hfs 3.3.2 → 3.4.0-alpha1

package/src/serveFile.js

@@ -8,6 +8,9 @@ exports.forceDownload = forceDownload;
 exports.disposition = disposition;
 exports.serveFileNode = serveFileNode;
 exports.enforceDownloadLimits = enforceDownloadLimits;
+exports.resolveFileMime = resolveFileMime;
+exports.getNodeMime = getNodeMime;
+exports.isActiveContentMime = isActiveContentMime;
 exports.serveFile = serveFile;
 exports.monitorAsDownload = monitorAsDownload;
 exports.applyRange = applyRange;
@@ -26,6 +29,7 @@ const errorPages_1 = require("./errorPages");
 const stream_1 = require("stream");
 const crypto_1 = require("crypto");
 const iconv_lite_1 = __importDefault(require("iconv-lite"));
+const upload_1 = require("./upload");
 const allowedReferer = (0, config_1.defineConfig)(misc_1.CFG.allowed_referer, '');
 const maxDownloads = downloadLimiter((0, config_1.defineConfig)(misc_1.CFG.max_downloads, 0), () => true);
 const maxDownloadsPerIp = downloadLimiter((0, config_1.defineConfig)(misc_1.CFG.max_downloads_per_ip, 0), ctx => ctx.ip);
@@ -49,6 +53,7 @@ async function serveFileNode(ctx, node) {
     const name = (0, vfs_1.getNodeName)(node);
     const mimeString = typeof mime === 'string' ? mime
         : lodash_1.default.find(mime, (_val, mask) => (0, misc_1.matches)(name, mask));
+    const effectiveMime = resolveFileMime(source || '', mimeString);
     if (allowedReferer.get()) {
         const ref = (0, misc_1.try_)(() => new URL(ctx.get('referer') || '').host);
         if (ref && ref !== ctx.host // automatically accept if the referer is basically the hosting domain
@@ -58,12 +63,17 @@ async function serveFileNode(ctx, node) {
     ctx.state.vfsNode = node; // useful to tell service files from files shared by the user
     const download = 'dl' in ctx.query;
     disposition(ctx, name, download);
+    if (!download && source && isActiveContentMime(effectiveMime)) {
+        const upload = await (0, upload_1.getUploadMeta)(source);
+        if ((0, upload_1.isUploading)(source) || upload && upload.approved !== true)
+            return (0, errorPages_1.sendErrorPage)(ctx, const_1.HTTP_FORBIDDEN);
+    }
     const fetchDest = ctx.get('sec-fetch-dest');
     ctx.state.considerAsGui ??= !download && ctx.get('referer')?.endsWith('/')
         && (fetchDest ? fetchDest !== 'document' && fetchDest !== 'empty' // modern clients
             // legacy clients often send Accept: */* for archive downloads, so the served mime is a safer signal than request headers here
-            : GUI_ASSET_MIME.test(mimeString || mime_types_1.default.lookup(source || '') || ''));
-    await serveFile(ctx, source || '', mimeString);
+            : GUI_ASSET_MIME.test(effectiveMime));
+    await serveFile(ctx, source || '', effectiveMime);
     await enforceDownloadLimits(ctx);
 }
 async function enforceDownloadLimits(ctx) {
@@ -75,14 +85,25 @@ const mimeCfg = (0, config_1.defineConfig)(misc_1.CFG.mime, {}, obj => {
     const values = Object.values(obj);
     return (name) => values[matchers.findIndex(matcher => matcher(name))];
 });
+function resolveFileMime(filePath, mime) {
+    mime ??= mimeCfg.compiled()((0, path_1.basename)(filePath));
+    return mime === undefined || mime === const_1.MIME_AUTO ? mime_types_1.default.lookup(filePath) || '' : mime;
+}
+function getNodeMime(node) {
+    const name = (0, vfs_1.getNodeName)(node);
+    const mime = typeof node.mime === 'string' ? node.mime
+        : lodash_1.default.find(node.mime, (_val, mask) => (0, misc_1.matches)(name, mask));
+    return resolveFileMime(node.source || '', mime);
+}
+function isActiveContentMime(mime) {
+    return /^(?:text\/html|application\/xhtml\+xml|image\/svg\+xml)(?:;|$)/i.test(mime);
+}
 // after this number of seconds, the browser should check the server to see if there's a newer version of the file
 const cacheControlDiskFiles = (0, config_1.defineConfig)(misc_1.CFG.cache_control_disk_files, 5);
 async function serveFile(ctx, filePath, mime, cached) {
     if (!filePath)
         return;
-    mime ??= mimeCfg.compiled()((0, path_1.basename)(filePath));
-    if (mime === undefined || mime === const_1.MIME_AUTO)
-        mime = mime_types_1.default.lookup(filePath) || '';
+    mime = resolveFileMime(filePath, mime);
     if (mime)
         ctx.type = mime;
     if (ctx.method === 'OPTIONS') {

package/src/serveGuiFiles.js

@@ -19,6 +19,7 @@ const customHtml_1 = require("./customHtml");
 const lodash_1 = __importDefault(require("lodash"));
