hfs 0.53.0 → 0.53.2

package/src/upload.js

@@ -61,9 +61,9 @@ function uploadWriter(base, path, ctx) {
     else
         try {
             // refer to the source of the closest node that actually belongs to the vfs, so that cache is more effective
-            let closestVfsNode = base;
-            while (closestVfsNode && !closestVfsNode.original)
-                closestVfsNode = closestVfsNode.parent;
+            let closestVfsNode = base; // if base=root, there's no parent and no original
+            while ((closestVfsNode === null || closestVfsNode === void 0 ? void 0 : closestVfsNode.parent) && !closestVfsNode.original)
+                closestVfsNode = closestVfsNode.parent; // if it's not original, it surely has a parent
             const statDir = closestVfsNode.source;
             if (!Object.hasOwn(diskSpaceCache, statDir)) {
                 const c = diskSpaceCache[statDir] = (0, util_os_1.getDiskSpaceSync)(statDir);
@@ -88,12 +88,12 @@ function uploadWriter(base, path, ctx) {
     openFiles.add(fullPath);
     try {
         // if upload creates a folder, then add meta to it too
-        if (fs_1.default.mkdirSync(dir, { recursive: true }))
+        if (!dir.endsWith(':\\') && fs_1.default.mkdirSync(dir, { recursive: true }))
             setUploadMeta(dir, ctx);
         // use temporary name while uploading
         const keepName = (0, path_1.basename)(fullPath).slice(-200);
         let tempName = (0, path_1.join)(dir, 'hfs$upload-' + keepName);
-        const resumable = fs_1.default.existsSync(tempName) && !openFiles.has(tempName) && tempName;
+        const resumable = fs_1.default.existsSync(tempName) && !openFiles.has(tempName) && tempName; // resumable is temp-file-1
         if (resumable)
             tempName = (0, path_1.join)(dir, 'hfs$upload2-' + keepName);
         // checks for resume feature
@@ -101,15 +101,19 @@ function uploadWriter(base, path, ctx) {
         const size = resumable && (0, misc_1.try_)(() => fs_1.default.statSync(resumable).size);
         if (size === undefined) // stat failed
             return fail(const_1.HTTP_SERVER_ERROR);
-        if (resume > size)
+        if (lodash_1.default.isNumber(size) && resume > size)
             return fail(const_1.HTTP_RANGE_NOT_SATISFIABLE);
         // warn frontend about resume possibility
+        let resumableLost = false;
         if (!resume && resumable) {
             const timeout = 30;
             (0, frontEndApis_1.notifyClient)(ctx, 'upload.resumable', { [path]: size, expires: Date.now() + timeout * 1000 });
-            delayedDelete(resumable, timeout, () => fs_1.default.rename(tempName, resumable, err => {
-                if (!err)
-                    tempName = resumable;
+            delayedDelete(resumable, timeout, () => // if user resumes, this upload is interrupted, and next upload will cancel this delayedDelete
+             fs_1.default.rename(tempName, resumable, err => {
+                if (err)
+                    return;
+                tempName = resumable;
+                resumableLost = true;
             }));
         }
         // append if resuming
@@ -136,9 +140,10 @@ function uploadWriter(base, path, ctx) {
         const lockMiddleware = (0, misc_1.pendingPromise)(); // outside we need to know when all operations stopped
         writeStream.once('close', async () => {
             try {
+                await new Promise(res => fileStream.close(res)); // this only seem to be necessary on Windows
                 if (ctx.req.aborted) {
-                    if (resumable) // we don't want to be left with 2 temp files
-                        return delayedDelete(tempName, 0);
+                    if (resumable && !resumableLost && !resuming) // we don't want to be left with 2 temp files
+                        return (0, promises_1.rm)(tempName);
                     const sec = exports.deleteUnfinishedUploadsAfter.get();
                     return lodash_1.default.isNumber(sec) && delayedDelete(tempName, sec);
                 }
@@ -153,12 +158,13 @@ function uploadWriter(base, path, ctx) {
                 }
                 try {
                     await (0, promises_1.rename)(tempName, dest);
+                    cancelDeletion(tempName); // not necessary, as deletion's failure is silent, but still
                     ctx.state.uploadDestinationPath = dest;
                     setUploadMeta(dest, ctx);
                     if (ctx.query.comment)
                         void (0, comments_1.setCommentFor)(dest, String(ctx.query.comment));
-                    if (resumable)
-                        delayedDelete(resumable, 0);
+                    if (resumable && !resuming) // this happens if user decided to not resume and the new upload finished before delayedDelete
+                        (0, promises_1.rm)(resumable).catch(console.warn);
                     events_1.default.emit('uploadFinished', obj);
                     if (resEvent)
                         for (const cb of resEvent)

package/src/util-files.js

@@ -154,7 +154,7 @@ function createFileWithPath(path, options) {
 }
 exports.createFileWithPath = createFileWithPath;
 function isValidFileName(name) {
-    return !/[/*?<>|\\]/.test(name) && !dirTraversal(name);
+    return !(const_1.IS_WINDOWS ? /[/:"*?<>|\\]/ : /\//).test(name) && !dirTraversal(name);
 }
 exports.isValidFileName = isValidFileName;
 function exists(path) {

package/src/vfs.js

@@ -103,8 +103,6 @@ async function urlToNode(url, ctx, parent = exports.vfs, getRest) {
 exports.urlToNode = urlToNode;
 async function getNodeByName(name, parent) {
     var _a;
-    if (!(0, misc_1.isValidFileName)(name))
-        return;
     // does the tree node have a child that goes by this name, otherwise attempt disk
     const child = ((_a = parent.children) === null || _a === void 0 ? void 0 : _a.find(isSameFilenameAs(name))) || childFromDisk();
     return child && applyParentToChild(child, parent, name);
@@ -121,6 +119,8 @@ async function getNodeByName(name, parent) {
                 }
             ret.rename = renameUnderPath(parent.rename, name);
         }
+        if (!(0, misc_1.isValidFileName)(onDisk))
+            return;
         ret.source = (0, path_1.join)(parent.source, onDisk);
         ret.original = undefined; // overwrite in applyParentToChild, so we know this is not part of the vfs
         return ret;
@@ -233,7 +233,7 @@ async function* walkNode(parent, { ctx, depth = Infinity, prefixPath = '', requi
             const name = prefixPath + nodeName;
             took === null || took === void 0 ? void 0 : took.add(normalizeFilename(name));
             const item = { ...child, name };
-            if (!canSee(item))
+            if (!await canSee(item))
                 continue;
             if (item.source) // real items must be accessible
                 try {
@@ -279,7 +279,7 @@ async function* walkNode(parent, { ctx, depth = Infinity, prefixPath = '', requi
             };
             if (isFolder) // store it even if we can't see it (masks), as its children can be produced by dirStream
                 parentsCache.set(name, item);
-            if (canSee(item))
+            if (await canSee(item))
                 yield item;
         }
     }
@@ -287,9 +287,9 @@ async function* walkNode(parent, { ctx, depth = Infinity, prefixPath = '', requi
         console.debug('glob', source, e); // ENOTDIR, or lacking permissions
     }
     // item will be changed, so be sure to pass a temp node
-    function canSee(item) {
+    async function canSee(item) {
         // we basename for depth>0 where we already have the rest of the path in the parent's url, and would be duplicated
-        maskApplier(item, (0, path_1.basename)(getNodeName(item)));
+        await maskApplier(item, (0, path_1.basename)(getNodeName(item)));
         inheritFromParent(parent, item);
         if (ctx && !hasPermission(item, 'can_see', ctx))
             return;