tlsd 2.20.0 → 2.20.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tlsd",
-  "version": "2.20.0",
+  "version": "2.20.2",
   "description": "A server for web app prototyping with HTTPS and Websockets",
   "main": "tlsd.js",
   "bin": {

package/tlsd.js

@@ -43,6 +43,30 @@ const RATE_LIMIT_MAX_REQUESTS = toInt( process.env.RATE_LIMIT_MAX_REQUESTS ) ||
 
 let dev_mode = false;
 
+function public_origin_matches_host( origin, host ) {
+	if( ! origin ) {
+		return false;
+	}
+	const httpOrigin = "http://" + host;
+	const httpsOrigin = "https://" + host;
+	if( dev_mode ) {
+		return origin === httpOrigin || origin === httpsOrigin;
+	}
+	return origin === httpsOrigin;
+}
+
+function public_referer_matches_host( referer, host ) {
+	if( ! referer ) {
+		return false;
+	}
+	const httpRef = "http://" + host;
+	const httpsRef = "https://" + host;
+	if( dev_mode ) {
+		return referer.startsWith( httpRef ) || referer.startsWith( httpsRef );
+	}
+	return referer.startsWith( httpsRef );
+}
+
 // Connection tracking for DOS protection
 const ipConnections = new Map();
 let totalConnections = 0;
@@ -444,11 +468,9 @@ function csrf_protection( root ) {
 		let originValid = false;
 
 		if( origin ) {
-			const expectedOrigin = ( dev_mode ? "http://" : "https://" ) + host;
-			originValid = origin === expectedOrigin;
+			originValid = public_origin_matches_host( origin, host );
 		} else if( referer ) {
-			const expectedReferer = ( dev_mode ? "http://" : "https://" ) + host;
-			originValid = referer.startsWith( expectedReferer );
+			originValid = public_referer_matches_host( referer, host );
 		}
 
 		// For PUT (e.g. file uploads), cookie + Origin/Referer is sufficient.
@@ -598,63 +620,117 @@ function put_handler( req, res, next ) {
 			return;
 		}
 
-        let local_path = UPLOAD_DIR;
-        fs.mkdirSync( local_path, { recursive: true } );
-
-        // generate random hash to store file under locally
-        const hash = sha1( "" + ( Date.now() + Math.random() ) ).slice( 0, 16 );  // only use first 16 chars of the hash
-        let raw_filename = req.headers[ "X-Filename" ];
-		if( ! raw_filename ) {
-			// take the filename from the last part of the URL
-			raw_filename = req.url.split( "/" ).pop();
-			// remove any query string
-			raw_filename = raw_filename.split( "?" ).shift();
-		}
-        const sanitized_filename = sanitize_upload_filename( raw_filename );
-		const final_filename = hash + "_" + sanitized_filename;
-        local_path += "/" + final_filename;
-
-        D( "PUT: " + local_path );
-
-		const writeStream = fs.createWriteStream( local_path );
-
-		let responded = false;
-		let received_bytes = 0;
-		const abort_too_large = function( ) {
-			if( responded ) return;
-			responded = true;
-			try { req.unpipe( writeStream ); } catch( _e ) {}
-			try { writeStream.destroy(); } catch( _e ) {}
-			try { req.destroy(); } catch( _e ) {}
-			try { fs.unlink( local_path, function( ){} ); } catch( _e ) {}
-			res.writeHead( 413, { "Content-Type": "application/json" } );
-			res.write( o2j( { error: "Payload too large" } ) );
-			res.end();
-		};
+        const upload_dir = UPLOAD_DIR;
+        fs.mkdirSync( upload_dir, { recursive: true } );
+
+		// Kick off the upload, given the initial available bytes on the dest filesystem.
+		// available_bytes is re-queried every 500ms throughout the transfer so that
+		// concurrent uploads are accounted for.
+		const do_put = function( initial_available_bytes ) {
+			let available_bytes = initial_available_bytes;
+
+			// Preflight: reject immediately if Content-Length already exceeds threshold
+			if( content_length && content_length > available_bytes * 0.8 ) {
+				W( "PUT: Content-Length " + content_length + " exceeds 80% of available space (" + available_bytes + " bytes)" );
+				res.writeHead( 507, { "Content-Type": "application/json" } );
+				res.write( o2j( { error: "Insufficient storage space" } ) );
+				res.end();
+				return;
+			}
 