 const config_1 = require("./config");
 const lang_1 = require("./lang");
+const adminLang_1 = require("./adminLang");
 const upload_1 = require("./upload");
 const icons_1 = require("./icons");
 const middlewares_1 = require("./middlewares");
@@ -107,7 +108,8 @@ async function treatIndex(ctx, filesUri, body) {
         return !lodash_1.default.isEmpty(configs) && [name, configs];
     })));
     const timestamp = await getFaviconTimestamp();
-    const lang = await (0, lang_1.getLangData)(ctx);
+    const adminLangs = isFrontend ? [] : await (0, adminLang_1.getAdminLangs)();
+    const lang = isFrontend ? await (0, lang_1.getLangData)(ctx) : await (0, adminLang_1.getAdminLangData)(ctx, adminLangs);
     let group = 0; // this represents the loading-group: all plugins with the same group can be loaded concurrently
     const loadScripts = (0, misc_1.onlyTruthy)((0, plugins_1.mapPlugins)((p, id) => {
         const js = p.frontend_js?.map(f => f.includes('//') ? f : pub + id + '/' + f);
@@ -148,7 +150,8 @@ async function treatIndex(ctx, filesUri, body) {
                 customHtml: lodash_1.default.omit((0, customHtml_1.getAllSections)(), ['top', 'bottom', 'htmlHead', 'style']), // exclude the sections we already apply in this phase
                 ...(0, misc_1.newObj)(misc_1.FRONTEND_OPTIONS, (v, k) => (0, config_1.getConfig)(k)),
                 icons: Object.assign({}, ...(0, plugins_1.mapPlugins)(p => iconsToObj(p.icons, p.id + '/')), iconsToObj(icons_1.customizedIcons)), // name-to-uri 
-                lang
+                lang,
+                ...(isFrontend ? {} : { adminLangs, adminLang: adminLang_1.adminLang.get() })
             }, null, 4).replace(/<(\/script)/g, '<"+"$1') /*avoid breaking our script container*/}
                     document.documentElement.setAttribute('ver', HFS.VERSION.split('-')[0])
                     document.documentElement.setAttribute('browser', ${JSON.stringify((0, misc_1.shortenAgent)(ctx.get('user-agent')))})

package/src/update.js

@@ -10,7 +10,7 @@ exports.getVersions = getVersions;
 exports.getUpdates = getUpdates;
 exports.localUpdateAvailable = localUpdateAvailable;
 exports.previousAvailable = previousAvailable;
-exports.updateSupported = updateSupported;
+exports.updateNotSupported = updateNotSupported;
 exports.update = update;
 const github_1 = require("./github");
 const const_1 = require("./const");
@@ -29,6 +29,7 @@ const lodash_1 = __importDefault(require("lodash"));
 const argv_1 = require("./argv");
 const promises_2 = require("stream/promises");
 const updateChangelog_1 = require("./updateChangelog");
+const fast_xml_parser_1 = require("fast-xml-parser");
 const updateToBeta = (0, config_1.defineConfig)(misc_1.CFG.update_to_beta, false);
 const autoCheckUpdate = (0, config_1.defineConfig)(misc_1.CFG.auto_check_update, true);
 const lastCheckUpdate = persistence_1.storedMap.singleSync('lastCheckUpdate', 0);
@@ -59,15 +60,16 @@ exports.checkForUpdates = (0, misc_1.debounceAsync)(async () => {
 async function getBestUpdate() {
     return (await getUpdates(true))[0];
 }
-const ReleaseKeys = ['prerelease', 'tag_name', 'name', 'body', 'assets', 'isNewer', 'versionScalar'];
-const ReleaseAssetKeys = ['name', 'browser_download_url'];
+const releaseKeys = ['prerelease', 'tag_name', 'name', 'body', 'assets', 'isNewer', 'versionScalar'];
+const releaseAssetKeys = ['name', 'browser_download_url'];
+const assetPrefix = `hfs-${(0, misc_1.xlate)(process.platform, { win32: 'windows', darwin: 'mac' })}-${process.arch}`;
 const curV = config_1.currentVersion.scalar;
 function prepareRelease(r) {
     const v = (0, config_1.versionToScalar)(r.name);
-    return Object.assign(lodash_1.default.pick(r, ReleaseKeys), {
+    return Object.assign(lodash_1.default.pick(r, releaseKeys), {
         versionScalar: v,
         isNewer: v > curV, // make easy to know what's newer
-        assets: r.assets.map((a) => lodash_1.default.pick(a, ReleaseAssetKeys))
+        assets: r.assets.map((a) => lodash_1.default.pick(a, releaseAssetKeys))
     });
 }
 async function getVersions(filter, max = 30, stopAtCurrent = false) {
@@ -91,10 +93,19 @@ async function getVersions(filter, max = 30, stopAtCurrent = false) {
 async function getUpdates(strict = false) {
     console.log("Checking for updates");
     void (0, github_1.getProjectInfo)(); // also check for alerts and print them asap in the console
