fix: unit test + sanitize uploaded filename

Hexastack · Oct 18, 2024 · 0054e02 · 0054e02
1 parent c5a55cb
commit 0054e02
Show file tree

Hide file tree

Showing 5 changed files with 27 additions and 8 deletions.
diff --git a/api/package-lock.json b/api/package-lock.json
diff --git a/api/package.json b/api/package.json
@@ -72,6 +72,7 @@
     "patch-package": "^8.0.0",
     "reflect-metadata": "^0.1.13",
     "rxjs": "^7.8.1",
+    "sanitize-filename": "^1.6.3",
     "slug": "^8.2.2",
     "ts-migrate-mongoose": "^3.8.4",
     "uuid": "^9.0.1"

diff --git a/api/src/channel/lib/Handler.ts b/api/src/channel/lib/Handler.ts
@@ -27,8 +27,6 @@ import { ChannelSetting } from '../types';
 
 import EventWrapper from './EventWrapper';
 
-import EventWrapper from './EventWrapper';
-
 @Injectable()
 export default abstract class ChannelHandler<N extends string = string> {
   private readonly name: N;

diff --git a/api/src/chat/services/block.service.spec.ts b/api/src/chat/services/block.service.spec.ts
@@ -66,9 +66,6 @@ import { FileType } from '../schemas/types/attachment';
 import { Context } from '../schemas/types/context';
 import { PayloadType, StdOutgoingListMessage } from '../schemas/types/message';
 import { SubscriberContext } from '../schemas/types/subscriberContext';
-import { CategoryRepository } from './../repositories/category.repository';
-import { BlockService } from './block.service';
-import { CategoryService } from './category.service';
 
 import { CategoryRepository } from './../repositories/category.repository';
 import { BlockService } from './block.service';

diff --git a/api/src/extensions/channels/offline/base-web-channel.ts b/api/src/extensions/channels/offline/base-web-channel.ts
@@ -13,6 +13,7 @@ import { Injectable } from '@nestjs/common';
 import { EventEmitter2, OnEvent } from '@nestjs/event-emitter';
 import { Request, Response } from 'express';
 import multer, { diskStorage } from 'multer';
+import sanitize from 'sanitize-filename';
 import { Socket } from 'socket.io';
 import { v4 as uuidv4 } from 'uuid';
 
@@ -684,9 +685,9 @@ export default class BaseWebChannelHandler<
 
     // Store file as attachment
     const dirPath = path.join(config.parameters.uploadDir);
-    const filename = `${req.session.offline.profile.id}_${+new Date()}_${
-      upload.name
-    }`;
+    const filename = sanitize(
+      `${req.session.offline.profile.id}_${+new Date()}_${upload.name}`,
+    );
     if ('isSocket' in req && req.isSocket) {
       // @TODO : test this
       try {