hfs 3.2.0-rc7 → 3.2.0

package/src/serveGuiFiles.js

@@ -12,6 +12,7 @@ const plugins_1 = require("./plugins");
 const api_auth_1 = require("./api.auth");
 const apiMiddleware_1 = require("./apiMiddleware");
 const path_1 = require("path");
+const promises_1 = require("fs/promises");
 const misc_1 = require("./misc");
 const adminApis_1 = require("./adminApis");
 const customHtml_1 = require("./customHtml");
@@ -27,6 +28,9 @@ exports.logGui = (0, config_1.defineConfig)(misc_1.CFG.log_gui, false);
 lodash_1.default.each(misc_1.FRONTEND_OPTIONS, (v, k) => (0, config_1.defineConfig)(k, v)); // define default values
 function serveStatic(uri) {
     const folder = (const_1.DEV ? 'dist/' : '') + uri.slice(2, -1);
+    const root = (0, path_1.join)(__dirname, '..', folder);
+    prewarmGuiAssets(root) // keep pkg snapshot files in memory before the reported runtime access loss can happen
+        .catch(e => console.error(`GUI asset prewarm failed: ${e?.code || e}`));
     return async (ctx) => {
         if (!exports.logGui.get())
             ctx.state.dontLog = true;
@@ -38,20 +42,37 @@ function serveStatic(uri) {
         if (ctx.method !== 'GET')
             return ctx.status = const_1.HTTP_METHOD_NOT_ALLOWED;
         const serveApp = shouldServeApp(ctx);
-        const fullPath = (0, path_1.join)(__dirname, '..', folder, serveApp ? '/index.html' : ctx.path);
-        const content = await (0, misc_1.parseFile)(fullPath, raw => serveApp || !raw.length ? raw : adjustBundlerLinks(ctx, uri, raw), 1000)
+        const fullPath = (0, path_1.join)(root, serveApp ? '/index.html' : ctx.path);
+        const cached = await parseGuiFile(fullPath)
             .catch(e => {
-            if (e?.code !== 'ENOENT') // not supposed to happen, and yet a user reported a strange behavior
+            if (!/^(?:ENOENT|EISDIR)$/.test(e?.code)) // not supposed to happen, and yet a user reported a strange behavior
                 console.error(`serveStatic/parseFile: ${String(e)}`);
             return null;
         });
-        if (content === null)
+        if (cached === null)
             return ctx.status = const_1.HTTP_NOT_FOUND;
-        if (!serveApp)
-            return (0, serveFile_1.serveFile)(ctx, fullPath, const_1.MIME_AUTO, content);
+        if (!serveApp) {
+            const c = cached.content;
+            return (0, serveFile_1.serveFile)(ctx, fullPath, const_1.MIME_AUTO, { ...cached, content: !c.length ? c : adjustBundlerLinks(ctx, uri, c) });
+        }
