godprotocol 2.3.30 → 2.3.32

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "godprotocol",
-  "version": "2.3.30",
+  "version": "2.3.32",
   "description": "A distributed computing environment for Web 4.0 — integrating AI, decentralisation, and virtual computation.",
   "main": "Index.js",
   "type": "module",

package/server/parse_multipart_data.js

@@ -1,36 +1,134 @@
 import Busboy from "busboy";
 import fs from "fs";
 import path from "path";
+import crypto from "crypto";
+
+const allowedExtensions = new Set([
+  ".jpg",
+  ".jpeg",
+  ".png",
+  ".gif",
+  ".webp",
+  ".pdf",
+  ".doc",
+  ".docx",
+  ".xls",
+  ".xlsx",
+  ".csv",
+  ".txt",
+  ".zip",
+]);
+
+const allowedMimeTypes = new Set([
+  "image/jpeg",
+  "image/png",
+  "image/gif",
+  "image/webp",
+  "application/pdf",
+  "application/msword",
+  "application/vnd.openxmlformats-officedocument.wordprocessingml.document",
+  "application/vnd.ms-excel",
+  "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet",
+  "text/plain",
+  "text/csv",
+  "application/zip",
+  "application/x-zip-compressed",
+]);
 
 const parseMultipart = (req, gp) => {
   return new Promise((resolve, reject) => {
-    const busboy = Busboy({ headers: req.headers });
+    const busboy = Busboy({
+      headers: req.headers,
+    });
 
     const fields = {};
-    let filePath = null;
+    const files = {};
+    const writes = [];
+
+    const uploadDir = `.${gp.static_path}/uploads`;
 
-    const uploadDir = `./${gp.static_path.slice(1)}/uploads`;
     if (!fs.existsSync(uploadDir)) {
       fs.mkdirSync(uploadDir, { recursive: true });
     }
 
-    busboy.on("file", (name, file, info) => {
-      const filename = `${Date.now()}-${info.filename}`;
-      filePath = path.join(uploadDir, filename);
-
-      const stream = fs.createWriteStream(filePath);
-      file.pipe(stream);
-    });
-
     busboy.on("field", (name, value) => {
       fields[name] = value;
     });
 
-    busboy.on("finish", () => {
-      resolve({
-        ...fields,
-        file_path: filePath,
+    busboy.on("file", (fieldName, file, info) => {
+      // -----------------------------
+      // Sanitise client filename
+      // -----------------------------
+      const originalName = path.basename(info.filename || "");
+
+      const extension = path.extname(originalName).toLowerCase();
+
+      if (
+        !allowedExtensions.has(extension) ||
+        !allowedMimeTypes.has(info.mimeType)
+      ) {
+        file.resume();
+
+        return reject(
+          new Error(`Unsupported file type (${extension}, ${info.mimeType})`),
+        );
+      }
+
+      // -----------------------------
+      // Generate safe filename
+      // -----------------------------
+      const filename = `${Date.now()}-${crypto.randomUUID()}${extension}`;
+
+      const filepath = path.join(uploadDir, filename);
+
+      const stream = fs.createWriteStream(filepath);
+
+      let size = 0;
+
+      file.on("data", (chunk) => {
+        size += chunk.length;
       });
+
+      const write = new Promise((resolveWrite, rejectWrite) => {
+        stream.on("finish", resolveWrite);
+
+        stream.on("error", rejectWrite);
+
+        file.on("error", rejectWrite);
+
+        file.pipe(stream);
+      });
+
+      writes.push(write);
+
+      if (!files[fieldName]) {
+        files[fieldName] = [];
+      }
+
+      files[fieldName].push({
+        field: fieldName,
+        original_name: originalName,
+        filename,
+        mime_type: info.mimeType,
+        encoding: info.encoding,
+        extension,
+        size,
+        path: filepath,
+        url: `${gp.server?.domain?.slice(0, -1)}/${gp.static_path?.slice(0, -1)}/uploads/${filename}`,
+      });
+    });
+
+    busboy.on("finish", async () => {
+      try {
+        await Promise.all(writes);
+
+        resolve({
+          ...fields,
+          files,
+        });
+      } catch (err) {
+        reject(err);
+      }
     });
 
     busboy.on("error", reject);

package/server/serve_static_file.js

@@ -1,20 +1,66 @@
 import path from "path";
 import fs from "fs";
 
