External/SnapOtter
1
0
Fork 0
mirror of https://github.com/snapotter-hq/SnapOtter.git synced 2026-08-03 07:46:42 +02:00
Code Issues Packages Projects Releases Wiki Activity

fix: harden all AI tools against proxy timeouts and filename attacks

Browse Source 
Convert all 9 AI tool routes (colorize, restore-photo, remove-background,
enhance-faces, blur-faces, red-eye-removal, erase-object, noise-removal,
upscale) to async 202 processing so none are vulnerable to proxy
connection timeouts.

Also fixes:
- Replace basename() with sanitizeFilename() in all AI tool routes
  (prevents double-extension attacks and adds length truncation)
- Add UUID format validation for clientJobId field
- Fix missing filename sanitization in noise-removal (was using raw
  user-supplied filename with zero sanitization)
- Remove em dash from error message in use-tool-processor
This commit is contained in:
SnapOtter
2026-05-01 00:11:03 +08:00
parent 4900d8a4fe
commit d12b1c0fc6
18 changed files with 818 additions and 628 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/integration/noise-removal.test.ts
+19 -20
View File
@@ -33,7 +33,7 @@ afterAll(async () => {
describe("noise-removal", () => {
// ── Processing (sidecar-dependent) ────────────────────────────────
it("responds to the route (200 or 501)", async () => {
it("responds to the route (202 or 501)", async () => {
const { body, contentType } = createMultipartPayload([
{ name: "file", filename: "test.png", contentType: "image/png", content: PNG },
{ name: "settings", content: JSON.stringify({}) },
@@ -46,10 +46,10 @@ describe("noise-removal", () => {
body,
});
expect([200, 501]).toContain(res.statusCode);
expect([202, 501]).toContain(res.statusCode);
}, 60_000);
it("processes with default settings (200 or 501)", async () => {
it("processes with default settings (202 or 501)", async () => {
const { body, contentType } = createMultipartPayload([
{ name: "file", filename: "test.png", contentType: "image/png", content: PNG },
]);
@@ -61,16 +61,15 @@ describe("noise-removal", () => {
body,
});
expect([200, 501]).toContain(res.statusCode);
if (res.statusCode === 200) {
const json = JSON.parse(res.body);
expect(json.jobId).toBeDefined();
expect(json.downloadUrl).toBeDefined();
expect(json.processedSize).toBeGreaterThan(0);
expect([202, 501]).toContain(res.statusCode);
if (res.statusCode === 202) {
const result = JSON.parse(res.body);
expect(result.jobId).toBeDefined();
expect(result.async).toBe(true);
}
}, 60_000);
it("accepts tier=quick (200 or 501)", async () => {
it("accepts tier=quick (202 or 501)", async () => {
const { body, contentType } = createMultipartPayload([
{ name: "file", filename: "test.png", contentType: "image/png", content: PNG },
{
@@ -86,10 +85,10 @@ describe("noise-removal", () => {
body,
});
expect([200, 501]).toContain(res.statusCode);
expect([202, 501]).toContain(res.statusCode);
}, 60_000);
it("accepts tier=quality with explicit strength (200 or 501)", async () => {
it("accepts tier=quality with explicit strength (202 or 501)", async () => {
const { body, contentType } = createMultipartPayload([
{ name: "file", filename: "test.png", contentType: "image/png", content: PNG },
{
@@ -105,10 +104,10 @@ describe("noise-removal", () => {
body,
});
expect([200, 501]).toContain(res.statusCode);
expect([202, 501]).toContain(res.statusCode);
}, 60_000);
it("accepts tier=maximum (200 or 501)", async () => {
it("accepts tier=maximum (202 or 501)", async () => {
const { body, contentType } = createMultipartPayload([
{ name: "file", filename: "test.png", contentType: "image/png", content: PNG },
{
@@ -124,10 +123,10 @@ describe("noise-removal", () => {
body,
});
expect([200, 501]).toContain(res.statusCode);
expect([202, 501]).toContain(res.statusCode);
}, 60_000);
it("accepts all explicit settings (200 or 501)", async () => {
it("accepts all explicit settings (202 or 501)", async () => {
const { body, contentType } = createMultipartPayload([
{ name: "file", filename: "test.png", contentType: "image/png", content: PNG },
{
@@ -150,10 +149,10 @@ describe("noise-removal", () => {
body,
});
expect([200, 501]).toContain(res.statusCode);
expect([202, 501]).toContain(res.statusCode);
}, 60_000);
it("handles HEIC input (200 or 501)", async () => {
it("handles HEIC input (202 or 501)", async () => {
const { body, contentType } = createMultipartPayload([
{ name: "file", filename: "photo.heic", contentType: "image/heic", content: HEIC },
{ name: "settings", content: JSON.stringify({}) },
@@ -166,7 +165,7 @@ describe("noise-removal", () => {
body,
});
expect([200, 501]).toContain(res.statusCode);
expect([202, 501]).toContain(res.statusCode);
}, 60_000);
it("handles 1x1 pixel input (200, 422, or 501)", async () => {
@@ -182,7 +181,7 @@ describe("noise-removal", () => {
body,
});
expect([200, 422, 501]).toContain(res.statusCode);
expect([202, 422, 501]).toContain(res.statusCode);
}, 60_000);
// ── Validation (always testable) ──────────────────────────────────