instbyte 1.9.3 → 1.10.0

package/server/server.js

@@ -67,7 +67,14 @@ app.use((req, res, next) => {
 });
 app.use(cookieParser());
 app.use(requireAuth);
-app.use("/uploads", express.static(UPLOADS_DIR));
+app.use("/uploads", (req, res, next) => {
+  const ext = req.path.split('.').pop().toLowerCase();
+  if (FORCE_DOWNLOAD_EXTENSIONS.has(ext)) {
+    const filename = path.basename(req.path);
+    res.setHeader('Content-Disposition', `attachment; filename="${filename}"`);
+  }
+  next();
+}, express.static(UPLOADS_DIR));
 app.use(express.static(CLIENT_DIR));
 
 const storage = multer.diskStorage({
@@ -75,7 +82,8 @@ const storage = multer.diskStorage({
     cb(null, UPLOADS_DIR);
   },
   filename: (req, file, cb) => {
-    const unique = Date.now() + "-" + file.originalname;
+    const safe = sanitiseFilename(file.originalname);
+    const unique = Date.now() + "-" + safe;
     cb(null, unique);
   },
 });
@@ -85,6 +93,64 @@ const upload = multer({
   limits: { fileSize: config.storage.maxFileSize },
 });
 
+// FILE SECURITY
+
+// Extensions that must never be rendered inline by a browser.
+// These are served with Content-Disposition: attachment always.
+const FORCE_DOWNLOAD_EXTENSIONS = new Set([
+  'svg', 'html', 'htm', 'xml', 'xhtml', 'js', 'mjs', 'php',
+  'sh', 'bash', 'py', 'rb', 'pl', 'ps1', 'bat', 'cmd', 'exe',
+  'dll', 'jar', 'vbs', 'ws', 'hta'
+]);
+
+// Magic number signatures — first bytes that identify real file types.
+// Key = expected extension group, value = array of valid byte signatures.
+const MAGIC_NUMBERS = {
+  jpg: [Buffer.from([0xFF, 0xD8, 0xFF])],
+  png: [Buffer.from([0x89, 0x50, 0x4E, 0x47])],
+  gif: [Buffer.from([0x47, 0x49, 0x46, 0x38])],
+  webp: [Buffer.from([0x52, 0x49, 0x46, 0x46])],
+  pdf: [Buffer.from([0x25, 0x50, 0x44, 0x46])],
+  zip: [Buffer.from([0x50, 0x4B, 0x03, 0x04]), Buffer.from([0x50, 0x4B, 0x05, 0x06])],
+  mp4: [Buffer.from([0x00, 0x00, 0x00, 0x18]), Buffer.from([0x00, 0x00, 0x00, 0x20])],
+};
+
+// Extension → magic group mapping
+const EXT_TO_MAGIC = {
+  jpg: 'jpg', jpeg: 'jpg',
+  png: 'png',
+  gif: 'gif',
+  webp: 'webp',
+  pdf: 'pdf',
+  zip: 'zip',
+  mp4: 'mp4',
+};
+
+function sanitiseFilename(name) {
+  return name
+    .replace(/[/\\?%*:|"<>\x00]/g, '_')  // strip path separators and dangerous chars
+    .replace(/\.{2,}/g, '.')              // collapse .. sequences
+    .trim()
+    .slice(0, 255);                        // max filename length
+}
+
+function checkMagicNumber(filePath, ext) {
+  const group = EXT_TO_MAGIC[ext.toLowerCase()];
+  if (!group) return true; // no check defined for this type — allow through
+
+  const signatures = MAGIC_NUMBERS[group];
+  if (!signatures) return true;
+
+  try {
+    const fd = fs.openSync(filePath, 'r');
+    const buf = Buffer.alloc(8);
+    fs.readSync(fd, buf, 0, 8, 0);
+    fs.closeSync(fd);
+    return signatures.some(sig => buf.slice(0, sig.length).equals(sig));
+  } catch (e) {
+    return false; // can't read → reject
+  }
+}
 
 function hexToHsl(hex) {
   let r = parseInt(hex.slice(1, 3), 16) / 255;
@@ -284,6 +350,27 @@ const loginLimiter = rateLimit({
   message: { error: "Too many attempts, try again later" }
 });
 
