yusufipek/OpenFrame
1
0
Fork 0
mirror of https://github.com/yusufipk/OpenFrame.git synced 2026-09-11 09:36:08 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix: address security vulnerabilities and add image attachments

Browse Source 
- Fix type confusion vulnerability in comment content updates
- Validate pagination offsets to prevent negative values
- Validate timestamp is a valid number before parsing
- Exclude guestEmail from comment API responses for privacy
- Fix TypeScript error in audio upload route
- Add image attachment support for comments with upload API
- Update admin dashboard to track image attachments
- Rename cleanup functions to handle both voice and image media
This commit is contained in:
Yusuf İpek
2026-02-21 16:40:58 +03:00
parent cd9b89c971
commit e32196c430
15 changed files with 837 additions and 119 deletions
Download Patch File Download Diff File Expand all files Collapse all files
lib/admin-stats.ts
+29 -13
View File
@@ -34,10 +34,10 @@ export const getCachedTotalStorage = unstable_cache(
{ revalidate: 600 }
);
export const getCachedUserVoiceStorage = unstable_cache(
export const getCachedUserMediaStorage = unstable_cache(
async () => {
// Return a plain object so it maps cleanly out of unstable_cache across requests
const userStorage: Record<string, number> = {};
const userStorage: Record<string, { total: number, voice: number, image: number }> = {};
try {
const fileSizes = new Map<string, number>();
let isTruncated = true;
@@ -57,25 +57,41 @@ export const getCachedUserVoiceStorage = unstable_cache(
continuationToken = data.NextContinuationToken;
}
const voiceComments = await db.comment.findMany({
where: { voiceUrl: { not: null }, authorId: { not: null } },
select: { authorId: true, voiceUrl: true }
const mediaComments = await db.comment.findMany({
where: { OR: [{ voiceUrl: { not: null } }, { imageUrl: { not: null } }], authorId: { not: null } },
select: { authorId: true, voiceUrl: true, imageUrl: true }
});
for (const comment of voiceComments) {
if (!comment.authorId || !comment.voiceUrl) continue;
const keyParts = comment.voiceUrl.split('/');
const filename = keyParts[keyParts.length - 1];
const r2Key = `voice/${filename}`;
const size = fileSizes.get(r2Key) || 0;
for (const comment of mediaComments) {
if (!comment.authorId) continue;
userStorage[comment.authorId] = (userStorage[comment.authorId] || 0) + size;
if (!userStorage[comment.authorId]) {
userStorage[comment.authorId] = { total: 0, voice: 0, image: 0 };
}
if (comment.voiceUrl) {
const keyParts = comment.voiceUrl.split('/');
const filename = keyParts[keyParts.length - 1];
const r2Key = `voice/${filename}`;
const size = fileSizes.get(r2Key) || 0;
userStorage[comment.authorId].voice += size;
userStorage[comment.authorId].total += size;
}
if (comment.imageUrl) {
const keyParts = comment.imageUrl.split('/');
const filename = keyParts[keyParts.length - 1];
const r2Key = `images/${filename}`;
const size = fileSizes.get(r2Key) || 0;
userStorage[comment.authorId].image += size;
userStorage[comment.authorId].total += size;
}
}
} catch (err) {
console.error('Failed to parse user storage:', err);
}
return userStorage;
},
['admin-user-voice-storage'],
['admin-user-media-storage'],
{ revalidate: 600 }
);
lib/r2-cleanup.ts
+59 -38
View File
@@ -2,103 +2,124 @@ import { DeleteObjectCommand } from '@aws-sdk/client-s3';
import { r2Client, R2_BUCKET_NAME } from '@/lib/r2';
import { db } from '@/lib/db';
/** The path prefix for images served by the upload API. */
const IMAGE_PATH_PREFIX = '/api/upload/image/';
/** The path prefix for audio URLs served by the upload API. */
const AUDIO_PATH_PREFIX = '/api/upload/audio/';
/**
* Extract the R2 object key from a voice URL like /api/upload/audio/filename.webm.
* Extract the R2 object key from a media URL.
* Uses string parsing instead of regex to avoid ReDoS risk on untrusted input.
*/
function voiceUrlToKey(url: string): string | null {
const idx = url.indexOf(AUDIO_PATH_PREFIX);
if (idx === -1) return null;
const filename = url.slice(idx + AUDIO_PATH_PREFIX.length);
return filename ? `voice/${filename}` : null;
function mediaUrlToKey(url: string): string | null {
if (url.includes(AUDIO_PATH_PREFIX)) {
const filename = url.slice(url.indexOf(AUDIO_PATH_PREFIX) + AUDIO_PATH_PREFIX.length);
return filename ? `voice/${filename}` : null;
} else if (url.includes(IMAGE_PATH_PREFIX)) {
const filename = url.slice(url.indexOf(IMAGE_PATH_PREFIX) + IMAGE_PATH_PREFIX.length);
return filename ? `images/${filename}` : null;
}
return null;
}
/**
* Delete a list of voice files from R2 (best-effort, logs failures).
