---
         const timeoutMs = limits.timeout ?? 300_000;
         if (timeoutMs > 0) {
@@ -998,9 +1030,7 @@ export function getFormData(req, events = {}, limits = {}) {
                     return;
                 }
                 finished = true;
-                if ((state === EState.FILE) && ftmpName && ftmpStream) {
-                    ftmpStream.destroy();
-                }
+                cleanupActiveFile();
                 lCore.debug('[ROUTE][GETFORMDATA] formdata request timeout');
                 lCore.log({}, '[ROUTE][GETFORMDATA] formdata request timeout after ' + timeoutMs + 'ms', '-error');
                 cleanupFiles();
@@ -1032,6 +1062,16 @@ export function getFormData(req, events = {}, limits = {}) {
         }
         // --- 开始读取 ---
         req.on('data', function (chunk) {
+            if (finished || rejected) {
+                return;
+            }
+            totalSize += chunk.length;
+            if ((limits.maxTotalSize !== undefined) && (limits.maxTotalSize > 0) && (totalSize > limits.maxTotalSize)) {
+                rejected = true;
+                cleanupActiveFile();
+                buffer = Buffer.from('');
+                return;
+            }
             buffer = Buffer.concat([buffer, chunk], buffer.length + chunk.length);
             while (true) {
                 switch (state) {
@@ -1039,9 +1079,19 @@ export function getFormData(req, events = {}, limits = {}) {
                         /** --- 中断符位置 --- */
                         const io = buffer.indexOf('\r\n\r\n');
                         if (io === -1) {
+                            if (buffer.length > (limits.maxHeaderSize ?? 16 * 1024)) {
+                                rejected = true;
+                                buffer = Buffer.from('');
+                            }
                             return;
                         }
                         // --- 头部已经读取完毕 ---
+                        ++partCount;
+                        if (partCount > (limits.maxParts ?? 1000)) {
+                            rejected = true;
+                            buffer = Buffer.from('');
+                            return;
+                        }
                         const head = buffer.subarray(0, io).toString();
                         // --- 除头部外剩下的 buffer ---
                         buffer = buffer.subarray(io + 4);
@@ -1084,8 +1134,20 @@ export function getFormData(req, events = {}, limits = {}) {
                                     date.getUTCDate().toString().padStart(2, '0') +
                                     date.getUTCHours().toString().padStart(2, '0') +
                                     date.getUTCMinutes().toString().padStart(2, '0') + '_' + lCore.random() + '.ftmp';
-                                ftmpStream = lFs.createWriteStream(kebab.FTMP_CWD + ftmpName);
-                                ftmpStream.on('error', () => { });
+                                const activeName = ftmpName;
+                                const activePath = kebab.FTMP_CWD + activeName;
+                                const activeStream = lFs.createWriteStream(activePath);
+                                ftmpStream = activeStream;
+                                activeStream.on('error', (error) => {
+                                    rejected = true;
+                                    lFs.unlink(activePath).catch(() => { });
+                                    if (ftmpStream === activeStream) {
+                                        ftmpName = '';
+                                    }
+                                    --writeFileLength;
+                                    req.resume();
+                                    lCore.log({}, `[ROUTE][GETFORMDATA] temporary file error: ${error.message}`, '-error');
+                                });
                                 ftmpSize = 0;
                             }
                             else {
@@ -1102,13 +1164,14 @@ export function getFormData(req, events = {}, limits = {}) {
                             const maxField = limits.maxFieldSize ?? 1_048_576;
                             if (buffer.length > maxField + boundary.length + 4) {
                                 rejected = true;
+                                buffer = Buffer.from('');
                                 return;
                             }
                             return;
                         }
                         // --- 找到结束标语，写入 POST ---
                         const val = buffer.subarray(0, io).toString();
-                        if (rtn.post[name]) {
+                        if (Object.hasOwn(rtn.post, name)) {
                             if (Array.isArray(rtn.post[name])) {
                                 rtn.post[name].push(val);
                             }
@@ -1117,7 +1180,7 @@ export function getFormData(req, events = {}, limits = {}) {
                             }
                         }
                         else {
-                            rtn.post[name] = val;
+                            setInputValue(rtn.post, name, val);
                         }
                         // --- 重置状态机 ---
                         state = EState.WAIT;
@@ -1138,7 +1201,10 @@ export function getFormData(req, events = {}, limits = {}) {
                                         rejectFile();
                                     }
                                     else {
-                                        ftmpStream.write(writeBuffer);
+                                        if (!ftmpStream.write(writeBuffer)) {
+                                            req.pause();
+                                            ftmpStream.once('drain', () => { req.resume(); });
+                                        }
                                         ftmpSize += Buffer.byteLength(writeBuffer);
                                     }
                                 }
@@ -1188,7 +1254,7 @@ export function getFormData(req, events = {}, limits = {}) {
                                     'size': ftmpSize,
                                     'path': kebab.FTMP_CWD + ftmpName
                                 };
-                                if (rtn.files[name]) {
+                                if (Object.hasOwn(rtn.files, name)) {
                                     if (Array.isArray(rtn.files[name])) {
                                         rtn.files[name].push(val);
                                     }
@@ -1197,7 +1263,7 @@ export function getFormData(req, events = {}, limits = {}) {
                                     }
                                 }
                                 else {
-                                    rtn.files[name] = val;
+                                    setInputValue(rtn.files, name, val);
                                 }
                             }
                         }
@@ -1223,9 +1289,7 @@ export function getFormData(req, events = {}, limits = {}) {
             }
             finished = true;
             clearTimer();
-            if ((state === EState.FILE) && ftmpName) {
-                ftmpStream.destroy();
-            }
+            cleanupActiveFile();
             lCore.debug('[ROUTE][GETFORMDATA] request error before getFormData: ' + e.message);
             lCore.log({}, '[ROUTE][GETFORMDATA] request error before getFormData: ' + (e.stack ?? ''), '-error');
             cleanupFiles();
@@ -1237,12 +1301,10 @@ export function getFormData(req, events = {}, limits = {}) {
                 return;
             }
             // --- 若数据未读完且连接已关闭，视为传输中断（多数是用户主动取消，无需记录错误） ---
-            if (!readEnd && writeFileLength > 0) {
+            if (!readEnd) {
                 finished = true;
                 clearTimer();
-                if ((state === EState.FILE) && ftmpName && ftmpStream) {
-                    ftmpStream.destroy();
-                }
+                cleanupActiveFile();
                 lCore.debug('[ROUTE][GETFORMDATA] connection closed before formdata complete');
                 cleanupFiles();
                 resolve(false);