-    const stable = prepareRelease(await (0, github_1.getRepoInfo)(const_1.HFS_REPO + '/releases/latest'));
     const includeBetas = updateToBeta.get() || const_1.RUNNING_BETA;
-    // we don't consider betas before stable
-    const betas = !includeBetas ? [] : await getVersions(x => x.prerelease && x.versionScalar > stable.versionScalar && (!strict || x.isNewer));
+    const latest = await (0, misc_1.httpStream)(`https://github.com/${const_1.HFS_REPO}/releases/latest`, { method: 'HEAD', noRedirect: true });
+    const stableTag = latest.headers.location?.split('/').at(-1);
+    if (!stableTag)
+        throw Error('Cannot determine latest stable version');
+    if ((0, config_1.versionToScalar)(stableTag) === curV && !includeBetas)
+        return [];
+    let stable = prepareRelease({ prerelease: false, tag_name: stableTag, name: stableTag, body: '', assets: [probableAsset(stableTag)], isNewer: false, versionScalar: 0 });
+    if (stable.isNewer || const_1.RUNNING_BETA && !strict)
+        stable = await (0, github_1.getRepoInfo)(const_1.HFS_REPO + '/releases/tags/' + stableTag).then(prepareRelease).catch(() => stable);
+    const betas = !includeBetas ? [] : await getVersions(x => x.prerelease && x.versionScalar > stable.versionScalar && (!strict || x.isNewer))
+        // preserve update detection when GitHub's REST quota is exhausted
+        .catch(() => getVersionsFromAtom(x => x.prerelease && x.versionScalar > stable.versionScalar && (!strict || x.isNewer)));
     if (stable.isNewer || const_1.RUNNING_BETA && !strict)
         betas.push(stable);
     if (stable.isNewer && stable.body) {
@@ -102,7 +113,28 @@ async function getUpdates(strict = false) {
             .catch(() => []); // missing history must not prevent installing an available update
         stable.body = (0, updateChangelog_1.updateChangelog)(stable, history, curV);
     }
-    return betas;
+    return lodash_1.default.sortBy(betas, x => -x.versionScalar);
+    async function getVersionsFromAtom(filter) {
+        const feed = new fast_xml_parser_1.XMLParser({ ignoreAttributes: false })
+            .parse(await (0, misc_1.httpString)(`https://github.com/${const_1.HFS_REPO}/releases.atom`))?.feed;
+        return lodash_1.default.sortBy(lodash_1.default.castArray(feed?.entry)
+            .map((x) => prepareRelease({
+            prerelease: /^v?\d+\.\d+\.\d+-/.test(x.title),
+            tag_name: x.id.split('/').at(-1),
+            name: x.title,
+            body: x.content?.['#text'] || '',
+            assets: [probableAsset(x.id.split('/').at(-1))],
+            isNewer: false,
+            versionScalar: 0,
+        }))
+            .filter(x => Number.isFinite(x.versionScalar) && !x.name.endsWith('-ignore')
+            && x.versionScalar !== curV && filter(x)), x => -x.versionScalar);
+    }
+    function probableAsset(tag) {
+        const name = `${assetPrefix}-${tag.replace(/^v/, '')}.zip`;
+        // release-assets.yml uses this predictable name, keeping degraded checks installable
+        return { name, browser_download_url: `https://github.com/${const_1.HFS_REPO}/releases/download/${tag}/${name}` };
+    }
 }
 const LOCAL_UPDATE = 'hfs-update.zip'; // update from file takes precedence over net
 const INSTALLED_FN = 'hfs-installed.zip';
@@ -113,13 +145,16 @@ function localUpdateAvailable() {
 function previousAvailable() {
     return (0, misc_1.exists)(PREVIOUS_FN);
 }
-function updateSupported() {
-    return !process.env.DISABLE_UPDATE && (argv_1.argv.forceupdate || const_1.IS_BINARY);
+function updateNotSupported() {
+    return process.env.DISABLE_UPDATE ? "Automatic updates are disabled"
+        : !(argv_1.argv.forceupdate || const_1.IS_BINARY) ? "Only binary versions support automatic updates"
+            : (0, promises_1.access)((0, path_1.dirname)(process.execPath), fs_1.constants.W_OK | fs_1.constants.X_OK)
+                .then(() => '', () => `Executable directory is not writable: ${(0, path_1.dirname)(process.execPath)}`);
 }
 async function update(tagOrUrl = '') {
-    if (!updateSupported())
-        throw process.env.DISABLE_UPDATE ? "Automatic updates are disabled"
-            : "Only binary versions support automatic updates";
+    const error = await updateNotSupported();
+    if (error)
+        throw error;
     let url = tagOrUrl.includes('://') && tagOrUrl;
     if (tagOrUrl === const_1.PREVIOUS_TAG)
         await (0, promises_1.rename)(PREVIOUS_FN, LOCAL_UPDATE);
