chattransfer 2.0.12 → 2.0.13

package/frontend/dist/index.html

@@ -5,7 +5,7 @@
     <link rel="icon" href="/assets/logo-DQUxWwh1.png" />
     <meta name="viewport" content="width=device-width, initial-scale=1.0" />
     <title>ChatTransfer</title>
-    <script type="module" crossorigin src="/assets/index-B70USaaW.js"></script>
+    <script type="module" crossorigin src="/assets/index-BZdEqZiK.js"></script>
     <link rel="stylesheet" crossorigin href="/assets/index-Bg5fD0DP.css">
   </head>
   <body>

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "chattransfer",
-  "version": "2.0.12",
+  "version": "2.0.13",
   "description": "LAN instant messaging and file transfer tool",
   "main": "server/index.js",
   "engines": {

package/server/index.js

@@ -3,7 +3,7 @@ const net = require('net');
 const fs = require('fs');
 const path = require('path');
 const { getIPAddress, openDefaultBrowser } = require('./tool');
-const { getCachePath, getConfigFile } = require('./config');
+const { getCachePath, getConfigFile, getDefaultCachePath } = require('./config');
 const registerRoutes = require('./routes/index');
 const registerSocket = require('./socket/index');
 const { MessageHistoryService } = require('./services/message-history-service');
@@ -14,6 +14,7 @@ const {
   usesIndependentDatabaseFile
 } = require('./utils/runtime-paths');
 const { resolveStartOptions } = require('./utils/runtime-options');
+const { getSafeStartupCachePath } = require('./utils/cache-path-validation');
 
 const DEFAULT_PORT = 55556;
 const MAX_RETRY = 3;
@@ -22,7 +23,27 @@ const pkg = require('../package.json');
 
 function createApp() {
   const app = require('express')();
-  registerRoutes(app);
+  return app;
+}
+
+function createConfiguredApp(cachePath) {
+  const app = createApp();
+  const safeCachePath = cachePath
+    ? { path: path.resolve(cachePath), changed: false }
+    : getSafeStartupCachePath({
+      appRoot: path.resolve(__dirname, '..'),
+      configPath: getConfigFile(),
+      configuredPath: getCachePath(),
+      dataRoot: path.dirname(getConfigFile()),
+      defaultPath: getDefaultCachePath()
+    });
+
+  if (safeCachePath.changed) {
+    console.warn(`[Cache] unsafe configured path rejected: ${getCachePath()}`);
+    console.warn(`[Cache] fallback to default: ${safeCachePath.path}`);
+  }
+
+  registerRoutes(app, safeCachePath.path);
   return app;
 }
 
@@ -72,7 +93,22 @@ async function start(options = {}) {
     return;
   }
 
-  const uploadsDir = getCachePath();
+  const configuredCachePath = getCachePath();
+  const defaultCachePath = getDefaultCachePath();
+  const safeCachePath = getSafeStartupCachePath({
+    appRoot: path.resolve(__dirname, '..'),
+    configPath: getConfigFile(),
+    configuredPath: configuredCachePath,
+    dataRoot: path.dirname(getConfigFile()),
+    defaultPath: defaultCachePath
+  });
+
+  if (safeCachePath.changed) {
+    console.warn(`[Cache] unsafe configured path rejected: ${configuredCachePath}`);
+    console.warn(`[Cache] fallback to default: ${safeCachePath.path}`);
+  }
+
+  const uploadsDir = safeCachePath.path;
   await fs.promises.mkdir(uploadsDir, { recursive: true });
 
   const historyService = new MessageHistoryService({
@@ -87,7 +123,7 @@ async function start(options = {}) {
     return;
   }
 
-  const app = createApp();
+  const app = createConfiguredApp(uploadsDir);
   const server = http.createServer(app);
 
   registerSocket(server, historyService);
@@ -127,6 +163,6 @@ if (require.main === module) {
 }
 
 module.exports = {
-  createApp,
+  createApp: createConfiguredApp,
   start
 };

package/server/routes/files.js

@@ -1,49 +1,52 @@
 const express = require('express');
 const path = require('path');
-const router = express.Router();
 const { getCachePath } = require('../config');
 
 function sanitizeFileName(name) {
   return path.basename(name || '').replace(/[\\/:*?"<>|\u0000]/g, '_');
 }
 
