01d4832edb
POST /api/v1/uploads minted an upload key from caller input with no ownership check, no content-type allowlist, and the raw filename interpolated into the S3 key. - Ownership: a caller may only mint upload URLs for a route/activity they own, enforced via the branded loadOwnedRoute/loadOwnedActivity (404 on miss, no existence leak). Closes writing into another user's resource key-space. - Content type: the request schema now constrains contentType to an image/gpx allowlist, so active content (HTML/SVG/JS) that would execute if served inline is rejected at the request boundary. - Filename: sanitizeUploadFilename() reduces the client filename to a safe basename (charset-restricted, no path components, no leading dots, length-bounded) before it becomes part of the key. Tests: schema allow/deny + filename sanitization in @trails-cool/api; handler tests covering owned-success, not-owner 404, disallowed content-type, and the route-vs-activity ownership branch. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
45 lines
1.4 KiB
TypeScript
45 lines
1.4 KiB
TypeScript
import { z } from "zod";
|
|
|
|
/**
|
|
* Content types accepted for uploads. Constrained so a caller can't
|
|
* stash active content (HTML/SVG/JS) that would execute if the object
|
|
* were ever served inline. Keep in sync with what the upload UI sends.
|
|
*/
|
|
export const ALLOWED_UPLOAD_CONTENT_TYPES = [
|
|
"image/jpeg",
|
|
"image/png",
|
|
"image/webp",
|
|
"image/gif",
|
|
"application/gpx+xml",
|
|
] as const;
|
|
|
|
export const PresignedUploadRequestSchema = z.object({
|
|
filename: z.string().min(1).max(255),
|
|
contentType: z.enum(ALLOWED_UPLOAD_CONTENT_TYPES),
|
|
resourceType: z.enum(["route", "activity"]),
|
|
resourceId: z.uuid(),
|
|
});
|
|
|
|
/**
|
|
* Reduce a client-supplied filename to a safe S3 object-key segment:
|
|
* basename only (drop any path), restrict to a conservative charset,
|
|
* collapse runs, strip leading dots, and bound the length. Never empty.
|
|
*/
|
|
export function sanitizeUploadFilename(filename: string): string {
|
|
const base = filename.split(/[/\\]/).pop() ?? "";
|
|
const cleaned = base
|
|
.replace(/[^A-Za-z0-9._-]/g, "_")
|
|
.replace(/_{2,}/g, "_")
|
|
.replace(/^\.+/, "")
|
|
.slice(0, 128);
|
|
return cleaned.length > 0 ? cleaned : "upload";
|
|
}
|
|
|
|
export const PresignedUploadResponseSchema = z.object({
|
|
uploadUrl: z.url(),
|
|
storageKey: z.string(),
|
|
expiresAt: z.iso.datetime(),
|
|
});
|
|
|
|
export type PresignedUploadRequest = z.infer<typeof PresignedUploadRequestSchema>;
|
|
export type PresignedUploadResponse = z.infer<typeof PresignedUploadResponseSchema>;
|