@@ -135,11 +170,9 @@ async function update(tagOrUrl = '') {
             });
         if (!update)
             throw "No update has been found";
-        const plat = '-' + (0, misc_1.xlate)(process.platform, { win32: 'windows', darwin: 'mac' });
-        const assetSearch = `${plat}-${process.arch}`;
-        const asset = update.assets.find((x) => x.name.includes(assetSearch) && x.name.endsWith('.zip'));
+        const asset = update.assets.find((x) => x.name.includes(assetPrefix) && x.name.endsWith('.zip'));
         if (!asset)
-            throw `Asset not found: ${assetSearch}`;
+            throw `Asset not found: ${assetPrefix}`;
         url = asset.browser_download_url;
     }
     if (url) {

package/src/upload.js

@@ -5,7 +5,11 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.dontOverwriteUploading = exports.minAvailableMb = exports.deleteUnfinishedUploadsAfter = void 0;
 exports.getUploadMeta = getUploadMeta;
+exports.saveUploadMeta = saveUploadMeta;
+exports.setUploadApproved = setUploadApproved;
 exports.getUploadTempFor = getUploadTempFor;
+exports.isUploading = isUploading;
+exports.whileUploadMetaPending = whileUploadMetaPending;
 exports.uploadWriter = uploadWriter;
 const vfs_1 = require("./vfs");
 const const_1 = require("./const");
@@ -25,6 +29,7 @@ const expiringCache_1 = require("./expiringCache");
 const first_1 = require("./first");
 const uploadOwners_1 = require("./uploadOwners");
 const webdav_1 = require("./webdav");
+const adminApis_1 = require("./adminApis");
 exports.deleteUnfinishedUploadsAfter = (0, config_1.defineConfig)(misc_1.CFG.delete_unfinished_uploads_after, 86_400);
 exports.minAvailableMb = (0, config_1.defineConfig)(misc_1.CFG.min_available_mb, 100);
 exports.dontOverwriteUploading = (0, config_1.defineConfig)(misc_1.CFG.dont_overwrite_uploading, true);
@@ -56,10 +61,18 @@ const ATTR_UPLOADER = 'uploader';
 function getUploadMeta(path) {
     return (0, misc_1.loadFileAttr)(path, ATTR_UPLOADER);
 }
-function setUploadMeta(path, ctx) {
-    return (0, misc_1.storeFileAttr)(path, ATTR_UPLOADER, {
+function saveUploadMeta(path, meta) {
+    return (0, misc_1.storeFileAttr)(path, ATTR_UPLOADER, meta);
+}
+async function setUploadApproved(path, approved) {
+    const meta = await getUploadMeta(path);
+    return Boolean(meta && await saveUploadMeta(path, { ...meta, approved }));
+}
+function fillUploadMeta(path, ctx) {
+    return saveUploadMeta(path, {
         username: (0, auth_1.getCurrentUsername)(ctx) || undefined,
         ip: ctx.ip,
+        approved: (0, adminApis_1.ctxAdminAccess)(ctx) || undefined,
     });
 }
 function getUploadTempFor(fullPath) {
@@ -67,6 +80,24 @@ function getUploadTempFor(fullPath) {
 }
 const diskSpaceCache = (0, expiringCache_1.expiringCache)(3_000); // invalidate shortly
 const uploadingFiles = new Map();
+const uploadMetaPending = new Set();
+function isUploading(path) {
+    const key = (0, vfs_1.normalizeFilename)(path);
+    return (0, path_1.basename)(path).startsWith(const_1.UPLOAD_TEMP_PREFIX)
+        || uploadingFiles.has(key)
+        || uploadingFiles.has((0, vfs_1.normalizeFilename)(getUploadTempFor(path))) // active uploads are keyed by their temporary file
+        || uploadMetaPending.has(key);
+}
+async function whileUploadMetaPending(path, cb) {
+    const key = (0, vfs_1.normalizeFilename)(path);
+    uploadMetaPending.add(key);
+    try {
+        return await cb();
+    }
+    finally {
+        uploadMetaPending.delete(key);
+    }
+}
 // initially sync for formidable; still sync to avoid async races and PUT piping gaps
 function uploadWriter(base, baseUri, filename, ctx) {
     if (!filename || !(0, misc_1.isValidFileName)(filename) || !filename)
@@ -123,7 +154,7 @@ function uploadWriter(base, baseUri, filename, ctx) {
         const createdFolders = [];
         const firstCreated = !dir.endsWith(':\\') && fs_1.default.mkdirSync(dir, { recursive: true });
         if (firstCreated) {
-            setUploadMeta(dir, ctx);
+            fillUploadMeta(dir, ctx);
             // recursive mkdir returns the first created directory; existing ancestors must not receive ownership
             const firstCreatedPath = (0, path_1.toNamespacedPath)((0, path_1.resolve)(firstCreated)); // Node 24 mkdir can return a namespace-prefixed Windows path
             let source = (0, path_1.resolve)(dir);
@@ -219,12 +250,16 @@ function uploadWriter(base, baseUri, filename, ctx) {