* Delete a list of media files from R2 (best-effort, logs failures).
*/
async function deleteVoiceFiles(voiceUrls: string[]) {
for (const url of voiceUrls) {
async function deleteMediaFiles(mediaUrls: string[]) {
for (const url of mediaUrls) {
try {
const key = voiceUrlToKey(url);
const key = mediaUrlToKey(url);
if (key) {
await r2Client.send(
new DeleteObjectCommand({ Bucket: R2_BUCKET_NAME, Key: key })
);
}
} catch (err) {
console.error('Failed to delete audio from R2:', err);
console.error('Failed to delete media from R2:', err);
}
}
}
/**
* Collect all voice URLs from comments under a given video (all versions).
* Collect all media URLs from comments under a given video (all versions).
*/
export async function collectVideoVoiceUrls(videoId: string): Promise<string[]> {
export async function collectVideoMediaUrls(videoId: string): Promise<string[]> {
const comments = await db.comment.findMany({
where: {
voiceUrl: { not: null },
OR: [{ voiceUrl: { not: null } }, { imageUrl: { not: null } }],
version: { videoParentId: videoId },
},
select: { voiceUrl: true },
select: { voiceUrl: true, imageUrl: true },
});
return comments.map((c: { voiceUrl: string | null }) => c.voiceUrl).filter(Boolean) as string[];
const urls: string[] = [];
comments.forEach(c => {
if (c.voiceUrl) urls.push(c.voiceUrl);
if (c.imageUrl) urls.push(c.imageUrl);
});
return urls;
}
/**
* Collect all voice URLs from comments under all videos in a project.
* Collect all media URLs from comments under all videos in a project.
*/
export async function collectProjectVoiceUrls(projectId: string): Promise<string[]> {
export async function collectProjectMediaUrls(projectId: string): Promise<string[]> {
const comments = await db.comment.findMany({
where: {
voiceUrl: { not: null },
OR: [{ voiceUrl: { not: null } }, { imageUrl: { not: null } }],
version: { video: { projectId } },
},
select: { voiceUrl: true },
select: { voiceUrl: true, imageUrl: true },
});
return comments.map((c: { voiceUrl: string | null }) => c.voiceUrl).filter(Boolean) as string[];
const urls: string[] = [];
comments.forEach(c => {
if (c.voiceUrl) urls.push(c.voiceUrl);
if (c.imageUrl) urls.push(c.imageUrl);
});
return urls;
}
/**
* Collect all voice URLs from comments under all projects in a workspace.
* Collect all media URLs from comments under all projects in a workspace.
*/
export async function collectWorkspaceVoiceUrls(workspaceId: string): Promise<string[]> {
export async function collectWorkspaceMediaUrls(workspaceId: string): Promise<string[]> {
const comments = await db.comment.findMany({
where: {
voiceUrl: { not: null },
OR: [{ voiceUrl: { not: null } }, { imageUrl: { not: null } }],
version: { video: { project: { workspaceId } } },
},
select: { voiceUrl: true },
select: { voiceUrl: true, imageUrl: true },
});
return comments.map((c: { voiceUrl: string | null }) => c.voiceUrl).filter(Boolean) as string[];
const urls: string[] = [];
comments.forEach(c => {
if (c.voiceUrl) urls.push(c.voiceUrl);
if (c.imageUrl) urls.push(c.imageUrl);
});
return urls;
}
/**
* Delete all voice files for a video from R2.
* Delete all media files for a video from R2.
* Call BEFORE deleting the video from the database (cascade would remove comment rows).
*/
export async function cleanupVideoVoiceFiles(videoId: string) {
const urls = await collectVideoVoiceUrls(videoId);
await deleteVoiceFiles(urls);
export async function cleanupVideoMediaFiles(videoId: string) {
const urls = await collectVideoMediaUrls(videoId);
await deleteMediaFiles(urls);
}
/**
* Delete all voice files for a project from R2.
* Delete all media files for a project from R2.
* Call BEFORE deleting the project from the database.
*/
export async function cleanupProjectVoiceFiles(projectId: string) {
const urls = await collectProjectVoiceUrls(projectId);
await deleteVoiceFiles(urls);
export async function cleanupProjectMediaFiles(projectId: string) {
const urls = await collectProjectMediaUrls(projectId);
await deleteMediaFiles(urls);
}
/**
* Delete all voice files for a workspace from R2.
* Delete all media files for a workspace from R2.
* Call BEFORE deleting the workspace from the database.
*/
export async function cleanupWorkspaceVoiceFiles(workspaceId: string) {
const urls = await collectWorkspaceVoiceUrls(workspaceId);
await deleteVoiceFiles(urls);
export async function cleanupWorkspaceMediaFiles(workspaceId: string) {
const urls = await collectWorkspaceMediaUrls(workspaceId);
await deleteMediaFiles(urls);
}