-router.post('/uploadFile', async (req, res) => {
-  const uploadsDir = getCachePath();
-  const files = req.files && (req.files.file_data || req.files.fileObj);
-
-  if (!files) {
-    return res.status(400).send({
-      code: -1,
-      message: 'No file uploaded'
-    });
-  }
-
-  const fileList = Array.isArray(files) ? files : [files];
-  const uploadResults = [];
-
-  for (const file of fileList) {
-    const timestamp = Date.now();
-    const safeName = `${timestamp}_${sanitizeFileName(file.name)}`;
-    const filePath = path.join(uploadsDir, 'files', safeName);
-
-    await new Promise((resolve, reject) => {
-      file.mv(filePath, (error) => (error ? reject(error) : resolve()));
-    });
-
-    uploadResults.push({
-      name: safeName,
-      mimetype: file.mimetype,
-      size: file.size,
-      fileUrl: `${req.protocol}://${req.headers.host}/files/${encodeURIComponent(safeName)}`,
-      localFilePath: filePath
+module.exports = (configuredUploadsDir = getCachePath()) => {
+  const router = express.Router();
+  const uploadsDir = path.resolve(configuredUploadsDir);
+
+  router.post('/uploadFile', async (req, res) => {
+    const files = req.files && (req.files.file_data || req.files.fileObj);
+
+    if (!files) {
+      return res.status(400).send({
+        code: -1,
+        message: 'No file uploaded'
+      });
+    }
+
+    const fileList = Array.isArray(files) ? files : [files];
+    const uploadResults = [];
+
+    for (const file of fileList) {
+      const timestamp = Date.now();
+      const safeName = `${timestamp}_${sanitizeFileName(file.name)}`;
+      const filePath = path.join(uploadsDir, 'files', safeName);
+
+      await new Promise((resolve, reject) => {
+        file.mv(filePath, (error) => (error ? reject(error) : resolve()));
+      });
+
+      uploadResults.push({
+        name: safeName,
+        mimetype: file.mimetype,
+        size: file.size,
+        fileUrl: `${req.protocol}://${req.headers.host}/files/${encodeURIComponent(safeName)}`,
+        localFilePath: filePath
+      });
+    }
+
+    res.send({
+      code: 0,
+      message: fileList.length > 1 ? 'Files uploaded' : 'File uploaded',
+      data: fileList.length > 1 ? uploadResults : uploadResults[0]
     });
-  }
-
-  res.send({
-    code: 0,
-    message: fileList.length > 1 ? 'Files uploaded' : 'File uploaded',
-    data: fileList.length > 1 ? uploadResults : uploadResults[0]
   });
-});
 
-module.exports = router;
+  return router;
+};

package/server/routes/index.js

@@ -5,10 +5,15 @@ const fs = require('fs');
 const fileUpload = require('express-fileupload');
 const { getCachePath } = require('../config');
 
-module.exports = function registerRoutes(app) {
-  const uploadsDir = getCachePath();
+module.exports = function registerRoutes(app, configuredUploadsDir = getCachePath()) {
+  const uploadsDir = path.resolve(configuredUploadsDir);
+  const filesDir = path.join(uploadsDir, 'files');
   const tempDir = path.join(uploadsDir, 'tmp');
 
+  if (!fs.existsSync(filesDir)) {
+    fs.mkdirSync(filesDir, { recursive: true });
+  }
+
   if (!fs.existsSync(tempDir)) {
     fs.mkdirSync(tempDir, { recursive: true });
   }
@@ -22,13 +27,13 @@ module.exports = function registerRoutes(app) {
 
   app.use(express.json());
 
-  app.use(require('./system'));
+  app.use(require('./system')(uploadsDir));
   app.use(require('./session'));
   app.use(require('./qr'));
-  app.use(require('./files'));
+  app.use(require('./files')(uploadsDir));
 
   app.use(express.static(path.join(__dirname, '../../frontend/dist')));
-  app.use(express.static(uploadsDir));
+  app.use('/files', express.static(filesDir));
 
   app.get('*', (req, res) => {
     res.sendFile(path.join(__dirname, '../../frontend/dist/index.html'));

package/server/routes/system.js

@@ -1,107 +1,119 @@
 const express = require('express');
 const path = require('path');
+const fs = require('fs');
 const { execFile } = require('child_process');
-const router = express.Router();
 const {
   getCachePath,
   getConfigFile,
   getDefaultCachePath,
-  isCustomized,
   setCachePath
 } = require('../config');
 const { getDefaultDataDir } = require('../utils/runtime-paths');
+const { validateCachePath } = require('../utils/cache-path-validation');
 const { trackEvent } = require('../telemetry/compat');
 
