@xuda.io/drive_module 1.1.1501 → 1.1.1503

package/index.mjs

@@ -1746,6 +1746,22 @@ export const extract_drive_file = async (req, job_id, headers) => {
         const ext = path.extname(fileName).toLowerCase();
 
         if (fileName.startsWith('__MACOSX/')) {
+          entry.autodrain();
+          return;
+        }
+
+        // A zip entry name is fully attacker controlled, and this validator used to be
+        // called further down only to decide is_archive, never to reject. That let an entry named
+        // "x.png$(cmd)" through as the doc's file_ext, and file_ext is what ocr_file_to_tmp
+        // appends to the path handed to tesseract, which builds a shell command string.
+        // Directories carry no extension, so only file entries are validated. A rejected
+        // entry has to be drained rather than left unread, or unzipper stalls on the rest
+        // of the archive.
+        const validation_ret = type === 'Directory' ? { valid: false } : file_upload_validator(fileName);
+
+        if (type !== 'Directory' && !validation_ret.valid) {
+          console.warn(`[drive_module] skipped zip entry with unsupported extension: ${path.basename(fileName)}`);
+          entry.autodrain();
           return;
         }
 
@@ -1771,8 +1787,6 @@ export const extract_drive_file = async (req, job_id, headers) => {
           entry.pipe(fs.createWriteStream(extract_path));
         }
 
-        const validation_ret = file_upload_validator(fileName);
-
         let file_doc = {
           _id: file_doc_id,
 
@@ -1923,6 +1937,69 @@ export const upload_drive_file = async (req, job_id, headers = {}, file_obj) =>
     };
     const check_existing_file_ret = await check_drive_file(check_req);
 
+    // OVERWRITE IN PLACE. Callers that mean "update this file" (the office plugins editing a
+    // deck / document the user named) opt in with req.overwrite. Without it the block below
+    // dedupes the name, so "update /Presentations/deck.pptx" quietly produced
+    // "deck (1).pptx" and the file the user was looking at never changed.
+    //
+    // The existing doc is REUSED rather than replaced: _id, server_file_name and the bucket
+    // key all stay, so every link already handed out (a chat file card, a shared URL, an
+    // agent's saved reference) still resolves to the edited bytes. Only the mutable facts
+    // move. preview_stat goes back to 1 so the rendered preview is regenerated from the new
+    // content instead of showing the old slides for ever.
+    //
+    // Bucket-backed drives only. The datacenter / is_deployment branches ship bytes over scp
+    // to a path derived from the same name, so an overwrite there would need its own handling;
+    // until it does, those fall through to the dedupe rather than half-writing.
+    if (check_existing_file_ret.code < 0 && req.overwrite) {
+      try {
+        const existing = await get_drive_doc('file', drive_type, app_id, uid, path.join(doc.file_path, originalname), headers);
+        const existing_key = existing?.server_file_name;
+        const app_obj_ret = drive_type === 'workspace' ? await db_module.get_app_obj(app_id) : null;
+        const scp_backed = !!(app_obj_ret?.data?.app_type === 'datacenter' || app_obj_ret?.data?.is_deployment);
+
+        if (existing_key && drive_type !== 'studio' && !scp_backed) {
+          const ref_ow = drive_type === 'user' ? await get_account_default_project_id(uid) : await _common.get_project_app_id(req.app_id, true);
+          existing.bucket = {
+            [`${process.env.XUDA_HOSTNAME}`]: await upload_file_to_spaces(tempPath, ref_ow, drive_type, existing_key),
+          };
+          existing.size = doc.size;
+          existing.mime = doc.mime;
+          existing.file_ext = doc.file_ext;
+          existing.ts = Date.now();
+          // Back to 1 (queued) so the office->pdf render re-runs against the new bytes;
+          // without it the viewer would keep showing the slides from before the edit.
+          // preview_link is not stored, it is derived per read by preview_links_for.
+          existing.preview_stat = doc.preview_stat;
+
+          const save_ow =
+            drive_type === 'user' ? await save_user_drive_file(uid, existing) : await db_module.save_app_couch_doc(await _common.get_project_app_id(req.app_id), existing);
+          if (save_ow.code < 0) throw new Error(save_ow.data);
+
+          await fs_module.unlink(tempPath).catch(() => {});
+          if (existing.preview_stat === 1) {
+            generate_drive_file_preview({ app_id: req.app_id, drive_type, uid, doc_id: existing._id }).catch(() => {});
+          }
+
+          return {
+            code: 760,
+            data: {
+              server_file_name: existing_key,
+              filename: existing.originalname,
+              file_url: get_file_url(drive_type, existing_key, ref_ow),
+              file_path: existing.file_path,
+              bucket: existing.bucket,
+            },
+            overwritten: true,
+          };
+        }
+      } catch (err) {
+        // An overwrite that cannot be completed must not lose the upload: fall through to the
+        // dedupe path below so the bytes still land somewhere the user can reach.
+        console.error('[upload_drive_file] overwrite failed, falling back to a new name:', err?.message || err);
+      }
+    }
+
     if (check_existing_file_ret.code < 0) {
       const rename_file_name = async (i) => {
         if (i > 1000) {
@@ -2427,9 +2504,21 @@ const detectLanguageByCountry = (cfCountry) => {
 // HTTP entirely. Only a drive with no bucket entry (a datacenter workspace drive, whose
 // files are scp'd to the hosting box) still needs the round trip, and that one now uses a
 // URL built the same way the drive listing builds it.
+// The readers below hand this path to a shell: node-tesseract-ocr joins a command string
+// and calls child_process.exec, and its double quotes around the path still let $(...) and
+// backticks expand. The upload validator already rejects a filename whose extension is not
+// on the allowlist, but this is the sink, so it does not get to assume that. Anything that
+// is not a plain short alphanumeric extension is dropped instead of passed through; the
+// readers key off the doc's mime, not this suffix, so losing it costs nothing.
+const SAFE_OCR_EXT = /^\.[a-z0-9]{1,12}$/;
+const safe_ocr_ext = (doc) => {
+  const candidate = String(doc.file_ext || path.extname(doc.originalname || '') || '').toLowerCase();
+  return SAFE_OCR_EXT.test(candidate) ? candidate : '';
+};
+
 const ocr_file_to_tmp = async (app_id, doc) => {
   const write_tmp = async (buffer) => {
-    const tmp_path = path.join(os.tmpdir(), `xuda_ocr_${await _common.xuda_get_uuid('tmp')}${doc.file_ext || path.extname(doc.originalname || '') || ''}`);
+    const tmp_path = path.join(os.tmpdir(), `xuda_ocr_${await _common.xuda_get_uuid('tmp')}${safe_ocr_ext(doc)}`);
     await fs.promises.writeFile(tmp_path, buffer);
     return tmp_path;
   };
@@ -5056,7 +5145,10 @@ export const drive_set_plan = async function (req) {
     const account = await _drive_account_doc(uid);
     if (!account._id) return { code: -404, data: 'account not found' };
     const current = _drive_account_plan(account);
-    if (current === plan_id) return await get_drive_plans({ uid });
+    // UI-192: a switch-off asks for the FREE tier, so an account already sitting on free
+    // matches here and would come back unchanged with the switch still on. Asking to
+    // deactivate is never "no change": clearing the chosen stamp is the change.
+    if (current === plan_id && req?.deactivate !== true) return await get_drive_plans({ uid });
 