+const dropLimiter = rateLimit({
+  windowMs: 5 * 60 * 1000,
+  max: 60,
+  skip: () => process.env.NODE_ENV === 'test',
+  message: { error: "Too many requests,  try again later" }
+});
+
+const channelLimiter = rateLimit({
+  windowMs: 5 * 60 * 1000,
+  max: 20,
+  skip: () => process.env.NODE_ENV === 'test',
+  message: { error: "Too many requests,  try again later" }
+});
+
+const broadcastLimiter = rateLimit({
+  windowMs: 60 * 1000,
+  max: 5,
+  skip: () => process.env.NODE_ENV === 'test',
+  message: { error: "Too many broadcast attempts, slow down" }
+});
+
 /* LOGIN POST */
 app.post("/login", loginLimiter, (req, res) => {
   if (!config.auth.passphrase) return res.redirect("/");
@@ -313,11 +400,19 @@ app.post("/logout", (req, res) => {
 
 
 /* FILE UPLOAD */
-app.post("/upload", upload.single("file"), (req, res) => {
+app.post("/upload", dropLimiter, upload.single("file"), (req, res) => {
   if (!req.file) {
     return res.status(400).json({ error: "No file received" });
   }
 
+  // Magic number check — verify file content matches its extension
+  const ext = req.file.originalname.split('.').pop().toLowerCase();
+  const filePath = path.join(UPLOADS_DIR, req.file.filename);
+  if (!checkMagicNumber(filePath, ext)) {
+    fs.unlinkSync(filePath); // delete the suspicious file immediately
+    return res.status(400).json({ error: "File content does not match its extension" });
+  }
+
   const { channel, uploader } = req.body;
 
   const item = {
@@ -359,7 +454,7 @@ app.use((err, req, res, next) => {
 });
 
 /* TEXT/LINK */
-app.post("/text", (req, res) => {
+app.post("/text", dropLimiter, (req, res) => {
   const { content, channel, uploader } = req.body;
 
   const item = {
@@ -496,7 +591,7 @@ app.get("/channels", (req, res) => {
 });
 
 /* ADD CHANNEL */
-app.post("/channels", (req, res) => {
+app.post("/channels", channelLimiter, (req, res) => {
 
   const { name } = req.body;
   if (!name) return res.status(400).json({ error: "Name required" });
@@ -684,6 +779,37 @@ app.get("/branding", (req, res) => {
   });
 });
 
+/* PWA MANIFEST */
+app.get("/manifest.json", (req, res) => {
+  const b = config.branding;
+  const name = b.appName || "Instbyte";
+  const color = b.primaryColor || "#111827";
+
+  res.json({
+    name,
+    short_name: name.length > 12 ? name.slice(0, 12) : name,
+    description: "Real-time LAN sharing — no cloud, no accounts",
+    start_url: "/",
+    display: "standalone",
+    background_color: "#f3f4f6",
+    theme_color: color,
+    icons: [
+      {
+        src: "/logo-dynamic.png",
+        sizes: "192x192",
+        type: "image/png",
+        purpose: "any maskable"
+      },
+      {
+        src: "/logo-dynamic.png",
+        sizes: "512x512",
+        type: "image/png",
+        purpose: "any maskable"
+      }
+    ]
+  });
+});
+
 /* HEALTH MONITOR */
 app.get("/health", (req, res) => {
   res.json({
@@ -693,6 +819,62 @@ app.get("/health", (req, res) => {
   });
 });
 
