@xuda.io/drive_module 1.1.1502 → 1.1.1504

package/index.mjs

@@ -1746,6 +1746,22 @@ export const extract_drive_file = async (req, job_id, headers) => {
         const ext = path.extname(fileName).toLowerCase();
 
         if (fileName.startsWith('__MACOSX/')) {
+          entry.autodrain();
+          return;
+        }
+
+        // A zip entry name is fully attacker controlled, and this validator used to be
+        // called further down only to decide is_archive, never to reject. That let an entry named
+        // "x.png$(cmd)" through as the doc's file_ext, and file_ext is what ocr_file_to_tmp
+        // appends to the path handed to tesseract, which builds a shell command string.
+        // Directories carry no extension, so only file entries are validated. A rejected
+        // entry has to be drained rather than left unread, or unzipper stalls on the rest
+        // of the archive.
+        const validation_ret = type === 'Directory' ? { valid: false } : file_upload_validator(fileName);
+
+        if (type !== 'Directory' && !validation_ret.valid) {
+          console.warn(`[drive_module] skipped zip entry with unsupported extension: ${path.basename(fileName)}`);
+          entry.autodrain();
           return;
         }
 
@@ -1771,8 +1787,6 @@ export const extract_drive_file = async (req, job_id, headers) => {
           entry.pipe(fs.createWriteStream(extract_path));
         }
 
-        const validation_ret = file_upload_validator(fileName);
-
         let file_doc = {
           _id: file_doc_id,
 
@@ -2490,9 +2504,21 @@ const detectLanguageByCountry = (cfCountry) => {
 // HTTP entirely. Only a drive with no bucket entry (a datacenter workspace drive, whose
 // files are scp'd to the hosting box) still needs the round trip, and that one now uses a
 // URL built the same way the drive listing builds it.
+// The readers below hand this path to a shell: node-tesseract-ocr joins a command string
+// and calls child_process.exec, and its double quotes around the path still let $(...) and
+// backticks expand. The upload validator already rejects a filename whose extension is not
+// on the allowlist, but this is the sink, so it does not get to assume that. Anything that
+// is not a plain short alphanumeric extension is dropped instead of passed through; the
+// readers key off the doc's mime, not this suffix, so losing it costs nothing.
+const SAFE_OCR_EXT = /^\.[a-z0-9]{1,12}$/;
+const safe_ocr_ext = (doc) => {
+  const candidate = String(doc.file_ext || path.extname(doc.originalname || '') || '').toLowerCase();
+  return SAFE_OCR_EXT.test(candidate) ? candidate : '';
+};
+
 const ocr_file_to_tmp = async (app_id, doc) => {
   const write_tmp = async (buffer) => {
-    const tmp_path = path.join(os.tmpdir(), `xuda_ocr_${await _common.xuda_get_uuid('tmp')}${doc.file_ext || path.extname(doc.originalname || '') || ''}`);
+    const tmp_path = path.join(os.tmpdir(), `xuda_ocr_${await _common.xuda_get_uuid('tmp')}${safe_ocr_ext(doc)}`);
     await fs.promises.writeFile(tmp_path, buffer);
     return tmp_path;
   };
@@ -5159,3 +5185,58 @@ export const drive_set_plan = async function (req) {
     return { code: -1, data: err.message || String(err) };
   }
 };
+
+// ---------------------------------------------------------------------------
+// PLATFORM ARTIFACTS
+// ---------------------------------------------------------------------------
+// Uploads a platform-owned file (not a customer drive file) and returns a URL
+// that a third party can fetch for a short window. Built for the app bundler:
+// create_app_bundle writes a tree to a local directory, and a macOS build runs
+// on Codemagic's machine, so the archive has to be reachable from outside.
+//
+// Lives here because drive_module owns the R2 client, the bucket map and the
+// credentials. Nothing else should be constructing S3 clients.
+//
+// SIGNED, not public. There is no r2.public_base configured, so an uploaded
+// object has no public URL at all, and giving the bucket one would make every
+// object in it world-readable to solve a problem that is really "let one machine
+// read one file for ten minutes". A presigned URL keeps the bucket private and
+// expires on its own.
+export const upload_platform_artifact = async function ({ file_path, key, expires_in = 900, content_type = 'application/gzip' }) {
+  if (!file_path || !fs.existsSync(file_path)) {
+    return { code: -2, data: `artifact not found: ${file_path}` };
+  }
+  if (!key) return { code: -2, data: 'key is mandatory' };
+
+  const region_host = process.env.XUDA_HOSTNAME;
+  const conf = _conf.storage_bucket?.[region_host];
+  const s3 = _drive_s3_for(region_host);
+  if (!s3 || !conf) return { code: -2, data: `no storage config for ${region_host}` };
+
+  // Imported lazily and on purpose: @aws-sdk/s3-request-presigner is a separate
+  // package from client-s3, so a box that has not installed it would otherwise
+  // fail to LOAD drive_module rather than fail this one call.
+  let getSignedUrl;
+  try {
+    ({ getSignedUrl } = await import('@aws-sdk/s3-request-presigner'));
+  } catch (err) {
+    return { code: -2, data: 'missing dependency @aws-sdk/s3-request-presigner, run npm install in cpi/' };
+  }
+
+  const Bucket = conf.name;
+  const Key = `platform_artifacts/${String(key).replace(/^\/+/, '')}`;
+
+  try {
+    const upload = new Upload({
+      client: s3,
+      params: { Bucket, Key, Body: fs.createReadStream(file_path), ContentType: content_type },
+    });
+    await upload.done();
+
+    const url = await getSignedUrl(s3, new GetObjectCommand({ Bucket, Key }), { expiresIn: expires_in });
+
+    return { code: 1, data: { url, key: Key, bucket: Bucket, expires_in, bytes: fs.statSync(file_path).size } };
+  } catch (err) {
+    return { code: -1, data: `artifact upload failed: ${err.message}` };
+  }
+};

package/index_ms.mjs

@@ -441,6 +441,10 @@ export const drive_set_plan = async function (...args) {
   return await broker.send_to_queue("drive_set_plan", ...args);
 };
 
+export const upload_platform_artifact = async function (...args) {
+  return await broker.send_to_queue("upload_platform_artifact", ...args);
+};
+
 export const get_drive_files_studio = async function (...args) {
   return await broker.send_to_queue("get_drive_files_studio", ...args);
 };

package/index_msa.mjs

@@ -441,6 +441,10 @@ export const drive_set_plan =  function (...args) {
    broker.send_to_queue_async("drive_set_plan", ...args);
 };
 
+export const upload_platform_artifact =  function (...args) {
+   broker.send_to_queue_async("upload_platform_artifact", ...args);
+};
+
 export const get_drive_files_studio =  function (...args) {
    broker.send_to_queue_async("get_drive_files_studio", ...args);
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@xuda.io/drive_module",
-  "version": "1.1.1502",
+  "version": "1.1.1504",
   "description": "Xuda Drive Server Module",
   "main": "index.mjs",
   "dependencies": {