-		// Streaming size guard
-		req.on( "data", function( chunk ) {
-			received_bytes += chunk.length;
-			if( received_bytes > UPLOAD_MAX_BYTES ) {
-				W( "PUT: stream exceeded cap: " + received_bytes + " > " + UPLOAD_MAX_BYTES );
-				abort_too_large( );
+			// generate random hash to store file under locally
+			const hash = sha1( "" + ( Date.now() + Math.random() ) ).slice( 0, 16 );  // only use first 16 chars of the hash
+			let raw_filename = req.headers[ "X-Filename" ];
+			if( ! raw_filename ) {
+				// take the filename from the last part of the URL
+				raw_filename = req.url.split( "/" ).pop();
+				// remove any query string
+				raw_filename = raw_filename.split( "?" ).shift();
 			}
-		} );
+			const sanitized_filename = sanitize_upload_filename( raw_filename );
+			const final_filename = hash + "_" + sanitized_filename;
+			const local_path = upload_dir + "/" + final_filename;
+
+			D( "PUT: " + local_path );
+
+			const writeStream = fs.createWriteStream( local_path );
+
+			let responded = false;
+			let received_bytes = 0;
+
+			const abort_with = function( status, message, log_msg ) {
+				if( responded ) return;
+				responded = true;
+				clearInterval( disk_poll );
+				W( log_msg );
+				try { req.unpipe( writeStream ); } catch( _e ) {}
+				try { writeStream.destroy(); } catch( _e ) {}
+				try { req.destroy(); } catch( _e ) {}
+				try { fs.unlink( local_path, function( ){} ); } catch( _e ) {}
+				res.writeHead( status, { "Content-Type": "application/json" } );
+				res.write( o2j( { error: message } ) );
+				res.end();
+			};
 
-        req.pipe( writeStream );
+			// Poll available disk space every 500ms so concurrent uploads are reflected
+			const disk_poll = setInterval( function( ) {
+				fs.statfs( upload_dir, function( err, stats ) {
+					if( ! err ) {
+						available_bytes = stats.bavail * stats.bsize;
+						D( "PUT: disk poll available=" + available_bytes );
+					}
+				} );
+			}, 500 );
+
+			// Streaming size guard - checks against the latest available_bytes each chunk
+			req.on( "data", function( chunk ) {
+				received_bytes += chunk.length;
+				if( received_bytes > UPLOAD_MAX_BYTES ) {
+					abort_with( 413, "Payload too large", "PUT: stream exceeded cap: " + received_bytes + " > " + UPLOAD_MAX_BYTES );
+				} else if( received_bytes > available_bytes * 0.8 ) {
+					abort_with( 507, "Insufficient storage space", "PUT: stream exceeded 80% of available space: " + received_bytes + " > " + ( available_bytes * 0.8 ) );
+				}
+			} );
 
-		writeStream.on( "finish", ( ) => {
-			if( responded ) return;
-            I( "PUT: " + local_path );
-            res.writeHead( 200, { "Content-Type": "application/json" } );
-            res.write( o2j( { hash, filename: final_filename } ) );
-            res.end();
-        } );
+			req.pipe( writeStream );
+
+			writeStream.on( "finish", ( ) => {
+				if( responded ) return;
+				clearInterval( disk_poll );
+				I( "PUT: " + local_path );
+				res.writeHead( 200, { "Content-Type": "application/json" } );
+				res.write( o2j( { hash, filename: final_filename } ) );
+				res.end();
+			} );
+
+			writeStream.on( "error", ( error ) => {
+				if( responded ) return;
+				clearInterval( disk_poll );
+				fail( "PUT: " + local_path + " failed during stream", error.stack );
+			} );
+		};
+
+		if( typeof fs.statfs !== "function" ) {
+			E( "PUT: fs.statfs unavailable, aborting transfer" );
+			res.writeHead( 503, { "Content-Type": "application/json" } );
+			res.write( o2j( { error: "Disk space check unavailable" } ) );
+			res.end();
+			return;
+		}
+
+		fs.statfs( upload_dir, function( err, stats ) {
+			if( err ) {
+				E( "PUT: statfs failed, aborting transfer: " + err.message );
+				res.writeHead( 503, { "Content-Type": "application/json" } );
+				res.write( o2j( { error: "Disk space check failed" } ) );
+				res.end();
+				return;
+			}
+			const available_bytes = stats.bavail * stats.bsize;
+			D( "PUT: disk available=" + available_bytes );
+			do_put( available_bytes );
+		} );
 
-		writeStream.on( "error", ( error ) => {
-			if( responded ) return;
-            fail( "PUT: " + local_path + " failed during stream", error.stack );
-        } );
     } catch ( error ) {
         fail( "PUT: failed", error.stack );
     }
@@ -799,9 +875,9 @@ function ws_attach( server, msg_handler ) {
 
 		// Validate WebSocket origin matches host
 		if( origin ) {
-			const expectedOrigin = ( dev_mode ? "http://" : "https://" ) + host;
-			if( origin !== expectedOrigin ) {
-				W( "WS: Origin validation failed: " + origin + " expected: " + expectedOrigin );
+			if( ! public_origin_matches_host( origin, host ) ) {
+				const expectedHint = dev_mode ? "http(s)://" + host : "https://" + host;
+				W( "WS: Origin validation failed: " + origin + " expected: " + expectedHint );
 				activeWSConnections--;
 				totalConnections--;
 				release_ip_connection( remote_ip );