         // we don't cache the index as it's small and may prevent plugins change to apply
-        ctx.body = await treatIndex(ctx, uri, String(content));
+        ctx.body = await treatIndex(ctx, uri, String(cached.content));
     };
+    async function prewarmGuiAssets(dir) {
+        for (const entry of await (0, promises_1.readdir)(dir, { withFileTypes: true })) {
+            const fullPath = (0, path_1.join)(dir, entry.name);
+            if (entry.isDirectory()) {
+                await prewarmGuiAssets(fullPath);
+                continue;
+            }
+            if (!entry.isFile())
+                continue;
+            await parseGuiFile(fullPath);
+        }
+    }
+    function parseGuiFile(fullPath) {
+        return (0, misc_1.parseFile)(fullPath, x => x, const_1.DEV ? 1000 : Infinity); // cache raw bytes so reverse-proxy URL rewriting can still use the current request context
+    }
 }
 function shouldServeApp(ctx) {
     return ctx.state.serveApp ||= ctx.path.endsWith('/') && !ctx.headers.upgrade; // skip websockets
@@ -61,7 +82,7 @@ function adjustBundlerLinks(ctx, uri, data) {
     const filesUri = ctx.state.revProxyPath + uri;
     return ext && !ext.match(/\.(css|html|js|ts|scss)/) ? data
         : String(data).replace(/((?:import[ (]| from )['"])\//g, `$1${filesUri}`)
-            .replace(/(assetsURL=function\(([^)]+)\)\{return)"\/"\+\2\}/g, `$1${JSON.stringify(filesUri)}+$2}`); // vite's preload helper uses the configured absolute base for dependency hints
+            .replace(/(=function\(([\w$]+)\)\{return)[`'"]\/[`'"]\+\2\}/g, `$1${JSON.stringify(filesUri)}+$2}`); // vite's preload helper uses the configured absolute base for dynamic dependency hints
 }
 const getFaviconTimestamp = (0, misc_1.debounceAsync)(async () => {
     const f = adminApis_1.favicon.get();
@@ -174,12 +195,12 @@ function serveProxied(port, uri) {
      proxy = lib.default('127.0.0.1:' + port, {
         parseReqBody: false, // the dev GUI proxy serves app/assets, so avoid koa-better-http-proxy trying to reread ctx.req
         proxyReqPathResolver: (ctx) => shouldServeApp(ctx) ? '/' : ctx.path,
-        userResDecorator(res, data, ctx) {
+        userResDecorator(_res, data, ctx) {
             return shouldServeApp(ctx) ? treatIndex(ctx, uri, String(data))
                 : adjustBundlerLinks(ctx, uri, data);
         }
     }));
-    return function (ctx, next) {
+    return function (ctx, _next) {
         if (!exports.logGui.get())
             ctx.state.dontLog = true;
         return proxy(ctx, async () => { });