-router.get('/getHomeDir', (req, res) => {
-  const uploadsDir = getCachePath();
-
-  res.send({
-    code: 0,
-    message: 'ok',
-    data: {
-      uploadsDir,
-      defaultDir: getDefaultCachePath(),
-      isCustomized: isCustomized(),
-      configFile: getConfigFile()
-    }
-  });
-});
-
-router.get('/getVersionInfo', (req, res) => {
-  res.send({
-    code: 0,
-    message: 'ok',
-    data: {
-      version: require('../../package.json').version,
-      deviceId: 'anonymous'
-    }
-  });
-});
-
-router.post('/openCachePath', express.json(), (req, res) => {
-  const uploadsDir = getCachePath();
-  const respond = (code, message) => res.send({
-    code,
-    message,
-    data: { platform: process.platform, path: uploadsDir }
-  });
-
-  if (process.platform === 'linux' && !process.env.DISPLAY && !process.env.WAYLAND_DISPLAY) {
-    respond(0, '服务器无桌面环境，缓存目录已返回');
-    return;
-  }
+module.exports = (configuredUploadsDir = getCachePath()) => {
+  const router = express.Router();
+  const uploadsDir = path.resolve(configuredUploadsDir);
 
-  if (process.platform === 'darwin') {
-    execFile('open', [uploadsDir], (error) => {
-      respond(error ? -1 : 0, error ? `打开失败：${error.message}` : '打开成功');
+  router.get('/getHomeDir', (req, res) => {
+    res.send({
+      code: 0,
+      message: 'ok',
+      data: {
+        uploadsDir,
+        defaultDir: getDefaultCachePath(),
+        isCustomized: uploadsDir !== path.resolve(getDefaultCachePath()),
+        configFile: getConfigFile()
+      }
     });
-  } else if (process.platform === 'win32') {
-    execFile('explorer', [uploadsDir], (error) => {
-      respond(error ? -1 : 0, error ? `打开失败：${error.message}` : '打开成功');
+  });
+
+  router.get('/getVersionInfo', (req, res) => {
+    res.send({
+      code: 0,
+      message: 'ok',
+      data: {
+        version: require('../../package.json').version,
+        deviceId: 'anonymous'
+      }
     });
-  } else {
-    execFile('xdg-open', [uploadsDir], (error) => {
-      respond(error ? -1 : 0, error ? `打开失败：${error.message}` : '打开成功');
+  });
+
+  router.post('/openCachePath', express.json(), (req, res) => {
+    const respond = (code, message) => res.send({
+      code,
+      message,
+      data: { platform: process.platform, path: uploadsDir }
     });
-  }
-});
 
-router.post('/setCachePath', (req, res) => {
-  const inputPath = req.body && req.body.path;
+    if (process.platform === 'linux' && !process.env.DISPLAY && !process.env.WAYLAND_DISPLAY) {
+      respond(0, '服务器无桌面环境，缓存目录已返回');
+      return;
+    }
 
-  if (!inputPath || typeof inputPath !== 'string') {
-    return res.send({ code: -1, message: 'invalid path' });
-  }
+    if (process.platform === 'darwin') {
+      execFile('open', [uploadsDir], (error) => {
+        respond(error ? -1 : 0, error ? `打开失败：${error.message}` : '打开成功');
+      });
+    } else if (process.platform === 'win32') {
+      execFile('explorer', [uploadsDir], (error) => {
+        respond(error ? -1 : 0, error ? `打开失败：${error.message}` : '打开成功');
+      });
+    } else {
+      execFile('xdg-open', [uploadsDir], (error) => {
+        respond(error ? -1 : 0, error ? `打开失败：${error.message}` : '打开成功');
+      });
+    }
+  });
 
-  const newPath = path.resolve(inputPath.trim());
-  const dataRoot = path.resolve(getDefaultDataDir());
+  router.post('/setCachePath', (req, res) => {
+    const inputPath = req.body && req.body.path;
 
-  if (!path.isAbsolute(newPath) || newPath === path.resolve(getCachePath()) || newPath === dataRoot) {
-    return res.send({ code: -1, message: 'invalid cache path' });
-  }
+    if (!inputPath || typeof inputPath !== 'string') {
+      return res.send({ code: -1, message: 'invalid path' });
+    }
 