+const MIME_TYPES = {
+  ".pdf": "application/pdf",
+  ".docx":
+    "application/vnd.openxmlformats-officedocument.wordprocessingml.document",
+  ".json": "application/json",
+  ".txt": "text/plain",
+  ".png": "image/png",
+  ".jpg": "image/jpeg",
+  ".jpeg": "image/jpeg",
+  ".gif": "image/gif",
+  ".svg": "image/svg+xml",
+  ".webp": "image/webp",
+  ".css": "text/css",
+  ".js": "application/javascript",
+  ".html": "text/html",
+};
+
 const serveStaticFile = (req, res) => {
   try {
     const parsedUrl = new URL(req.url, `http://${req.headers.host}`);
 
-    let filePath = decodeURIComponent(parsedUrl.pathname);
+    // Root static directory
+    const staticRoot = path.resolve(process.cwd(), `.${res.gp.static_path}`);
+
+    // Remove "/static" (or whatever your static path is)
+    let relativePath = parsedUrl.pathname.replace(res.gp.static_path, "");
+
+    // Decode URI
+    relativePath = decodeURIComponent(relativePath);
+
+    // Remove leading slashes
+    relativePath = relativePath.replace(/^[/\\]+/, "");
 
-    // prevent path traversal attacks
-    filePath = filePath.replace(/\.\./g, "");
+    // Normalize path
+    relativePath = path.normalize(relativePath);
 
-    const fullPath = path.join(process.cwd(), filePath);
-    console.log(fullPath);
+    // Resolve final file
+    const fullPath = path.resolve(staticRoot, relativePath);
+
+    // Prevent path traversal
+    if (
+      !fullPath.startsWith(staticRoot + path.sep) &&
+      fullPath !== staticRoot
+    ) {
+      res.statusCode = 403;
+      res.setHeader("Content-Type", "application/json");
+
+      return res.end(
+        JSON.stringify({
+          ok: false,
+          message: "Access denied",
+        }),
+      );
+    }
+
+    // Must exist
     if (!fs.existsSync(fullPath)) {
       res.statusCode = 404;
       res.setHeader("Content-Type", "application/json");
+
       return res.end(
         JSON.stringify({
           ok: false,
@@ -23,30 +69,52 @@ const serveStaticFile = (req, res) => {
       );
     }
 
-    const stream = fs.createReadStream(fullPath);
+    // Must be a file
+    const stat = fs.statSync(fullPath);
 
-    // basic content type handling
-    const ext = path.extname(fullPath);
+    if (!stat.isFile()) {
+      res.statusCode = 404;
+      res.setHeader("Content-Type", "application/json");
+
+      return res.end(
+        JSON.stringify({
+          ok: false,
+          message: "File not found",
+        }),
+      );
+    }
 
-    const mimeTypes = {
-      ".pdf": "application/pdf",
-      ".docx":
-        "application/vnd.openxmlformats-officedocument.wordprocessingml.document",
-      ".json": "application/json",
-      ".txt": "text/plain",
-    };
+    const ext = path.extname(fullPath).toLowerCase();
 
     res.statusCode = 200;
-    res.setHeader("Content-Type", mimeTypes[ext] || "application/octet-stream");
+    res.setHeader(
+      "Content-Type",
+      MIME_TYPES[ext] || "application/octet-stream",
+    );
+    res.setHeader("Content-Length", stat.size);
+
+    const stream = fs.createReadStream(fullPath);
+
+    stream.on("error", () => {
+      if (!res.headersSent) {
+        res.statusCode = 500;
+        res.end();
+      }
+    });
 
     stream.pipe(res);
 
-    res.gp.compute_response(res);
+    res.on("finish", () => {
+      res.gp?.resource?.compute_response(res);
+    });
+
     return true;
   } catch (err) {
     console.error("Static file error:", err);
 
     res.statusCode = 500;
+    res.setHeader("Content-Type", "application/json");
+
     res.end(
       JSON.stringify({
         ok: false,

package/server/version_control.js

@@ -117,14 +117,16 @@ const version_middleware = async (req, res, routers) => {
     res.request_id = req.request_id;
 
     // STATIC ROUTE DETECTION
-    if (routers.static_path && pathname.startsWith(routers.static_path)) {
-      return serveStaticFile(req, res);
-    }
-
     let version;
 
     const versionMatch = pathname.match(/^\/api\/(v\d+)(\/|$)/i);
     if (req.method === "GET") {
+      if (routers.static_path && pathname.startsWith(routers.static_path)) {
+        res.gp = routers.gp;
+
+        return serveStaticFile(req, res);
+      }
+
       version = "__GET__";
     } else if (versionMatch) {
       version = versionMatch[1];