package/src/upload.js

@@ -197,7 +197,7 @@ function uploadWriter(base, baseUri, filename, ctx) {
                     if (mtime) // so we use it to touch the file
                         await (0, promises_1.utimes)(dest, Date.now() / 1000, mtime / 1000);
                     cancelDeletion(tempName); // not necessary, as deletion's failure is silent, but still
-                    ctx.state.uploadDestinationPath = dest;
+                    obj.fullPath = ctx.state.uploadDestinationPath = dest;
                     void setUploadMeta(dest, ctx);
                     if (ctx.query.comment)
                         void (0, comments_1.setCommentFor)(dest, String(ctx.query.comment));

package/src/util-files.js

@@ -17,6 +17,7 @@ exports.ensureParentFolder = ensureParentFolder;
 exports.createFileWithPath = createFileWithPath;
 exports.createSafeWriteStream = createSafeWriteStream;
 exports.isValidFileName = isValidFileName;
+exports.isValidWindowsFileName = isValidWindowsFileName;
 exports.exists = exists;
 exports.loadFileCached = loadFileCached;
 exports.parseFile = parseFile;
@@ -110,6 +111,8 @@ async function unzip(stream, cb) {
         .on('error', reject)
         .on('entry', (entry) => chain = chain.then(async () => {
         const { path, type } = entry;
+        if (hasDirTraversal(path))
+            return entry.autodrain().promise();
         const dest = await (0, cross_1.try_)(() => cb(path), e => console.warn(String(e)));
         if (!dest || type !== 'File')
             return entry.autodrain().promise();
@@ -174,31 +177,36 @@ async function createSafeWriteStream(path, options) {
     });
 }
 function isValidFileName(name, acceptUnreadable = false) {
-    return name && name !== '.' && !(const_1.IS_WINDOWS ? /[/:"*?<>|\\]/ : /\//).test(name) && !hasDirTraversal(name)
+    return name && name !== '.' && !(const_1.IS_WINDOWS ? !isValidWindowsFileName(name) : /\//.test(name)) && !hasDirTraversal(name)
         && (acceptUnreadable || !/[\u0000-\u001F\u007F]/.test(name));
 }
+function isValidWindowsFileName(name) {
+    return !/[/:"*?<>|\\]/.test(name)
+        && !/[. ]$/.test(name)
+        // windows treats these legacy DOS device names as device paths even when an extension is present
+        && !/^(?:con|prn|aux|nul|conin\$|conout\$|com[1-9\u00b9\u00b2\u00b3]|lpt[1-9\u00b9\u00b2\u00b3])(?:\..*)?$/i.test(name);
+}
 function exists(path) {
     return (0, promises_1.access)(path).then(() => true, () => false);
 }
-// parse a file, caching unless timestamp has changed
 exports.parseFileCache = new Map();
 async function loadFileCached(path, loader, minInterval = 0) {
     const cached = exports.parseFileCache.get(path);
     const now = Date.now();
     if (cached && now - cached.lastCheck < minInterval)
-        return cached.parsed;
-    const ts = await statWithTimeout(path).then(x => x.mtime, e => {
-        if (e?.message !== 'timeout')
-            throw e;
-        return cached?.ts || new Date(0); // on timeout (e.g. thread pool saturated), serve cache if any, or attempt the loader
+        return { stats: cached.stats, content: await cached.content };
+    const stats = await statWithTimeout(path).catch(e => {
+        if (e?.message === 'timeout' && cached)
+            return cached.stats; // on timeout (e.g. thread pool saturated), serve cache if any
+        throw e;
     });
     if (cached)
         cached.lastCheck = now;
-    if (cached && Number(ts) === Number(cached.ts))
-        return cached.parsed;
-    const parsed = loader(path);
-    exports.parseFileCache.set(path, { ts, parsed, lastCheck: now });
-    return parsed;
+    if (cached && Number(stats.mtime) === Number(cached.stats.mtime))
+        return { stats, content: await cached.content };
+    const content = Promise.resolve(loader(path));
+    exports.parseFileCache.set(path, { stats, content, lastCheck: now });
+    return { stats, content: await content };
 }
 async function parseFile(path, parse, skipStatIfFresherThan = 0) {
     return loadFileCached(path, () => (0, promises_1.readFile)(path).then(parse), skipStatIfFresherThan);

package/src/webdav.js

@@ -206,10 +206,7 @@ const webdav = async (ctx, next) => {
         if ((0, path_1.dirname)(path) === (0, path_1.dirname)(dest)) // rename case. `path` is is encoded, so we test before decoding `dest`
             try {
                 // decode the single path segment so reserved chars like %2C become their real name on rename
-                const newName = (0, cross_1.safeDecodeURIComponent)((0, path_1.basename)(dest), '');
-                if (!newName)
-                    return ctx.status = cross_1.HTTP_BAD_REQUEST;
-                await (0, frontEndApis_1.requestedRename)(node, newName, ctx);
+                await (0, frontEndApis_1.requestedRename)(node, (0, cross_1.safeDecodeURIComponent)((0, path_1.basename)(dest), ''), ctx);
                 releaseWebdavLock(path); // RFC 4918 says MOVE must not carry locks to destination, so clear source lock on success
                 return ctx.status = cross_1.HTTP_CREATED;
             }