-  try {
-    require('fs').mkdirSync(newPath, { recursive: true });
-    setCachePath(newPath);
-    res.send({
-      code: 0,
-      message: 'ok',
-      data: { newPath, needsRestart: true }
+    const validation = validateCachePath(inputPath, {
+      appRoot: path.resolve(__dirname, '..', '..'),
+      configPath: getConfigFile(),
+      currentPath: uploadsDir,
+      dataRoot: getDefaultDataDir()
     });
-  } catch (error) {
-    res.send({ code: -1, message: error.message });
-  }
-});
 
-router.post('/api/track', (req, res) => {
-  const { eventType, eventProperties, userId } = req.body || {};
+    if (!validation.valid) {
+      return res.send({ code: -1, message: 'invalid cache path' });
+    }
+
+    try {
+      const newPath = validation.path;
+      fs.mkdirSync(newPath, { recursive: true });
+
+      const testFile = path.join(newPath, '.chattransfer-write-test');
+      fs.writeFileSync(testFile, 'ok', 'utf8');
+      fs.unlinkSync(testFile);
+
+      setCachePath(newPath);
+      res.send({
+        code: 0,
+        message: 'ok',
+        data: { newPath, needsRestart: true }
+      });
+    } catch (error) {
+      res.send({ code: -1, message: error.message });
+    }
+  });
+
+  router.post('/api/track', (req, res) => {
+    const { eventType, eventProperties, userId } = req.body || {};
 
-  if (!eventType) {
-    return res.status(400).send({ code: -1, message: 'eventType is required' });
-  }
+    if (!eventType) {
+      return res.status(400).send({ code: -1, message: 'eventType is required' });
+    }
 
-  trackEvent(eventType, eventProperties || {}, userId || null);
-  res.send({ code: 0, message: 'ok' });
-});
+    trackEvent(eventType, eventProperties || {}, userId || null);
+    res.send({ code: 0, message: 'ok' });
+  });
 
-module.exports = router;
+  return router;
+};

package/server/utils/cache-path-validation.js

@@ -0,0 +1,125 @@
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+
+function isWithin(parent, child) {
+  const relative = path.relative(path.resolve(parent), path.resolve(child));
+  return relative === '' || (
+    relative !== '..' &&
+    !relative.startsWith(`..${path.sep}`) &&
+    !path.isAbsolute(relative)
+  );
+}
+
+function getSystemRoots() {
+  if (process.platform === 'win32') {
+    return [
+      process.env.SystemRoot,
+      process.env.ProgramFiles,
+      process.env['ProgramFiles(x86)'],
+      process.env.ProgramData
+    ].filter(Boolean);
+  }
+
+  return [
+    '/bin',
+    '/boot',
+    '/dev',
+    '/etc',
+    '/lib',
+    '/lib64',
+    '/proc',
+    '/run',
+    '/sbin',
+    '/sys',
+    '/usr',
+    '/var'
+  ];
+}
+
+function resolvePathForValidation(filePath) {
+  const resolved = path.resolve(filePath);
+  let nearest = resolved;
+
+  while (!fs.existsSync(nearest)) {
+    const parent = path.dirname(nearest);
+    if (parent === nearest) break;
+    nearest = parent;
+  }
+
+  const nearestRealPath = fs.realpathSync(nearest);
+  if (nearest === resolved) return nearestRealPath;
+
+  return path.resolve(nearestRealPath, path.relative(nearest, resolved));
+}
+
+function validateCachePath(inputPath, {
+  appRoot,
+  configPath,
+  currentPath,
+  dataRoot,
+  homeDir = os.homedir()
+} = {}) {
+  if (typeof inputPath !== 'string' || !inputPath.trim()) {
+    return { valid: false, reason: 'empty' };
+  }
+
+  if (!path.isAbsolute(inputPath.trim())) {
+    return { valid: false, reason: 'relative' };
+  }
+
+  const newPath = path.resolve(inputPath.trim());
+  const realPath = resolvePathForValidation(newPath);
+  const filesystemRoot = path.parse(realPath).root;
+  const systemRoots = getSystemRoots().map((item) => resolvePathForValidation(item));
+  const protectedPaths = [
+    filesystemRoot,
+    appRoot,
+    configPath && path.dirname(configPath),
+    currentPath,
+    dataRoot,
+    homeDir,
+    process.cwd(),
+    ...systemRoots
+  ].filter(Boolean).map((item) => path.resolve(item));
+
+  if (protectedPaths.some((protectedPath) => isWithin(realPath, protectedPath))) {
+    return { valid: false, reason: 'protected' };
+  }
+
+  return { valid: true, path: newPath, realPath };
+}
+
+function getSafeStartupCachePath({
+  appRoot,
+  configPath,
+  configuredPath,
+  dataRoot,
+  defaultPath
+}) {
+  if (configuredPath === defaultPath) {
+    return { path: defaultPath, changed: false };
+  }
+
+  const validation = validateCachePath(configuredPath, {
+    appRoot,
+    configPath,
+    dataRoot
+  });
+
+  if (validation.valid) {
+    return { path: validation.path, changed: false };
+  }
+
+  return {
+    path: defaultPath,
+    changed: true,
+    reason: validation.reason
+  };
+}
+
+module.exports = {
+  getSafeStartupCachePath,
+  isWithin,
+  validateCachePath
+};