+/*   BROADCAST*/
+/* GET /broadcast/status — returns current broadcast or null */
+app.get("/broadcast/status", (req, res) => {
+  if (!currentBroadcast) return res.json({ live: false });
+  res.json({
+    live: true,
+    uploader: currentBroadcast.uploader,
+    channel: currentBroadcast.channel,
+    startedAt: currentBroadcast.startedAt
+  });
+});
+
+/* POST /broadcast/start */
+app.post("/broadcast/start", broadcastLimiter, (req, res) => {
+
+  if (currentBroadcast) {
+    return res.status(409).json({
+      error: "Broadcast already in progress",
+      uploader: currentBroadcast.uploader
+    });
+  }
+
+  const { uploader, channel, socketId } = req.body;
+  if (!uploader || !channel) {
+    return res.status(400).json({ error: "uploader and channel required" });
+  }
+
+  currentBroadcast = {
+    uploader,
+    channel,
+    startedAt: Date.now(),
+    lastFrame: null,
+    socketId
+  };
+
+  io.emit("broadcast-started", {
+    uploader: currentBroadcast.uploader,
+    channel: currentBroadcast.channel,
+    startedAt: currentBroadcast.startedAt
+  });
+
+  console.log(`Broadcast started by ${uploader}`);
+  res.json({ ok: true, ...currentBroadcast });
+});
+
+/* POST /broadcast/end */
+app.post("/broadcast/end", (req, res) => {
+  if (!currentBroadcast) return res.status(400).json({ error: "No broadcast in progress" });
+
+  const uploader = currentBroadcast.uploader;
+  currentBroadcast = null;
+
+  io.emit("broadcast-ended", { uploader });
+  console.log(`Broadcast ended by ${uploader}`);
+  res.json({ ok: true });
+});
 
 /* FAVICON */
 app.get("/favicon-dynamic.png", async (req, res) => {
@@ -748,6 +930,9 @@ app.get("/logo-dynamic.png", (req, res) => {
 // resets on server restart, no DB needed
 const seenBy = new Map();
 
+// Broadcast state — null when IDLE, populated when LIVE
+let currentBroadcast = null;
+
 let connectedUsers = 0;
 
 io.on("connection", (socket) => {
@@ -770,10 +955,56 @@ io.on("connection", (socket) => {
     io.emit("seen-update", { id, count });
   });
 
+  // WebRTC — viewer joins, notify broadcaster to initiate peer connection
+  socket.on("broadcast-join", () => {
+    if (!currentBroadcast) return;
+    // tell broadcaster a new viewer has joined, pass viewer's socket id
+    const broadcasterSocket = io.sockets.sockets.get(currentBroadcast.socketId);
+    if (broadcasterSocket) {
+      broadcasterSocket.emit("webrtc-viewer-joined", { viewerId: socket.id });
+    }
+  });
+
+  // WebRTC — broadcaster sends offer to a specific viewer
+  socket.on("webrtc-offer", ({ offer, viewerId }) => {
+    const viewerSocket = io.sockets.sockets.get(viewerId);
+    if (viewerSocket) {
+      viewerSocket.emit("webrtc-offer", { offer, broadcasterId: socket.id });
+    }
+  });
+
+  // WebRTC — viewer sends answer back to broadcaster
+  socket.on("webrtc-answer", ({ answer, broadcasterId }) => {
+    const broadcasterSocket = io.sockets.sockets.get(broadcasterId);
+    if (broadcasterSocket) {
+      broadcasterSocket.emit("webrtc-answer", { answer, viewerId: socket.id });
+    }
+  });
+
+  // WebRTC — ICE candidate exchange, both directions
+  socket.on("webrtc-ice", ({ candidate, targetId }) => {
+    const targetSocket = io.sockets.sockets.get(targetId);
+    if (targetSocket) {
+      targetSocket.emit("webrtc-ice", { candidate, fromId: socket.id });
+    }
+  });
+
+  // Broadcast — raise hand, relay to broadcaster
+  socket.on("broadcast-reaction", ({ from }) => {
+    if (!currentBroadcast) return;
+    io.emit("broadcast-reaction-received", { from });
+  });
+
   socket.on("disconnect", () => {
     connectedUsers--;
     console.log(username + " disconnected | total:", connectedUsers);
     io.emit("user-count", connectedUsers);
+
+    if (currentBroadcast && currentBroadcast.socketId === socket.id) {
+      currentBroadcast = null;
+      io.emit("broadcast-ended");
+      console.log("Broadcast ended — broadcaster disconnected");
+    }
   });
 });
 
@@ -822,8 +1053,7 @@ const PREFERRED = parseInt(process.env.PORT) || config.server.port;
 const localIP = getLocalIP();
 
 let PORT;
-
-if (require.main === module) {
+if (process.env.INSTBYTE_BOOT === '1') {
   findFreePort(PREFERRED).then(p => {
     PORT = p;
     server.listen(PORT, () => {