package/admin/assets/index-CdJ2GK-i.css

@@ -1 +0,0 @@
-.ariaOnly{clip-path:rect(1px 1px 1px 1px);clip:rect(1px, 1px, 1px, 1px);position:absolute}.icon{text-align:center;width:1.4em;height:1.2em;font-size:1.2em;display:inline-block}@keyframes blink{0%{opacity:1}50%{opacity:.3}}:root{--success:#5c5;height:100dvh}body{-webkit-font-smoothing:antialiased;-moz-osx-font-smoothing:grayscale;background:#000;height:100vh;margin:0;font-family:-apple-system,BlinkMacSystemFont,Segoe UI,Roboto,Oxygen,Ubuntu,Cantarell,Fira Sans,Droid Sans,Helvetica Neue,sans-serif}#root{min-height:100%;display:flex}main{word-break:break-word}code{font-family:source-code-pro,Menlo,Monaco,Consolas,Courier New,monospace}img.flag{vertical-align:text-top;width:1.5em;height:1em;margin-top:1px}.icon-w-text{margin-right:.5em}form{max-width:100%}.MuiSvgIcon-root{vertical-align:bottom}div.MuiTreeItem-content{padding-top:1px;padding-bottom:0}.MuiDataGrid-columnHeaders{background-color:rgba(136,136,136,.133)}.MuiDataGrid-virtualScrollerRenderZone .MuiDataGrid-row .MuiDataGrid-cell{align-items:center;line-height:1.2em;display:flex}.MuiDataGrid-filterForm{flex-wrap:wrap;justify-content:space-evenly;row-gap:1em}.wrap[role=cell]{white-space:normal!important}ol,ul{margin-top:.2em;margin-bottom:.2em;padding-left:1.5em}h2.MuiDialogTitle-root{padding-top:2px;padding-bottom:2px}.dialog-alert .MuiDialogContent-root{white-space:pre-wrap;max-width:45em;padding:.5em 1em}.release code{background-color:rgba(136,136,136,.2);border-radius:.2em;padding:0 .2em;font-size:95%}.MuiAppBar-root .MuiAlert-standardInfo .MuiAlert-icon{color:rgba(255,255,255,.533)!important}.MuiAppBar-root .MuiAlert-standardInfo .MuiAlert-message{color:rgba(255,255,255,.667)!important}.MuiAppBar-root .MuiAlert-colorWarning .MuiAlert-icon{color:rgba(255,255,0,.533)!important}.MuiAppBar-root .MuiAlert-colorWarning .MuiAlert-message{color:rgba(255,255,0,.667)!important}.animated-dashed-line{background-image:linear-gradient(90deg,currentColor 50%,transparent 50%);background-size:10px 100%;width:100%;height:2px;animation:1s linear infinite alternate animate-dash}@keyframes animate-dash{to{background-position:20px 0}}@keyframes success{50%{color:var(--success);transform:scale(1.3)}to{transform:inherit;color:inherit}}::-webkit-scrollbar{width:4px}::-webkit-scrollbar-thumb{background:rgba(136,136,136,.533)}::-webkit-scrollbar-track{background:rgba(136,136,136,.133)}.token.operator{background:unset!important}.fflag{vertical-align:bottom;border:none;width:26px;height:17px}code[class*=language-],pre[class*=language-]{color:#657b83;text-align:left;white-space:pre;word-spacing:normal;word-break:normal;word-wrap:normal;-moz-tab-size:4;tab-size:4;-webkit-hyphens:none;-ms-hyphens:none;hyphens:none;font-family:Consolas,Monaco,Andale Mono,Ubuntu Mono,monospace;font-size:1em;line-height:1.5}pre[class*=language-]::-moz-selection{background:#073642}pre[class*=language-] ::-moz-selection{background:#073642}code[class*=language-]::-moz-selection{background:#073642}code[class*=language-] ::-moz-selection{background:#073642}pre[class*=language-]::-moz-selection{background:#073642}pre[class*=language-]::selection{background:#073642}pre[class*=language-] ::-moz-selection{background:#073642}pre[class*=language-] ::selection{background:#073642}code[class*=language-]::-moz-selection{background:#073642}code[class*=language-]::selection{background:#073642}code[class*=language-] ::-moz-selection{background:#073642}code[class*=language-] ::selection{background:#073642}pre[class*=language-]{border-radius:.3em;margin:.5em 0;padding:1em;overflow:auto}:not(pre)>code[class*=language-],pre[class*=language-]{background-color:#fdf6e3}:not(pre)>code[class*=language-]{border-radius:.3em;padding:.1em}.token.comment,.token.prolog,.token.doctype,.token.cdata{color:#93a1a1}.token.punctuation{color:#586e75}.token.namespace{opacity:.7}.token.property,.token.tag,.token.boolean,.token.number,.token.constant,.token.symbol,.token.deleted{color:#268bd2}.token.selector,.token.attr-name,.token.string,.token.char,.token.builtin,.token.url,.token.inserted{color:#2aa198}.token.entity{color:#657b83;background:#eee8d5}.token.atrule,.token.attr-value,.token.keyword{color:#859900}.token.function,.token.class-name{color:#b58900}.token.regex,.token.important,.token.variable{color:#cb4b16}.token.important,.token.bold{font-weight:700}.token.italic{font-style:italic}.token.entity{cursor:help}