                 await new Promise(res => fileStream.close(res)); // this only seems necessary on Windows
                 for (const { uri, source } of createdFolders)
                     await (0, uploadOwners_1.setUploadOwner)(uri, ctx, source);
-                if (errored)
-                    return;
                 if (simulate)
                     return (0, promises_1.rm)(tempName).catch(() => { });
+                if (!await fillUploadMeta(tempName, ctx)) {
+                    await (0, promises_1.rm)(tempName).catch(() => { });
+                    return fail(const_1.HTTP_SERVER_ERROR);
+                }
+                if (errored)
+                    return;
                 if (ctx.isAborted()) { // in the very unlikely case the connection is interrupted between last-byte and here, we still consider it unfinished, as the client had no way to know, and will resume, but it would get an error if we finish the process
-                    const sec = exports.deleteUnfinishedUploadsAfter.get();
+                    const sec = first_1.quitting ? undefined : exports.deleteUnfinishedUploadsAfter.get(); // preserve uploads interrupted by shutdown for resuming
                     await (0, uploadOwners_1.setUploadOwner)(tempOwnerUri, ctx, tempName, lodash_1.default.isNumber(sec) ? Date.now() + sec * 1000 : null);
                     return lodash_1.default.isNumber(sec) && delayedDelete(tempName, sec, tempOwnerUri);
                 }
@@ -254,11 +289,16 @@ function uploadWriter(base, baseUri, filename, ctx) {
                     () => (0, promises_1.rename)(tempName, dest).then(() => true, e => e?.code !== 'EBUSY' && Promise.reject(e)), { timeout: 10_000 });
                     if (!done)
                         throw 'EBUSY';
+                    await (0, misc_1.moveStoredFileAttrs)(tempName, dest);
                     (0, uploadOwners_1.deleteUploadOwner)(tempOwnerUri); // the temp URI no longer exists after rename; final ownership is recorded below
                     if (mtime) // so we use it to touch the file
                         await (0, promises_1.utimes)(dest, Date.now() / 1000, mtime / 1000);
                     obj.fullPath = ctx.state.uploadDestinationPath = dest;
-                    void setUploadMeta(dest, ctx);
+                    if (!await fillUploadMeta(dest, ctx)) {
+                        await (0, promises_1.rename)(dest, tempName);
+                        await (0, misc_1.moveStoredFileAttrs)(dest, tempName);
+                        throw Error("couldn't store upload metadata");
+                    }
                     if (ctx.query.comment)
                         void (0, comments_1.setCommentFor)(dest, String(ctx.query.comment));
                     obj.uri = (0, misc_1.enforceFinal)('/', baseUri) + (0, misc_1.pathEncode)((0, path_1.basename)(dest));
@@ -272,8 +312,9 @@ function uploadWriter(base, baseUri, filename, ctx) {
                                 cb(obj);
                 }
                 catch (err) {
-                    void setUploadMeta(tempName, ctx);
+                    void fillUploadMeta(tempName, ctx);
                     console.error("Couldn't rename temp to", dest, String(err));
+                    fail(const_1.HTTP_SERVER_ERROR);
                 }
             }
             finally {

package/src/util-http.js

@@ -38,6 +38,8 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.stream2string = void 0;
+exports.readTextLimited = readTextLimited;
+exports.readRequestBodyLimited = readRequestBodyLimited;
 exports.httpString = httpString;
 exports.httpWithBody = httpWithBody;
 exports.httpStream = httpStream;
@@ -51,6 +53,29 @@ const consumers_1 = require("node:stream/consumers");
 Object.defineProperty(exports, "stream2string", { enumerable: true, get: function () { return consumers_1.text; } });
 const tls = __importStar(require("node:tls"));
 const cross_1 = require("./cross");
+const cross_const_1 = require("./cross-const");
+async function readTextLimited(stream, maxBytes) {
+    if (Number(stream.headers['content-length']) > maxBytes)
+        return { error: 'too_large' };
+    const chunks = [];
+    let size = 0;
+    // keep the socket alive so callers can send the rejection before closing an undrained request
+    for await (const chunk of stream.iterator({ destroyOnReturn: false })) {
+        const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+        size += buffer.length;
+        if (size > maxBytes)
