fix(core): validate basePath for raw Node.js requests

Author: kukhariev

examples/node-http-server.js

@@ -1,10 +1,8 @@
 const { createServer } = require('http');
-const { DiskStorage, Uploadx, cors } = require('@uploadx/core');
+const { DiskStorage, Uploadx } = require('@uploadx/core');
 
 const PORT = process.env.PORT || 3002;
 
-const corsHandler = cors();
-
 const storage = new DiskStorage({
   uploadDir: process.env.UPLOAD_DIR || 'upload',
   basePath: '/files',
@@ -22,16 +20,7 @@ uploadx.on('completed', file => console.log('completed: ', file));
 uploadx.on('updated', file => console.log(' metadata updated: ', file));
 
 const server = createServer((req, res) => {
-  const { pathname } = new URL(req.url || '', 'http://localhost');
-  if (pathname === '/files') {
-    uploadx.upload(req, res, () => {
-      uploadx.send(res, { body: req.body, statusCode: 200 });
-    });
-  } else {
-    corsHandler(req, res, () => {
-      uploadx.send(res, { body: 'Not Found', statusCode: 404 });
-    });
-  }
+  uploadx.handle(req, res);
 });
 
 server.listen(+PORT, () => console.log('listening on port:', PORT));

examples/server.js

@@ -3,11 +3,9 @@ const { cors, DiskStorage, Multipart, Tus, Uploadx, fromEnv } = require('@upload
 const { createServer } = require('http');
 
 const PORT = process.env.PORT || 3002;
-const path = '/files';
-const pathRegexp = new RegExp(`^${path}([/?]|$)`);
 
 const config = {
-  basePath: path,
+  basePath: '/files',
   uploadDir: './upload',
   allowedMimeTypes: ['video/*', 'image/*'],
   maxFileSize: '2GB',
@@ -31,7 +29,7 @@ createServer((req, res) => {
       timestamp: Date.now()
     };
     corsHandler(req, res, () => uploadx.send(res, { body: healthcheck }));
-  } else if (pathname && pathRegexp.test(pathname)) {
+  } else {
     switch (searchParams.get('uploadType')) {
       case 'multipart':
         multipart.handle(req, res);
@@ -43,7 +41,5 @@ createServer((req, res) => {
         uploadx.handle(req, res);
         break;
     }
-  } else {
-    corsHandler(req, res, () => uploadx.send(res, { body: 'Not Found', statusCode: 404 }));
   }
 }).listen(PORT);

packages/core/src/handlers/base-handler.ts

@@ -112,6 +112,13 @@ export abstract class BaseHandler<TFile extends UploadxFile>
       res.writeHead(204, { 'Content-Length': 0 }).end();
       return;
     }
+    if (!req.originalUrl) {
+      const { pathname } = new URL(req.url || '', 'http://localhost');
+      const basePath = this.storage.basePath;
+      const match =
+        basePath === '/' || pathname === basePath || pathname.startsWith(`${basePath}/`);
+      if (!match) return this.sendError(res, new UploadxError(ERRORS.FILE_NOT_FOUND));
+    }
     req.on('error', err => this.logger.error('Request error', { err }));
     this.logger.debug('Request {method} {url}', { method: req.method, url: req.url });
     const handler = this.registeredHandlers.get(req.method as string);

test/base-handler.spec.ts

@@ -18,13 +18,13 @@ describe('BaseHandler', () => {
   it('should check if storage not ready', () => {
     uploader.storage.isReady = false;
     const res = createResponse();
-    uploader.handle(createRequest({ method: 'OPTIONS' }), res);
+    uploader.handle(createRequest({ method: 'OPTIONS', url: '/files' }), res);
     expect(res.statusCode).toBe(503);
   });
 
   it('should check http method', () => {
     const res = createResponse();
-    uploader.handle(createRequest({ method: 'PATCH' }), res);
+    uploader.handle(createRequest({ method: 'PATCH', url: '/files' }), res);
     expect(res.statusCode).toBe(405);
   });