External/SnapOtter
1
0
Fork 0
mirror of https://github.com/snapotter-hq/SnapOtter.git synced 2026-08-03 07:46:42 +02:00
Code Issues Packages Projects Releases Wiki Activity

fix: harden all AI tools against proxy timeouts and filename attacks

Browse Source 
Convert all 9 AI tool routes (colorize, restore-photo, remove-background,
enhance-faces, blur-faces, red-eye-removal, erase-object, noise-removal,
upscale) to async 202 processing so none are vulnerable to proxy
connection timeouts.

Also fixes:
- Replace basename() with sanitizeFilename() in all AI tool routes
  (prevents double-extension attacks and adds length truncation)
- Add UUID format validation for clientJobId field
- Fix missing filename sanitization in noise-removal (was using raw
  user-supplied filename with zero sanitization)
- Remove em dash from error message in use-tool-processor
This commit is contained in:
SnapOtter
2026-05-01 00:11:03 +08:00
parent 4900d8a4fe
commit d12b1c0fc6
18 changed files with 818 additions and 628 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/integration/blur-faces.test.ts
+15 -15
View File
@@ -33,7 +33,7 @@ afterAll(async () => {
describe("blur-faces", () => {
// ── Processing (sidecar-dependent) ────────────────────────────────
it("responds to the route (200 or 501)", async () => {
it("responds to the route (202 or 501)", async () => {
const { body, contentType } = createMultipartPayload([
{ name: "file", filename: "test.png", contentType: "image/png", content: PNG },
{ name: "settings", content: JSON.stringify({}) },
@@ -46,10 +46,10 @@ describe("blur-faces", () => {
body,
});
expect([200, 501]).toContain(res.statusCode);
expect([202, 501]).toContain(res.statusCode);
}, 60_000);
it("processes with default settings (200 or 501)", async () => {
it("processes with default settings (202 or 501)", async () => {
const { body, contentType } = createMultipartPayload([
{ name: "file", filename: "test.png", contentType: "image/png", content: PNG },
]);
@@ -61,15 +61,15 @@ describe("blur-faces", () => {
body,
});
expect([200, 501]).toContain(res.statusCode);
if (res.statusCode === 200) {
const json = JSON.parse(res.body);
expect(json.jobId).toBeDefined();
expect(json.downloadUrl).toBeDefined();
expect([202, 501]).toContain(res.statusCode);
if (res.statusCode === 202) {
const result = JSON.parse(res.body);
expect(result.jobId).toBeDefined();
expect(result.async).toBe(true);
}
}, 60_000);
it("accepts explicit blurRadius and sensitivity (200 or 501)", async () => {
it("accepts explicit blurRadius and sensitivity (202 or 501)", async () => {
const { body, contentType } = createMultipartPayload([
{ name: "file", filename: "test.png", contentType: "image/png", content: PNG },
{
@@ -85,10 +85,10 @@ describe("blur-faces", () => {
body,
});
expect([200, 501]).toContain(res.statusCode);
expect([202, 501]).toContain(res.statusCode);
}, 60_000);
it("accepts minimum settings values (200 or 501)", async () => {
it("accepts minimum settings values (202 or 501)", async () => {
const { body, contentType } = createMultipartPayload([
{ name: "file", filename: "test.png", contentType: "image/png", content: PNG },
{
@@ -104,10 +104,10 @@ describe("blur-faces", () => {
body,
});
expect([200, 501]).toContain(res.statusCode);
expect([202, 501]).toContain(res.statusCode);
}, 60_000);
it("handles HEIC input (200 or 501)", async () => {
it("handles HEIC input (202 or 501)", async () => {
const { body, contentType } = createMultipartPayload([
{ name: "file", filename: "photo.heic", contentType: "image/heic", content: HEIC },
{ name: "settings", content: JSON.stringify({}) },
@@ -120,7 +120,7 @@ describe("blur-faces", () => {
body,
});
expect([200, 501]).toContain(res.statusCode);
expect([202, 501]).toContain(res.statusCode);
}, 60_000);
it("handles 1x1 pixel input (200, 422, or 501)", async () => {
@@ -137,7 +137,7 @@ describe("blur-faces", () => {
});
// 200 = processed, 422 = processing error, 501 = sidecar not installed
expect([200, 422, 501]).toContain(res.statusCode);
expect([202, 422, 501]).toContain(res.statusCode);
}, 60_000);
// ── Validation (always testable) ──────────────────────────────────