peer-term 1.3.0 → 1.3.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "peer-term",
-  "version": "1.3.0",
+  "version": "1.3.1",
   "license": "MIT",
   "description": "Share your terminal instantly using a 6-digit code. Encrypted. No config.",
   "repository": {

package/src/index.js

@@ -99,6 +99,10 @@ const RELAY_URLS = argv.relay
 const HEARTBEAT_INTERVAL_MS = 5000;
 const MAX_MISSED_PINGS = 2;
 
+const UPLOAD_MAX_FILE_SIZE = 100 * 1024 * 1024; // 100 MB max
+const UPLOAD_MAX_CHUNKS_PER_FILE = Math.ceil(UPLOAD_MAX_FILE_SIZE / 16384);
+const UPLOAD_MAX_CONCURRENT = 3;
+
 // ─── Path Resolution ─────────────────────────────────────────────────────────
 
 function expandTilde(inputPath) {
@@ -605,6 +609,17 @@ class Session {
                 return;
               }
 
+              // Check if decrypted message is a file transfer message (file-start, file-chunk, file-end)
+              try {
+                const parsedMsg = JSON.parse(plaintext);
+                if (parsedMsg && typeof parsedMsg.type === 'string' && parsedMsg.type.startsWith('file-')) {
+                  this._handleFileMessage(parsedMsg);
+                  return;
+                }
+              } catch {
+                // Not JSON — normal keystroke data, fall through
+              }
+
               // Normal keystroke — drop if read-only
               if (this.readOnly) return;
               this.ptyProcess.write(plaintext);
@@ -834,15 +849,32 @@ class Session {
     switch (msg.type) {
       case 'file-start': {
         // Validate required fields
-        if (!msg.id || !msg.name || !msg.size || !msg.totalChunks) {
+        if (!msg.id || !msg.name || msg.size === undefined || msg.totalChunks === undefined) {
           this._sendFileError(msg.id, 'Invalid file-start message');
           return;
         }
+
+        if (msg.size > UPLOAD_MAX_FILE_SIZE) {
+          this._sendFileError(msg.id, `File exceeds maximum size of ${UPLOAD_MAX_FILE_SIZE / 1024 / 1024}MB`);
+          return;
+        }
+
+        if (msg.totalChunks > UPLOAD_MAX_CHUNKS_PER_FILE) {
+          this._sendFileError(msg.id, 'File requires too many chunks');
+          return;
+        }
+
+        if (Object.keys(this._incomingFiles).length >= UPLOAD_MAX_CONCURRENT) {
+          this._sendFileError(msg.id, 'Too many concurrent uploads');
+          return;
+        }
+
         this.log(`File upload started: "${msg.name}" (${msg.size} bytes, ${msg.totalChunks} chunks)`);
         this._incomingFiles[msg.id] = {
           name: msg.name,
           size: msg.size,
           totalChunks: msg.totalChunks,
+          receivedSize: 0,
           chunks: new Map(),
         };
         break;
@@ -853,8 +885,23 @@ class Session {
           this._sendFileError(msg.id, 'Unknown transfer ID');
           return;
         }
-        // data is base64-encoded raw bytes
-        transfer.chunks.set(msg.index, Buffer.from(msg.data, 'base64'));
+
+        const chunkData = Buffer.from(msg.data, 'base64');
+        
+        if (transfer.chunks.size >= transfer.totalChunks) {
+          this._sendFileError(msg.id, 'Too many chunks received');
+          delete this._incomingFiles[msg.id];
+          return;
+        }
+
+        if (transfer.receivedSize + chunkData.length > transfer.size) {
+          this._sendFileError(msg.id, 'Received size exceeds declared size');
+          delete this._incomingFiles[msg.id];
+          return;
+        }
+
+        transfer.chunks.set(msg.index, chunkData);
+        transfer.receivedSize += chunkData.length;
         this.logDebug(`File chunk ${msg.index + 1}/${transfer.totalChunks} received for "${transfer.name}"`);
         break;
       }
@@ -896,7 +943,17 @@ class Session {
     // Determine save path: ~/peerterm-uploads/<filename>
     const homeDir = os.homedir();
     const uploadDir = path.join(homeDir, 'peerterm-uploads');
-    const savePath = path.join(uploadDir, transfer.name);
+    // Sanitize filename to prevent path traversal (e.g., "../../../etc/passwd")
+    const baseName = path.basename(transfer.name);
+    if (!baseName || baseName === '.' || baseName === '..') {
+      this._sendFileError(id, 'Invalid filename');
+      delete this._incomingFiles[id];
+      return;
+    }
+    const savePath = path.join(uploadDir, baseName);
+
+
+
 
     try {
       await fs.promises.mkdir(uploadDir, { recursive: true });
@@ -1272,6 +1329,17 @@ class Session {
               return;
             }
 
+            // Check if decrypted message is a file transfer message
+            try {
+              const parsedMsg = JSON.parse(plaintext);
+              if (parsedMsg && typeof parsedMsg.type === 'string' && parsedMsg.type.startsWith('file-')) {
+                this._handleFileMessage(parsedMsg);
+                return;
+              }
+            } catch {
+              // Not JSON — normal keystroke data, fall through
+            }
+
             if (this.readOnly) return;
             this.ptyProcess.write(plaintext);
           } catch (err) {