add envoy, and add some protections for filenames

diff --git a/gleam.toml b/gleam.toml
index fc5046694cc1af70a9323d45cc21ccb253ee3e03..d145cdb790ced82ceccdfa874d6069062d4265d5 100644 (file)
--- a/gleam.toml
+++ b/gleam.toml
@@ -24,6 +24,7 @@ gleam_json = ">= 3.1.0 and < 4.0.0"
 gleam_time = ">= 1.8.0 and < 2.0.0"
 simplifile = ">= 2.4.0 and < 3.0.0"
 mist = ">= 6.0.3 and < 7.0.0"
+envoy = ">= 1.2.0 and < 2.0.0"
 
 [dev_dependencies]
 gleeunit = ">= 1.0.0 and < 2.0.0"

diff --git a/manifest.toml b/manifest.toml
index 717b1ae94dd7f6127839f771d2f1cb96e0ae4e7e..4baa82eced1b28291f259657f93a0bf4c5ce8e33 100644 (file)
--- a/manifest.toml
+++ b/manifest.toml
@@ -32,6 +32,7 @@ packages = [
 
 [requirements]
 argv = { version = ">= 1.1.0 and < 2.0.0" }
+envoy = { version = ">= 1.2.0 and < 2.0.0" }
 gleam_erlang = { version = ">= 1.3.0 and < 2.0.0" }
 gleam_http = { version = ">= 4.3.0 and < 5.0.0" }
 gleam_json = { version = ">= 3.1.0 and < 4.0.0" }

diff --git a/src/filestuffs.gleam b/src/filestuffs.gleam
index 7121b60df9ed04261cafdbfd23649c375f8489e9..7e0c49e1c073ba6bc5a859b1e1617645bb0e5a75 100644 (file)
--- a/src/filestuffs.gleam
+++ b/src/filestuffs.gleam
@@ -1,6 +1,8 @@
 import argv
+import envoy
 import gleam/erlang/process
 import gleam/io
+import gleam/result
 import mist
 import router
 import wisp
@@ -24,7 +26,8 @@ pub fn wassup() -> Int {
 fn web(file_path: String, password: String) -> Nil {
   wisp.configure_logger()
 
-  let secret_key_base = wisp.random_string(64)
+  let secret_key_base =
+    result.unwrap(envoy.get("SECRET_KEY_BASE"), wisp.random_string(64))
 
   let assert Ok(_) =
     router.handle_request(_, file_path, password)

diff --git a/src/router.gleam b/src/router.gleam
index a30d11b7ae5f7d8ea0a035c20919a727edd6f78b..2036bc7cb3111964175031c6d0fe79246fd97172 100644 (file)
--- a/src/router.gleam
+++ b/src/router.gleam
@@ -1,6 +1,7 @@
 import gleam/bool
 import gleam/list
 import gleam/result
+import gleam/string
 import simplifile
 import wisp
 
@@ -40,13 +41,18 @@ pub fn upload(req: wisp.Request, password: String) -> wisp.Response {
     return: wisp.response(401),
   )
 
-  wisp.log_debug(result.unwrap(list.key_find(form.values, "password"), ""))
-
   case form.files {
     [#("file", wisp.UploadedFile(file_name:, path: temp_path)), ..] -> {
-      let destination =
-        "./files/"
-        <> result.unwrap(list.key_find(form.values, "filename"), file_name)
+      let user_path_name =
+        result.unwrap(list.key_find(form.values, "filename"), file_name)
+
+      let destination = "./files/" <> user_path_name
+
+      use <- bool.guard(
+        string.contains(does: user_path_name, contain: "/")
+          || string.contains(does: user_path_name, contain: ".."),
+        wisp.bad_request("bad filename, no slashes allowed"),
+      )
 
       let result = {
         use _ <- result.try(simplifile.create_directory_all("./files"))