+            return { error: 'too_large' };
+        chunks.push(buffer);
+    }
+    return { text: new TextDecoder().decode(Buffer.concat(chunks, size)) };
+}
+async function readRequestBodyLimited(ctx, maxBytes) {
+    const body = await readTextLimited(ctx.req, maxBytes);
+    if (!('error' in body))
+        return body;
+    ctx.set('Connection', 'close'); // an unread rejected body makes this connection unsafe to reuse
+    ctx.status = cross_const_1.HTTP_PAYLOAD_TOO_LARGE;
+}
 async function httpString(url, { maxBytes = 10 * cross_1.MB, ...options } = {}) {
     const stream = await httpStream(url, options);
     if (maxBytes === Infinity)
@@ -85,12 +110,13 @@ function httpStream(url, { body, proxy, jar, noRedirect, httpThrow = true, ...op
             options.headers['user-agent'] = httpStream.defaultUA;
         if (body) {
             options.method ||= 'POST';
-            if (lodash_1.default.isPlainObject(body)) {
-                options.headers['content-type'] ??= 'application/json';
-                body = JSON.stringify(body);
-            }
-            if (!(body instanceof node_stream_1.Readable))
+            if (!(body instanceof node_stream_1.Readable)) {
+                if (typeof body === 'object' && !(body instanceof Buffer)) {
+                    options.headers['content-type'] ??= 'application/json';
+                    body = JSON.stringify(body);
+                }
                 options.headers['content-length'] ??= Buffer.byteLength(body);
+            }
         }
         const { auth, ...parsed } = parseHttpUrl(url);
         const hostJar = jar && (jar[parsed.hostname || ''] ||= {});

package/src/vfs.js

@@ -42,6 +42,7 @@ const walkDir_1 = require("./walkDir");
 const node_stream_1 = require("node:stream");
 const adminApis_1 = require("./adminApis");
 const showHiddenFiles = (0, config_1.defineConfig)(misc_1.CFG.show_hidden_files, false);
+const sourceNames = new Map();
 function setVfsPath(node, vfsPath, parent) {
     return (0, misc_1.setHidden)(node, {
         vfsPath: (0, misc_1.enforceFinal)('/', parent?.vfsPath) + (0, misc_1.pathEncode)(vfsPath)
@@ -189,6 +190,27 @@ async function getNodeByName(name, parent, assumeMissingToBeFolder = false) {
     // does the tree node have a child that goes by this name, otherwise attempt disk
     let virtualName = name;
     let child = parent.children?.find(isSameFilenameAs(name));
+    const sameName = isSameFilenameAs(name);
+    const sourceName = Object.entries(parent.rename || {}).find(([, to]) => sameName(to))?.[0] || name;
+    if (!child) {
+        child = findSourceChild();
+        if (!child && const_1.IS_WINDOWS && parent.source) {
+            const aliases = await windowsPathNames((0, path_1.join)(parent.source, sourceName), parent.source);
+            if (!aliases)
+                return;
+            child = findSourceChild(aliases);
+            if (!child) {
+                const normalized = new Set(aliases.map(normalizeFilename));
+                const candidates = parent.children?.filter(candidate => candidate.source
+                    && normalized.has(normalizeFilename((0, path_1.basename)(candidate.source)))) || [];
+                if (candidates.length > 1)
+                    return; // an unverified physical alias must identify one VFS child
+                const [candidate] = candidates;
+                if (candidate?.source && await isSameFilePath((0, path_1.dirname)(candidate.source), parent.source))
+                    child = candidate;
+            }
+        }
+    }
     if (child) { // found as vfs node
         virtualName = getNodeName(child);
         await setIsFolder(child); // in case it's pointing to a folder that didn't exist at loading time
@@ -202,7 +224,6 @@ async function getNodeByName(name, parent, assumeMissingToBeFolder = false) {
         const ret = {};
         let onDisk = name;
         if (parent.rename) { // reverse the mapping
-            const sameName = isSameFilenameAs(name);
             const entries = Object.entries(parent.rename);
             // search display names first: with { A: B, C: A }, A must resolve to C rather than be hidden
             const asDisplayName = entries.find(([, to]) => sameName(to));
@@ -211,12 +232,17 @@ async function getNodeByName(name, parent, assumeMissingToBeFolder = false) {
                 virtualName = asDisplayName[1];
             }
             else {
