BuzzbeeSCD/openchamber
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: harden file previews and downloads

Browse Source
This commit is contained in:
Bohdan Triapitsyn
2026-06-13 01:44:03 +03:00
parent 823cefd4b5
commit ca87428216
7 changed files with 305 additions and 59 deletions
Download Patch File Download Diff File Expand all files Collapse all files
packages/web/server/lib/ui-auth/ui-auth.js
+13 -6
View File
@@ -270,14 +270,19 @@ const getUrlAuthTokenFromRequest = (req) => {
};
const getRequestPathname = (req) => {
if (typeof req?.path === 'string' && req.path) return req.path;
const rawUrl = req?.originalUrl || req?.url;
if (typeof rawUrl !== 'string' || !rawUrl) return '';
try {
return new URL(rawUrl, 'http://localhost').pathname;
} catch {
return '';
if (typeof rawUrl === 'string' && rawUrl) {
try {
return new URL(rawUrl, 'http://localhost').pathname;
} catch {
// Fall through to Express' derived path fields.
}
}
if (typeof req?.baseUrl === 'string' && req.baseUrl && typeof req?.path === 'string' && req.path) {
return `${req.baseUrl}${req.path}`.replace(/\/+/g, '/');
}
if (typeof req?.path === 'string' && req.path) return req.path;
return '';
};
const isWebSocketUpgrade = (req) => {
@@ -292,6 +297,8 @@ const isUrlAuthReadableHttpPath = (pathname) => {
|| pathname === '/api/openchamber/events'
|| pathname === '/api/notifications/stream'
|| pathname === '/api/fs/raw'
|| pathname === '/api/fs/serve'
|| pathname.startsWith('/api/fs/serve/')
|| pathname.startsWith('/api/preview/proxy/')
|| /^\/api\/terminal\/[^/]+\/stream$/.test(pathname)
|| /^\/api\/projects\/[^/]+\/icon$/.test(pathname);