External/SnapOtter
1
0
Fork 0
mirror of https://github.com/snapotter-hq/SnapOtter.git synced 2026-08-03 07:46:42 +02:00
Code Issues Packages Projects Releases Wiki Activity

fix: harden all AI tools against proxy timeouts and filename attacks

Browse Source 
Convert all 9 AI tool routes (colorize, restore-photo, remove-background,
enhance-faces, blur-faces, red-eye-removal, erase-object, noise-removal,
upscale) to async 202 processing so none are vulnerable to proxy
connection timeouts.

Also fixes:
- Replace basename() with sanitizeFilename() in all AI tool routes
  (prevents double-extension attacks and adds length truncation)
- Add UUID format validation for clientJobId field
- Fix missing filename sanitization in noise-removal (was using raw
  user-supplied filename with zero sanitization)
- Remove em dash from error message in use-tool-processor
This commit is contained in:
SnapOtter
2026-05-01 00:11:03 +08:00
parent 4900d8a4fe
commit d12b1c0fc6
18 changed files with 818 additions and 628 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/integration/red-eye-removal.test.ts
+10 -10
View File
@@ -51,7 +51,7 @@ describe("Red Eye Removal", () => {
body,
});
expect([200, 501]).toContain(res.statusCode);
expect([202, 501]).toContain(res.statusCode);
}, 60_000);
it("accepts default settings", async () => {
@@ -70,12 +70,12 @@ describe("Red Eye Removal", () => {
body,
});
expect([200, 501]).toContain(res.statusCode);
expect([202, 501]).toContain(res.statusCode);
if (res.statusCode === 200) {
if (res.statusCode === 202) {
const result = JSON.parse(res.body);
expect(result.downloadUrl).toBeDefined();
expect(result.processedSize).toBeGreaterThan(0);
expect(result.jobId).toBeDefined();
expect(result.async).toBe(true);
}
if (res.statusCode === 501) {
@@ -103,7 +103,7 @@ describe("Red Eye Removal", () => {
body,
});
expect([200, 501]).toContain(res.statusCode);
expect([202, 501]).toContain(res.statusCode);
}, 60_000);
it("accepts explicit format and quality", async () => {
@@ -125,7 +125,7 @@ describe("Red Eye Removal", () => {
body,
});
expect([200, 501]).toContain(res.statusCode);
expect([202, 501]).toContain(res.statusCode);
}, 60_000);
it("processes JPEG input", async () => {
@@ -144,7 +144,7 @@ describe("Red Eye Removal", () => {
body,
});
expect([200, 501]).toContain(res.statusCode);
expect([202, 501]).toContain(res.statusCode);
}, 60_000);
it("handles HEIC input", async () => {
@@ -163,7 +163,7 @@ describe("Red Eye Removal", () => {
body,
});
expect([200, 501]).toContain(res.statusCode);
expect([202, 501]).toContain(res.statusCode);
}, 60_000);
it("handles 1x1 pixel input", async () => {
@@ -183,7 +183,7 @@ describe("Red Eye Removal", () => {
});
// AI tool may return 200, 501 (not installed), or 422 (processing error on tiny image)
expect([200, 422, 501]).toContain(res.statusCode);
expect([202, 422, 501]).toContain(res.statusCode);
}, 60_000);
// ── Validation (always testable) ─────────────────────────────────