@xuda.io/drive_module 1.1.1502 → 1.1.1503

package/index.mjs

@@ -1746,6 +1746,22 @@ export const extract_drive_file = async (req, job_id, headers) => {
         const ext = path.extname(fileName).toLowerCase();
 
         if (fileName.startsWith('__MACOSX/')) {
+          entry.autodrain();
+          return;
+        }
+
+        // A zip entry name is fully attacker controlled, and this validator used to be
+        // called further down only to decide is_archive, never to reject. That let an entry named
+        // "x.png$(cmd)" through as the doc's file_ext, and file_ext is what ocr_file_to_tmp
+        // appends to the path handed to tesseract, which builds a shell command string.
+        // Directories carry no extension, so only file entries are validated. A rejected
+        // entry has to be drained rather than left unread, or unzipper stalls on the rest
+        // of the archive.
+        const validation_ret = type === 'Directory' ? { valid: false } : file_upload_validator(fileName);
+
+        if (type !== 'Directory' && !validation_ret.valid) {
+          console.warn(`[drive_module] skipped zip entry with unsupported extension: ${path.basename(fileName)}`);
+          entry.autodrain();
           return;
         }
 
@@ -1771,8 +1787,6 @@ export const extract_drive_file = async (req, job_id, headers) => {
           entry.pipe(fs.createWriteStream(extract_path));
         }
 
-        const validation_ret = file_upload_validator(fileName);
-
         let file_doc = {
           _id: file_doc_id,
 
@@ -2490,9 +2504,21 @@ const detectLanguageByCountry = (cfCountry) => {
 // HTTP entirely. Only a drive with no bucket entry (a datacenter workspace drive, whose
 // files are scp'd to the hosting box) still needs the round trip, and that one now uses a
 // URL built the same way the drive listing builds it.
+// The readers below hand this path to a shell: node-tesseract-ocr joins a command string
+// and calls child_process.exec, and its double quotes around the path still let $(...) and
+// backticks expand. The upload validator already rejects a filename whose extension is not
+// on the allowlist, but this is the sink, so it does not get to assume that. Anything that
+// is not a plain short alphanumeric extension is dropped instead of passed through; the
+// readers key off the doc's mime, not this suffix, so losing it costs nothing.
+const SAFE_OCR_EXT = /^\.[a-z0-9]{1,12}$/;
+const safe_ocr_ext = (doc) => {
+  const candidate = String(doc.file_ext || path.extname(doc.originalname || '') || '').toLowerCase();
+  return SAFE_OCR_EXT.test(candidate) ? candidate : '';
+};
+
 const ocr_file_to_tmp = async (app_id, doc) => {
   const write_tmp = async (buffer) => {
-    const tmp_path = path.join(os.tmpdir(), `xuda_ocr_${await _common.xuda_get_uuid('tmp')}${doc.file_ext || path.extname(doc.originalname || '') || ''}`);
+    const tmp_path = path.join(os.tmpdir(), `xuda_ocr_${await _common.xuda_get_uuid('tmp')}${safe_ocr_ext(doc)}`);
     await fs.promises.writeFile(tmp_path, buffer);
     return tmp_path;
   };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@xuda.io/drive_module",
-  "version": "1.1.1502",
+  "version": "1.1.1503",
   "description": "Xuda Drive Server Module",
   "main": "index.mjs",
   "dependencies": {