-                const asPhysicalName = entries.find(([from]) => sameName(from));
+                if (!await canonicalizeWindowsAlias())
+                    return;
+                const sameSourceName = isSameFilenameAs(onDisk);
+                const asPhysicalName = entries.find(([from]) => sameSourceName(from));
                 if (asPhysicalName)
                     return; // a VFS rename replaces the original public name
             }
             ret.rename = renameUnderPath(parent.rename, onDisk);
         }
+        else if (!await canonicalizeWindowsAlias())
+            return;
         if (!(0, misc_1.isValidFileName)(onDisk))
             return;
         ret.source = (0, path_1.join)(parent.source, onDisk);
@@ -225,6 +251,22 @@ async function getNodeByName(name, parent, assumeMissingToBeFolder = false) {
         if (assumeMissingToBeFolder)
             ret.isFolder ??= true;
         return ret;
+        async function canonicalizeWindowsAlias() {
+            if (!const_1.IS_WINDOWS || !name.includes('~'))
+                return true;
+            // Windows exposes 8.3 aliases that must keep the long name's VFS identity
+            const longPath = await convertWindowsPath((0, path_1.join)(parent.source, name), true);
+            if (!longPath)
+                return true; // new names containing '~' are still valid
+            if (!await isSameFilePath((0, path_1.dirname)(longPath), parent.source))
+                return false;
+            onDisk = virtualName = (0, path_1.basename)(longPath);
+            return true;
+        }
+    }
+    function findSourceChild(names = [sourceName]) {
+        const normalized = new Set(names.map(normalizeFilename));
+        return parent.children?.find(x => getSourceNames(x, parent).some(source => normalized.has(normalizeFilename(source))));
     }
 }
 const smartUncFolderDetection = (0, config_1.defineConfig)(misc_1.CFG.smart_unc_folder_detection, false);
@@ -261,8 +303,42 @@ async function reviewVfs() {
             usedNames.add(normalizeFilename(getNodeName(child)));
         }
         await Promise.allSettled(node.children.map(recur));
+        await Promise.allSettled(node.children.map(child => setSourceNames(child, node)));
     })(exports.vfs.compiled());
 }
+async function setSourceNames(node, parent) {
+    if (!node.source || !parent.source)
+        return;
+    const sameParent = normalizeFilename((0, path_1.dirname)((0, path_1.resolve)(node.source))) === normalizeFilename((0, path_1.resolve)(parent.source));
+    if (!sameParent && (!const_1.IS_WINDOWS || !await isSameFilePath((0, path_1.dirname)(node.source), parent.source)))
+        return;
+    const names = [(0, path_1.basename)(node.source)];
+    const key = sourceNamesKey(node, parent);
+    if (const_1.IS_WINDOWS) {
+        const converted = await Promise.all([convertWindowsPath(node.source), convertWindowsPath(node.source, true)]);
+        names.push(...converted.map(x => x && (0, path_1.basename)(x)).filter(Boolean));
+    }
+    sourceNames.set(key, lodash_1.default.uniq(names));
+}
+function convertWindowsPath(path, isLong = false) {
+    return new Promise(resolvePromise => {
+        if (!fswin_1.default.convertPath(path, resolvePromise, isLong))
+            resolvePromise(undefined);
+    });
+}
+async function windowsPathNames(path, parent) {
+    const converted = await Promise.all([convertWindowsPath(path), convertWindowsPath(path, true)]);
+    const existing = converted.find(Boolean);
+    if (existing && !await isSameFilePath((0, path_1.dirname)(existing), parent))
+        return;
+    return lodash_1.default.uniq([(0, path_1.basename)(path), ...converted.map(x => x && (0, path_1.basename)(x)).filter(Boolean)]);
+}
+function getSourceNames(node, parent) {
+    return node.source && parent.source ? sourceNames.get(sourceNamesKey(node, parent)) || [] : [];
+}
+function sourceNamesKey(node, parent) {
+    return normalizeFilename((0, path_1.resolve)(parent.source)) + '\0' + normalizeFilename((0, path_1.resolve)(node.source));
+}
 exports.saveVfs = (0, misc_1.debounceAsync)(async () => {
     await reviewVfs(); // refresh runtime-derived folder flags before saving mutated VFS state
     exports.vfs.set(exports.vfs.compiled()); // sync the mutable runtime tree back to config state before persisting it
@@ -385,6 +461,7 @@ async function* walkNode(parent, { ctx, depth = Infinity, prefixPath = '', requi
             started = true;
