@solidxai/core 0.1.13-beta.14 → 0.1.13-beta.16

package/src/services/media-storage.utils.ts

@@ -5,6 +5,11 @@ import { MediaStorageProviderMetadata } from 'src/entities/media-storage-provide
 import { SettingService } from 'src/services/setting.service';
 import { DEFAULT_MEDIA_FILE_STORAGE_DIR } from 'src/services/settings/default-settings-provider.service';
 import type { SolidCoreSetting } from 'src/services/settings/default-settings-provider.service';
+import { normalizeUploadedFileName } from 'src/constants/media-file-types';
+
+// Keeps the joined path well clear of filesystem NAME_MAX (255 on ext4/APFS) once the
+// multer hash prefix and separator are added.
+const MAX_STORED_FILE_NAME_LENGTH = 150;
 
 
 export interface MediaRecordCreateInput {
@@ -18,9 +23,29 @@ export interface MediaRecordCreateInput {
   originalFileName?: string;
 }
 
+/**
+ * Reduces a client-supplied name to something safe to interpolate into a filesystem path.
+ * `originalname` is fully attacker-controlled, so without this a name like
+ * `../../../../tmp/pwned.png` escapes the media storage directory entirely - the multer hash
+ * prefix does not contain it, because the leading `..` simply cancels the prefix segment.
+ *
+ * Everything outside a conservative allowlist becomes `_`; the result can never contain a
+ * path separator, so the joined path always stays inside the storage root.
+ */
+export function sanitizeStoredMediaFileName(originalName?: string | null): string {
+  const sanitized = normalizeUploadedFileName(originalName)
+    .replace(/[^A-Za-z0-9._-]/g, '_')
+    // Collapse any run of dots so no `..` segment can survive.
+    .replace(/\.{2,}/g, '.')
+    .replace(/^[._-]+/, '')
+    .slice(0, MAX_STORED_FILE_NAME_LENGTH);
+
+  return sanitized || 'file';
+}
+
 // Builds the stored file name format shared by media storage implementations.
 export function buildStoredMediaFileName(file: Pick<Express.Multer.File, 'filename' | 'originalname'>): string {
-  return `${file.filename}-${file.originalname}`;
+  return `${file.filename}-${sanitizeStoredMediaFileName(file.originalname)}`;
 }
 
 // Resolves the on-disk path for a media file based on settings and provider visibility.

package/src/services/module-metadata.service.ts

@@ -18,6 +18,7 @@ import { ModuleMetadataHelperService } from 'src/helpers/module-metadata-helper.
 import { ModuleMetadataRepository } from 'src/repository/module-metadata.repository';
 import { PermissionMetadataSeederService } from 'src/seeders/permission-metadata-seeder.service';
 import { DiskFileService } from 'src/services/file';
+import { sanitizeStoredMediaFileName } from 'src/services/media-storage.utils';
 import { BasicFilterDto } from '../dtos/basic-filters.dto';
 import { UpdateModuleMetadataDto } from '../dtos/update-module-metadata.dto';
 import {
@@ -609,7 +610,8 @@ export class ModuleMetadataService {
   }
 
   private getFileName(file: Express.Multer.File): string {
-    return `${file.filename}-${file.originalname}`;
+    // originalname is attacker-controlled and feeds straight into a storage path.
+    return `${file.filename}-${sanitizeStoredMediaFileName(file.originalname)}`;
   }
 
 }

package/src/services/setting.service.ts

@@ -16,6 +16,7 @@ import { ModuleMetadataRepository } from 'src/repository/module-metadata.reposit
 import type { SolidCoreSetting } from './settings/default-settings-provider.service';
 import { Logger } from '@nestjs/common';
 import { EncryptionService } from './encryption.service';
+import { sanitizeStoredMediaFileName } from './media-storage.utils';
 
 
 @Injectable()
@@ -358,7 +359,8 @@ export class SettingService {
     if (uploadedFiles?.length) {
       for (const file of uploadedFiles) {
         const settingKey = file.fieldname;
-        const relativeFileName = `${file.filename}-${file.originalname}`;
+        // originalname is attacker-controlled and feeds straight into a storage path.
+        const relativeFileName = `${file.filename}-${sanitizeStoredMediaFileName(file.originalname)}`;
 
         // Read file from local disk (where Multer stores uploads) and write to storage
         // The path builder constructs the provider-appropriate storage path

package/src/solid-core.module.ts

@@ -1,6 +1,5 @@
 import "multer";
-import { Global, MiddlewareConsumer, Module, NestModule } from "@nestjs/common";
-import * as express from "express";
+import { Global, Module } from "@nestjs/common";
 import { ConfigModule, ConfigService } from "@nestjs/config";
 import {
   APP_FILTER,
@@ -1050,13 +1049,7 @@ import { SwitchNode } from './services/workflow/nodes/switch.node';
     WorkflowExpressionService,
   ],
 })
-export class SolidCoreModule implements NestModule {
-  configure(consumer: MiddlewareConsumer) {
-    consumer
-      .apply(
-        express.json({ limit: "10mb" }),
-        express.urlencoded({ limit: "10mb", extended: true }),
-      )
-      .forRoutes("*");
-  }
-}
+// Body-size limits live in bootstrapSolidApp (see SolidBootstrapOptions.bodyLimit).
+// They cannot be applied here: module middleware is registered in registerRouter(),
+// which runs after Nest's own parser middleware, so anything set here never takes effect.
+export class SolidCoreModule {}