     // Downgrade guard. Taking space away from an account that is already using it
     // would drop it straight into metered overage on files it cannot see a way to
@@ -5072,7 +5164,7 @@ export const drive_set_plan = async function (req) {
 
     const paid = Number(plan.price) > 0;
     if (paid) {
-      const ret = await stripe_ms.add_subscription_item({ uid, plan_id });
+      const ret = await stripe_ms.add_subscription_item({ uid, plan_id, deactivate: req?.deactivate === true });
       if (!ret || ret.code < 0) return { code: ret?.code === -402 || ret?.code === -3 ? -402 : -1, data: ret?.data || 'could not change the plan' };
     } else if (account.stripe_subscription_items?.[DRIVE_CATEGORY]) {
       const ret = await stripe_ms.remove_subscription_item({ uid, category: DRIVE_CATEGORY });
@@ -5082,7 +5174,10 @@ export const drive_set_plan = async function (req) {
     // Re-read: the stripe call just wrote stripe_subscription_items on this doc.
     const fresh = await _drive_account_doc(uid);
     fresh.drive_plan = plan_id;
-    fresh.drive_plan_changed = Date.now();
+    // UI-192: see the note in shipping_set_plan. A chosen free tier now reads as switched
+    // on, so switching off has to clear the stamp that recorded the choice.
+    if (req?.deactivate === true) delete fresh.drive_plan_changed;
+    else fresh.drive_plan_changed = Date.now();
     await db_module.save_couch_doc('xuda_accounts', fresh);
 
     return await get_drive_plans({ uid });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@xuda.io/drive_module",
-  "version": "1.1.1501",
+  "version": "1.1.1503",
   "description": "Xuda Drive Server Module",
   "main": "index.mjs",
   "dependencies": {