109 lines
6.2 KiB
JavaScript
109 lines
6.2 KiB
JavaScript
const express = require('express');
|
||
const Busboy = require('busboy');
|
||
const { DatabaseSync } = require('node:sqlite');
|
||
const { randomBytes, randomInt, createHmac, timingSafeEqual } = require('node:crypto');
|
||
const fs = require('node:fs');
|
||
const path = require('node:path');
|
||
const { pipeline } = require('node:stream/promises');
|
||
const ROOT = __dirname, DATA = path.join(ROOT, 'data');
|
||
const MAX = 4 * 1024 ** 3;
|
||
fs.mkdirSync(DATA, { recursive: true });
|
||
const db = new DatabaseSync(path.join(DATA, 'files.sqlite'));
|
||
db.exec('CREATE TABLE IF NOT EXISTS files (id TEXT PRIMARY KEY, name TEXT, mime TEXT, expires INTEGER)');
|
||
const app = express();
|
||
app.disable('x-powered-by');
|
||
app.set('trust proxy', 'loopback');
|
||
app.use(express.json({ limit: '4kb' }));
|
||
const password = () => fs.readFileSync(path.join(ROOT, '.passwd'), 'utf8').trim();
|
||
const digest = s => createHmac('sha256', password()).update(s).digest('hex');
|
||
function authenticated(req) {
|
||
const token = (req.headers.cookie || '').split(';').map(s => s.trim()).find(s => s.startsWith('session='))?.slice(8);
|
||
if (!token) return false;
|
||
const [expires, signature] = token.split('.');
|
||
return Number(expires) > Date.now() && signature?.length === 64 && timingSafeEqual(Buffer.from(signature), Buffer.from(digest(expires)));
|
||
}
|
||
app.post('/api/login', (req, res) => {
|
||
const given = createHmac('sha256', 'compare').update(String(req.body.password || '')).digest();
|
||
const expected = createHmac('sha256', 'compare').update(password()).digest();
|
||
if (!timingSafeEqual(given, expected)) return res.status(401).json({ error: 'Неверный пароль' });
|
||
const expires = String(Date.now() + 7 * 86400000);
|
||
res.setHeader('Set-Cookie', `session=${expires}.${digest(expires)}; HttpOnly; SameSite=Strict; Path=/; Max-Age=604800${req.secure ? '; Secure' : ''}`);
|
||
res.json({ ok: true });
|
||
});
|
||
app.get('/api/session', (req, res) => { res.set('Cache-Control', 'no-store').json({ authenticated: authenticated(req) }); });
|
||
let diskSpace = null;
|
||
async function refreshDiskSpace() {
|
||
try {
|
||
const stats = await fs.promises.statfs(DATA);
|
||
diskSpace = { free: stats.bavail * stats.bsize, total: stats.blocks * stats.bsize };
|
||
} catch (error) {
|
||
diskSpace = null;
|
||
console.error('Cannot check storage space:', error.message);
|
||
}
|
||
}
|
||
refreshDiskSpace();
|
||
setInterval(refreshDiskSpace, 60000).unref();
|
||
app.get('/api/storage', (req, res) => {
|
||
res.set('Cache-Control', 'no-store');
|
||
if (!authenticated(req)) return res.sendStatus(401);
|
||
if (!diskSpace) return res.status(503).json({ error: 'Не удалось проверить свободное место' });
|
||
res.json(diskSpace);
|
||
});
|
||
app.post('/api/upload', async (req, res) => {
|
||
if (!authenticated(req)) return res.status(401).json({ error: 'Введите пароль заново' });
|
||
if (req.headers['sec-fetch-site'] === 'cross-site') return res.sendStatus(403);
|
||
const days = Number(req.query.days);
|
||
if (!Number.isSafeInteger(days) || days < 1 || days > 3650) return res.status(400).json({ error: 'Укажите от 1 до 3650 дней' });
|
||
const alphabet = 'abcdefghijklmnopqrstuvwxyz0123456789';
