svragv/sakisafe
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Add support to ban extensions

Browse source
This commit is contained in:
(≧◡≦) 2023-09-24 13:44:04 +02:00
parent 47d733b2f4
commit 968a288866
No known key found for this signature in database
GPG key ID: B39C0BCEE94A4A89
1 changed files with 95 additions and 81 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

176
http/sakisafe.pl
View file

@ -1,13 +1,11 @@
#!/usr/bin/perl #!/usr/bin/perl
# This file is part of sakisafe. # This file is part of sakisafe.
use if $^O eq "openbsd", OpenBSD::Pledge, qw(pledge); use if $^O eq "openbsd", OpenBSD::Pledge, qw(pledge);
use Mojolicious::Lite -signatures; use Mojolicious::Lite -signatures;
use Mojolicious::Routes::Pattern; use Mojolicious::Routes::Pattern;
use Mojo::Log;
use Time::HiRes;
use List::MoreUtils qw(uniq); use List::MoreUtils qw(uniq);
use Carp;
use Term::ANSIColor; use Term::ANSIColor;
use English; use English;
use MIME::Types; use MIME::Types;
@ -18,88 +16,96 @@ use feature 'say';
plugin 'RenderFile'; plugin 'RenderFile';
# OpenBSD promises. # OpenBSD promises.
pledge("stdio cpath rpath wpath inet flock fattr") if $^O eq "openbsd"; pledge("stdio prot_exec cpath rpath wpath inet flock fattr")
if $^O eq "openbsd";
# 100 MBs # 500 MBs
my $MAX_SIZE = 1024 * 1024 * 100;
my @BANNED = eval { path('banned.txt')->slurp_utf8 } || qw(); # Add banned IP addresses here my $MAX_SIZE = 1024 * 1024 * 1000;
my @BANNED = eval { path('banned.txt')->slurp_utf8 }
or qw(); # Add banned IP addresses here
my @BANNED_EXTS = eval { path('banned_exts.txt')->slurp_utf8 }
or qw(); # Add forbidden files extensions here
my $dirname; my $dirname;
my $link; my $link;
mkdir "f"; mkdir "f";
# Mojo logger
my $log = Mojo::Log->new(path => 'sakisafe.log', level => 'trace');
$log->color(1);
# Forward logs to STDERR or STDOUT while also writing to the `sakisafe.log` file.
$log->on(
message => sub ($l, $level, @lines) {
my $time = time;
my ($s, $m, $h, $day, $month, $year) = localtime time;
$time = sprintf(
'%04d-%02d-%02d %02d:%02d:%08.5f',
$year + 1900,
$month + 1, $day, $h, $m, "$s." . ((split '.', $time)[1] // 0)
);
my $log_to_print = '[' . $time . '] ' . '[' . $level . '] ' . join(' ', @lines);
if ($level eq 'trace' || $level eq 'info') {
say $log_to_print;
}
else {
print \*STDERR, $log_to_print . "\n";
}
}
);
# Function to handle file uploads # Function to handle file uploads
sub logger ( $level, $address, $message ) {
open( my $fh, ">>", "sakisafe.log" );
printf( $fh "[%s]: %s has uploaded file %s\n", $level, $address, $message );
close($fh);
}
sub handle_file { sub handle_file {
my $c = shift; my $c = shift;
my $filedata = $c->param("file"); my $filedata = $c->param("file");
if ($filedata->size > $MAX_SIZE) { if ( $filedata->size > $MAX_SIZE ) {
return $c->render(text => "Max upload size: $MAX_SIZE", status => 400); return $c->render(
} text => "Max upload size: $MAX_SIZE",
status => 400
);
}
if (List::MoreUtils::any { $c->tx->remote_address } uniq @BANNED) { if ( List::MoreUtils::any { /$c->tx->remote_address/ } uniq @BANNED ) {
$log->info("Attempt to upload by banned IP: " . $c->tx->remote_address); $c->render(
$c->render( text =>
text => "Hi! Seems like the server admin added your IP address to the banned IP array." "Hi! Seems like the server admin added your IP address to the banned IP array."
. "As the developer of sakisafe, I can't do anything.", . "As the developer of sakisafe, I can't do anything.",
status => 403 status => 403
); );
return; return;
} }
# Generate random string for the directory # Generate random string for the directory
my @chars = ('0' .. '9', 'a' .. 'Z'); my @chars = ( '0' .. '9', 'a' .. 'Z' );
$dirname .= $chars[rand @chars] for 1 .. 5; $dirname .= $chars[ rand @chars ] for 1 .. 5;
my $filename = $filedata->filename; my $filename = $filedata->filename;
$log->warn("sakisafe warning: could not create directory: $ERRNO") unless mkdir("f/" . $dirname); my ($ext) = $filename =~ /(\.[^.]+)$/;
$filename .= ".txt" if $filename eq "-"; if ( List::MoreUtils::any { /$ext/ } uniq @BANNED_EXTS ) {
$c->render( text => "You cannot this filetype.\n", status => 415 );
