mirror of
https://github.com/Crosstalk-Solutions/project-nomad.git
synced 2026-03-28 11:39:26 +01:00
Fixes 4 high-severity findings from a comprehensive security audit: 1. Path traversal on ZIM file delete — resolve()+startsWith() containment 2. Path traversal on Map file delete — same pattern 3. Path traversal on docs read — same pattern (already used in rag_service) 4. SSRF on download endpoints — block private/internal IPs, require TLD Also adds assertNotPrivateUrl() to content update endpoints. Full audit report attached as admin/docs/security-audit-v1.md. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
89 lines
2.6 KiB
TypeScript
89 lines
2.6 KiB
TypeScript
import { ZimService } from '#services/zim_service'
|
|
import {
|
|
assertNotPrivateUrl,
|
|
downloadCategoryTierValidator,
|
|
filenameParamValidator,
|
|
remoteDownloadWithMetadataValidator,
|
|
selectWikipediaValidator,
|
|
} from '#validators/common'
|
|
import { listRemoteZimValidator } from '#validators/zim'
|
|
import { inject } from '@adonisjs/core'
|
|
import type { HttpContext } from '@adonisjs/core/http'
|
|
|
|
@inject()
|
|
export default class ZimController {
|
|
constructor(private zimService: ZimService) {}
|
|
|
|
async list({}: HttpContext) {
|
|
return await this.zimService.list()
|
|
}
|
|
|
|
async listRemote({ request }: HttpContext) {
|
|
const payload = await request.validateUsing(listRemoteZimValidator)
|
|
const { start = 0, count = 12, query } = payload
|
|
return await this.zimService.listRemote({ start, count, query })
|
|
}
|
|
|
|
async downloadRemote({ request }: HttpContext) {
|
|
const payload = await request.validateUsing(remoteDownloadWithMetadataValidator)
|
|
assertNotPrivateUrl(payload.url)
|
|
const { filename, jobId } = await this.zimService.downloadRemote(payload.url)
|
|
|
|
return {
|
|
message: 'Download started successfully',
|
|
filename,
|
|
jobId,
|
|
url: payload.url,
|
|
}
|
|
}
|
|
|
|
async listCuratedCategories({}: HttpContext) {
|
|
return await this.zimService.listCuratedCategories()
|
|
}
|
|
|
|
async downloadCategoryTier({ request }: HttpContext) {
|
|
const payload = await request.validateUsing(downloadCategoryTierValidator)
|
|
const resources = await this.zimService.downloadCategoryTier(
|
|
payload.categorySlug,
|
|
payload.tierSlug
|
|
)
|
|
|
|
return {
|
|
message: 'Download started successfully',
|
|
categorySlug: payload.categorySlug,
|
|
tierSlug: payload.tierSlug,
|
|
resources,
|
|
}
|
|
}
|
|
|
|
async delete({ request, response }: HttpContext) {
|
|
const payload = await request.validateUsing(filenameParamValidator)
|
|
|
|
try {
|
|
await this.zimService.delete(payload.params.filename)
|
|
} catch (error) {
|
|
if (error.message === 'not_found') {
|
|
return response.status(404).send({
|
|
message: `ZIM file with key ${payload.params.filename} not found`,
|
|
})
|
|
}
|
|
throw error // Re-throw any other errors and let the global error handler catch
|
|
}
|
|
|
|
return {
|
|
message: 'ZIM file deleted successfully',
|
|
}
|
|
}
|
|
|
|
// Wikipedia selector endpoints
|
|
|
|
async getWikipediaState({}: HttpContext) {
|
|
return this.zimService.getWikipediaState()
|
|
}
|
|
|
|
async selectWikipedia({ request }: HttpContext) {
|
|
const payload = await request.validateUsing(selectWikipediaValidator)
|
|
return this.zimService.selectWikipedia(payload.optionId)
|
|
}
|
|
}
|