|
||
let id;
|
||
do { id = Array.from({ length: 5 }, () => alphabet[randomInt(36)]).join(''); }
|
||
while (fs.existsSync(path.join(DATA, id)) || db.prepare('SELECT id FROM files WHERE id = ?').get(id));
|
||
const target = path.join(DATA, id);
|
||
fs.writeFileSync(target, '', { flag: 'wx', mode: 0o600 });
|
||
let name, mime, task, invalid = false, count = 0;
|
||
try {
|
||
const parser = Busboy({ headers: req.headers, defParamCharset: 'utf8', limits: { fileSize: MAX, files: 1, fields: 0, parts: 2 } });
|
||
parser.on('file', (_, stream, info) => {
|
||
count++;
|
||
name = path.basename(info.filename.replace(/\\/g, '/')).replace(/[\x00-\x1f\x7f]/g, '') || 'file';
|
||
mime = info.mimeType;
|
||
stream.on('limit', () => { invalid = true; });
|
||
task = pipeline(stream, fs.createWriteStream(target, { flags: 'w', mode: 0o600 }));
|
||
task.catch(() => {});
|
||
});
|
||
parser.on('fieldsLimit', () => { invalid = true; });
|
||
parser.on('partsLimit', () => { invalid = true; });
|
||
parser.on('filesLimit', () => { invalid = true; });
|
||
await pipeline(req, parser);
|
||
if (task) await task;
|
||
if (invalid || count !== 1) throw new Error('Выберите один файл до 4 ГБ');
|
||
const expires = Date.now() + days * 86400000;
|
||
db.prepare('INSERT INTO files VALUES (?, ?, ?, ?)').run(id, name, mime, expires);
|
||
res.json({ path: `/${id}`, expires });
|
||
} catch (error) {
|
||
if (task) await task.catch(() => {});
|
||
fs.rmSync(target, { force: true });
|
||
if (!res.headersSent && !res.destroyed) res.status(400).json({ error: invalid ? 'Максимальный размер 4 ГБ' : 'Не удалось загрузить файл' });
|
||
}
|
||
});
|
||
app.get('/:id', (req, res, next) => {
|
||
if (!/^[a-z0-9]{5}$/i.test(req.params.id)) return next();
|
||
const file = db.prepare('SELECT * FROM files WHERE id = ?').get(req.params.id.toLowerCase());
|
||
if (!file || file.expires <= Date.now()) return res.status(404).send('Файл не найден или срок ссылки истёк');
|
||
const inline = new Set(['image/png', 'image/jpeg', 'image/gif', 'image/webp', 'image/avif', 'image/bmp', 'image/x-icon']);
|
||
res.set({ 'Content-Type': inline.has(file.mime) ? file.mime : 'application/octet-stream', 'X-Content-Type-Options': 'nosniff', 'Cache-Control': 'no-store', 'Content-Disposition': `${inline.has(file.mime) ? 'inline' : 'attachment'}; filename="download"; filename*=UTF-8''${encodeURIComponent(file.name).replace(/['()*]/g, c => '%' + c.charCodeAt(0).toString(16))}` });
|
||
res.sendFile(path.join(DATA, file.id));
|
||
});
|
||
app.use(express.static(path.join(ROOT, 'public'), { dotfiles: 'deny' }));
|
||
function cleanup() {
|
||
for (const file of db.prepare('SELECT id FROM files WHERE expires <= ?').all(Date.now())) {
|
||
fs.rmSync(path.join(DATA, file.id), { force: true });
|
||
db.prepare('DELETE FROM files WHERE id = ?').run(file.id);
|
||
}
|
||
for (const name of fs.readdirSync(DATA)) {
|
||
if (/^(?:[a-z0-9]{5}|[a-f0-9]{48})$/.test(name) && fs.statSync(path.join(DATA, name)).mtimeMs < Date.now() - 86400000 && !db.prepare('SELECT id FROM files WHERE id = ?').get(name)) fs.rmSync(path.join(DATA, name), { force: true });
|
||
}
|
||
}
|
||
cleanup();
|
||
setInterval(cleanup, 60000).unref();
|
||
app.listen(8787, '127.0.0.1', () => console.log('Filedrop listening on 8787'));
|