say $ext;
logger( "WARN", $c->tx->remote_address, $dirname . "/" . $filename );
return;
}
carp( color("bold yellow"),
"sakisafe warning: could not create directory: $ERRNO",
color("reset") )
unless mkdir( "f/" . $dirname );
$filename .= ".txt" if $filename eq "-";
# TODO: get whether the server is http or https # TODO: get whether the server is http or https
# There's a CGI ENV variable for that. # There's a CGI ENV variable for that.
my $host = $c->req->url->to_abs->host; my $host = $c->req->url->to_abs->host;
my $ua = $c->req->headers->user_agent; my $ua = $c->req->headers->user_agent;
$filedata->move_to("f/" . $dirname . "/" . $filename); $filedata->move_to( "f/" . $dirname . "/" . $filename );
$link = "http://$host/f/$dirname/$filename"; $link = "http://$host/f/$dirname/$filename";
$c->stash(link => $link, host => $host, dirname => $dirname); $c->stash( link => $link, host => $host, dirname => $dirname );
$c->res->headers->header('Location' => "$link" . $filename); $c->res->headers->header( 'Location' => "$link" . $filename );
# Only give the link to curl, html template for others. # Only give the link to curl, html template for others.
if ($ua =~ m/curl/) {
$c->render(text => $link . "\n", status => 201,);
$dirname = ""; if ( $ua =~ m/curl/ || $ua eq "" ) {
} $c->render(
else { text => $link . "\n",
$c->render(template => 'file', status => 201,); status => 201,
} );
$log->info($c->tx->remote_address . " " . $dirname . "/" . $filename); $dirname = "";
$dirname = ""; }
else {
$c->render(
template => 'file',
status => 201,
);
}
logger( "INFO", $c->tx->remote_address, $dirname . "/" . $filename );
$dirname = "";
} }
# Function to log uploaded files # Function to log uploaded files
@ -110,19 +116,22 @@ post '/' => sub ($c) { handle_file($c) };
# Allow files to be downloaded. # Allow files to be downloaded.
get '/f/:dir/#name' => sub ($c) { get '/f/:dir/#name' => sub ($c) {
my $dir = $c->param("dir"); my $dir = $c->param("dir");
my $file = $c->param("name"); my $file = $c->param("name");
my $ext = $file; my $ext = $file;
$ext =~ s/.*\.//; $ext =~ s/.*\.//;
my $path = "f/" . $dir . "/" . $file; my $path = "f/" . $dir . "/" . $file;
#carp "sakisafe warning: could not get file: $ERRNO" unless #carp "sakisafe warning: could not get file: $ERRNO" unless
$c->render(text => "file not found", status => 404) unless -e $path; $c->render( text => "file not found", status => 404 ) unless -e $path;
$c->render_file(filepath => $path, format => $ext, content_disposition => 'inline'); $c->render_file(
filepath => $path,
format => $ext,
content_disposition => 'inline'
);
}; };
app->log($log); app->max_request_size( 1024 * 1024 * 100 );
app->max_request_size(1024 * 1024 * 100);
post '/upload' => sub ($c) { handle_file($c) }; post '/upload' => sub ($c) { handle_file($c) };
@ -158,6 +167,9 @@ __DATA__
</body> </body>
</html> </html>
__END__
@@ index.html.ep @@ index.html.ep
<!DOCTYPE html> <!DOCTYPE html>
<html lang="en"> <html lang="en">
@ -175,13 +187,14 @@ __DATA__
<p>POST a file:</p> <p>POST a file:</p>
<code>curl -F 'file=@yourfile.png' https://<%= $c->req->url->to_abs->host; %></code> <code>curl -F 'file=@yourfile.png' https://<%= $c->req->url->to_abs->host; %></code>
<p>Post your text directly</p> <p>Post your text directly</p>
<code>curl -F 'file=@-' https://<%= $c->req->url->to_abs->host; %></code> <code>curl -F 'file=@-' https://<%= $c->req->url->to_abs->host; %></code><br/>
<a href="https://git.suragu.net/svragv/sakisafe">Git repository</a>
</center> </center>
<p>Running sakisafe 2.4.0</p> <p>Running sakisafe 2.4.0</p>
<div class="left"> <div class="left">
<h2>Or just upload a file here</h2> <h2>Or just upload a file here</h2>
<form ENCTYPE='multipart/form-data' method='post' action='/upload'> <form ENCTYPE='multipart/form-data' method='post' action='/upload'>
<input type='file' name='file' size='30' required/> <input type='file' name='file' size='30'/>
<input type='submit' value='upload'/> <input type='submit' value='upload'/>
</form> </form>
</div> </div>
@ -189,6 +202,7 @@ __DATA__
</html> </html>
__END__ __END__
=pod =pod
=head1 sakisafe =head1 sakisafe