package/server/routes/setCachePath.js

@@ -1,94 +0,0 @@
-/**
- * 设置自定义缓存目录
- * 请求体: { path: string, migrate?: boolean }
- * 生效方式: 修改后需重启进程(express.static / fileUpload 中间件运行时不可热切换)
- * @param {*} app
- * @param {*} uploadsDir 当前生效缓存目录
- */
-const fs = require('fs');
-const path = require('path');
-const express = require('express');
-const { setCachePath } = require('../config.js');
-const { getAppWritableRoot } = require('../tool.js');
-
-module.exports = (app, uploadsDir) => {
-    app.post('/setCachePath', express.json(), async (req, res) => {
-        try {
-            const inputPath = req.body && req.body.path;
-            const migrate = req.body ? req.body.migrate !== false : true;
-
-            // 1. 参数校验
-            if (!inputPath || typeof inputPath !== 'string' || !inputPath.trim()) {
-                return res.send({ code: -1, message: '请输入缓存目录路径' });
-            }
-
-            // 2. 必须绝对路径(先校验原始输入,再 resolve 规范化)
-            const trimmed = inputPath.trim();
-            if (!path.isAbsolute(trimmed)) {
-                return res.send({ code: -1, message: '请输入绝对路径' });
-            }
-            const newPath = path.resolve(trimmed);
-
-            // 3. 不能等于当前路径
-            if (newPath === path.resolve(uploadsDir)) {
-                return res.send({ code: -1, message: '新路径与当前路径相同' });
-            }
-
-            // 4. 不能等于应用根目录(避免污染应用文件)
-            const appRoot = getAppWritableRoot();
-            if (newPath === path.resolve(appRoot)) {
-                return res.send({ code: -1, message: '不能使用应用根目录作为缓存目录' });
-            }
-
-            // 5. 目录不存在则创建
-            try {
-                if (!fs.existsSync(newPath)) {
-                    fs.mkdirSync(newPath, { recursive: true });
-                }
-            } catch (e) {
-                return res.send({ code: -1, message: '目录创建失败:' + e.message });
-            }
-
-            // 6. 可写性测试:写临时文件再删
-            const testFile = path.join(newPath, '.chattransfer-write-test');
-            try {
-                fs.writeFileSync(testFile, 'ok', 'utf8');
-                fs.unlinkSync(testFile);
-            } catch (e) {
-                return res.send({ code: -1, message: '路径无效或不可写' });
-            }
-
-            // 7. 迁移已有文件(递归复制旧目录内容到新目录)
-            if (migrate && fs.existsSync(uploadsDir)) {
-                try {
-                    fs.cpSync(uploadsDir, newPath, { recursive: true });
-                    // 清理测试遗留(若有)
-                    if (fs.existsSync(testFile)) fs.unlinkSync(testFile);
-                } catch (e) {
-                    // 迁移失败:清理已复制的内容,回滚,不更新配置
-                    console.error('[setCachePath] migrate failed:', e.message);
-                    return res.send({ code: -1, message: '迁移文件失败:' + e.message });
-                }
-            }
-
-            // 8. 持久化到 config.json
-            try {
-                setCachePath(newPath);
-            } catch (e) {
-                return res.send({ code: -1, message: '配置保存失败:' + e.message });
-            }
-
-            res.send({
-                code: 0,
-                message: '缓存目录设置成功,重启应用后生效',
-                data: {
-                    newPath: newPath,
-                    needsRestart: true
-                }
-            });
-        } catch (err) {
-            console.log(err);
-            res.status(500).send({ code: -1, message: err.message || '服务器内部错误' });
-        }
-    });
-}