Merge commit from fork

fix: validate fileId to prevent path traversal in chunked import

Author: 0PandaDEV

bun.lock

@@ -19,14 +19,15 @@
     "zod": "4.1.13"
   },
   "devDependencies": {
-    "@types/node": "24.10.2",
     "@nuxtjs/sitemap": "7.4.9",
     "@types/bcrypt": "6.0.0",
     "@types/busboy": "1.5.4",
+    "@types/node": "24.10.2",
     "@vite-pwa/nuxt": "1.1.0",
     "@waradu/keyboard": "8.0.0",
     "badgen": "3.2.3",
     "chart.js": "4.5.1",
+    "dotenv": "^17.4.2",
     "lucide-vue-next": "0.556.0",
     "nuxt": "4.2.1",
     "nuxt-cron": "1.8.0",

package.json

@@ -1,4 +1,5 @@
 import { defineConfig } from "prisma/config";
+import "dotenv/config";
 
 export default defineConfig({
   schema: "prisma/schema.prisma",

prisma.config.ts

@@ -294,6 +294,30 @@ const wakaTimeExportSchema = z.object({
   ),
 });
 
+const FILE_ID_PATTERN = /^[A-Za-z0-9_-]{1,128}$/;
+
+function assertSafeFileId(fileId: unknown): void {
+  if (typeof fileId !== "string" || !FILE_ID_PATTERN.test(fileId)) {
+    throw handleApiError(
+      400,
+      `Rejected import with invalid fileId: ${JSON.stringify(fileId)}`,
+      "Invalid upload identifier.",
+    );
+  }
+}
+
+function assertWithinUserDir(userTempDir: string, targetPath: string): void {
+  const base = path.resolve(userTempDir);
+  const resolved = path.resolve(targetPath);
+  if (resolved !== base && !resolved.startsWith(base + path.sep)) {
+    throw handleApiError(
+      400,
+      `Path traversal detected: ${resolved} escapes ${base}`,
+      "Invalid upload path.",
+    );
+  }
+}
+
 async function handleChunkUpload(formData: any[], userId: string) {
   const fileId = formData.find((p) => p.name === "fileId")?.data.toString();
   const chunkIndex = parseInt(
@@ -316,6 +340,8 @@ async function handleChunkUpload(formData: any[], userId: string) {
     );
   }
 
+  assertSafeFileId(fileId);
+
   const MAX_CHUNK_SIZE = 100 * 1024 * 1024;
   if (chunk.data && chunk.data.length > MAX_CHUNK_SIZE) {
     throw handleApiError(
@@ -336,6 +362,7 @@ async function handleChunkUpload(formData: any[], userId: string) {
 
   const userTempDir = path.join(tmpdir(), "ziit-chunks", userId);
   const chunksDir = path.join(userTempDir, fileId);
+  assertWithinUserDir(userTempDir, chunksDir);
   mkdirSync(chunksDir, { recursive: true });
 
   let job = activeJobs.get(fileId);
@@ -387,6 +414,7 @@ async function handleChunkUpload(formData: any[], userId: string) {
 }
 
 async function processFileInBackground(fileId: string, userId: string) {
+  assertSafeFileId(fileId);
   const job = activeJobs.get(fileId);
   if (!job || job.fileId !== fileId) {
     throw handleApiError(
@@ -403,6 +431,8 @@ async function processFileInBackground(fileId: string, userId: string) {
   const userTempDir = path.join(tmpdir(), "ziit-chunks", userId);
   const chunksDir = path.join(userTempDir, fileId);
   const combinedFilePath = path.join(userTempDir, `${fileId}-combined.json`);
+  assertWithinUserDir(userTempDir, chunksDir);
+  assertWithinUserDir(userTempDir, combinedFilePath);
 
   try {
     handleLog(