External/SnapOtter
1
0
Fork 0
mirror of https://github.com/snapotter-hq/SnapOtter.git synced 2026-08-03 07:46:42 +02:00
Code Issues Packages Projects Releases Wiki Activity

fix: harden all AI tools against proxy timeouts and filename attacks

Browse Source 
Convert all 9 AI tool routes (colorize, restore-photo, remove-background,
enhance-faces, blur-faces, red-eye-removal, erase-object, noise-removal,
upscale) to async 202 processing so none are vulnerable to proxy
connection timeouts.

Also fixes:
- Replace basename() with sanitizeFilename() in all AI tool routes
  (prevents double-extension attacks and adds length truncation)
- Add UUID format validation for clientJobId field
- Fix missing filename sanitization in noise-removal (was using raw
  user-supplied filename with zero sanitization)
- Remove em dash from error message in use-tool-processor
This commit is contained in:
SnapOtter
2026-05-01 00:11:03 +08:00
parent 4900d8a4fe
commit d12b1c0fc6
18 changed files with 818 additions and 628 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/integration/restore-photo.test.ts
+11 -11
View File
@@ -50,7 +50,7 @@ describe("Restore Photo", () => {
body,
});
expect([200, 501]).toContain(res.statusCode);
expect([202, 501]).toContain(res.statusCode);
}, 60_000);
it("accepts default settings", async () => {
@@ -69,12 +69,12 @@ describe("Restore Photo", () => {
body,
});
expect([200, 501]).toContain(res.statusCode);
expect([202, 501]).toContain(res.statusCode);
if (res.statusCode === 200) {
if (res.statusCode === 202) {
const result = JSON.parse(res.body);
expect(result.downloadUrl).toBeDefined();
expect(result.processedSize).toBeGreaterThan(0);
expect(result.jobId).toBeDefined();
expect(result.async).toBe(true);
}
if (res.statusCode === 501) {
@@ -108,7 +108,7 @@ describe("Restore Photo", () => {
body,
});
expect([200, 501]).toContain(res.statusCode);
expect([202, 501]).toContain(res.statusCode);
}, 60_000);
it("accepts heavy mode with colorize enabled", async () => {
@@ -134,7 +134,7 @@ describe("Restore Photo", () => {
body,
});
expect([200, 501]).toContain(res.statusCode);
expect([202, 501]).toContain(res.statusCode);
}, 60_000);
it("accepts light mode with features disabled", async () => {
@@ -161,7 +161,7 @@ describe("Restore Photo", () => {
body,
});
expect([200, 501]).toContain(res.statusCode);
expect([202, 501]).toContain(res.statusCode);
}, 60_000);
it("processes JPEG input", async () => {
@@ -180,7 +180,7 @@ describe("Restore Photo", () => {
body,
});
expect([200, 501]).toContain(res.statusCode);
expect([202, 501]).toContain(res.statusCode);
}, 60_000);
it("handles HEIC input", async () => {
@@ -199,7 +199,7 @@ describe("Restore Photo", () => {
body,
});
expect([200, 501]).toContain(res.statusCode);
expect([202, 501]).toContain(res.statusCode);
}, 60_000);
it("handles 1x1 pixel input", async () => {
@@ -218,7 +218,7 @@ describe("Restore Photo", () => {
body,
});
expect([200, 422, 501]).toContain(res.statusCode);
expect([202, 422, 501]).toContain(res.statusCode);
}, 60_000);
// ── Validation (always testable) ─────────────────────────────────