             const { source } = parent;
             const taken = new Set();
+            const takenSources = new Set();
             const maskApplier = parentMaskApplier(parent);
             const visitLater = [];
             const childrenWorking = parent.children?.length && Promise.all(parent.children.map(async (child) => {
@@ -392,7 +469,9 @@ async function* walkNode(parent, { ctx, depth = Infinity, prefixPath = '', requi
                     return;
                 const nodeName = getNodeName(child);
                 const name = prefixPath + nodeName;
-                taken?.add(normalizeFilename(name));
+                taken.add(normalizeFilename(name));
+                for (const sourceName of getSourceNames(child, parent))
+                    takenSources.add(normalizeFilename(prefixPath + sourceName));
                 const item = setVfsPath({ ...child, original: child, name, parent }, name, parent);
                 if (await cantSee(item))
                     return;
@@ -434,7 +513,8 @@ async function* walkNode(parent, { ctx, depth = Infinity, prefixPath = '', requi
                                 renamed = dir + '/' + renamed;
                         }
                         const name = prefixPath + (renamed || path);
-                        if (taken?.has(normalizeFilename(name))) // taken by vfs node above
+                        if (taken.has(normalizeFilename(name))
+                            || takenSources.has(normalizeFilename(prefixPath + path))) // taken by vfs node above
                             return false; // false just in case it's a folder
                         const item = setVfsPath({ name, isFolder, source: (0, path_1.join)(source, path), parent, stats: entry.stats }, name, parent);
                         // masks containing '/' must be matched against the relative path while keeping walkDir recursion enabled

package/src/webdav.js

@@ -6,7 +6,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.webdav = void 0;
 exports.releaseWebdavLock = releaseWebdavLock;
 exports.isWebdavLocked = isWebdavLocked;
-const consumers_1 = require("node:stream/consumers");
+const util_http_1 = require("./util-http");
 const vfs_1 = require("./vfs");
 const cross_1 = require("./cross");
 const stream_1 = require("stream");
@@ -315,11 +315,14 @@ const webdav = async (ctx, next) => {
                 setWebdavHeaders(true);
             return;
         }
-        const body = ctx.length || ctx.get('content-length') || ctx.get('transfer-encoding') ? await (0, consumers_1.text)(ctx.req) : '';
+        const body = await (0, util_http_1.readRequestBodyLimited)(ctx, 1024 * 1024);
+        if (!body)
+            return;
+        const bodyText = body.text;
         const token = getProvidedLockToken();
         let seconds = Number(ctx.get('timeout').split(',').find(x => /^Second-\d+$/i.test(x.trim()))?.trim().split('-', 2)[1]);
         seconds = lodash_1.default.clamp(seconds || LOCK_DEFAULT_SECONDS, 1, LOCK_MAX_SECONDS);
-        if (!body) {
+        if (!bodyText) {
             // Finder and similar clients refresh an existing lock by sending LOCK without a body
             if (!token)
                 return ctx.status = cross_1.HTTP_BAD_REQUEST;
@@ -338,7 +341,7 @@ const webdav = async (ctx, next) => {
             ctx.body = renderLockResponse(lock.token, lock.seconds);
             return;
         }
-        const lockinfo = (0, cross_1.try_)(() => xmlParser.parse(body).lockinfo);
+        const lockinfo = (0, cross_1.try_)(() => xmlParser.parse(bodyText).lockinfo);
         const scope = lodash_1.default.keys(lockinfo?.lockscope)[0];
         const type = lodash_1.default.keys(lockinfo?.locktype)[0];
         if (!scope || !type)
@@ -416,8 +419,11 @@ const webdav = async (ctx, next) => {
                 setWebdavHeaders(true);
             return;
         }
-        const body = ctx.length || ctx.get('content-length') || ctx.get('transfer-encoding') ? await (0, consumers_1.text)(ctx.req) : '';
-        const props = (0, cross_1.try_)(() => parseProppatchProps(body)) || [];
+        const body = await (0, util_http_1.readRequestBodyLimited)(ctx, 1024 * 1024);
+        if (!body)
+            return;
+        const bodyText = body.text;
+        const props = (0, cross_1.try_)(() => parseProppatchProps(bodyText)) || [];
         if (!props.length)
             return ctx.status = cross_1.HTTP_BAD_REQUEST;
         const statuses = [];