Claude
af160e0f33
Deploy FileDrop / deploy (push) Successful in 43s
HIGH severity fixes: - H1: Bot token leak via 302 redirect — always proxy S3 GETs - H2: PUT TOCTOU race — add unique partial index (bucket_id, s3_key) WHERE NOT deleted - H3: GET/HEAD ignore conditional headers (If-Match, If-None-Match, etc.) - H4: Body payload hash not verified — add verifyBodyHash() post-stream check - H5: Header-based auth has no expiry check — add 15-min clock skew window - H7: Multipart abort does not delete parts — DELETE before UPDATE status - H8: CompleteMultipartUpload skips part number & etag verification - H9: XML regex fails on keys containing < — use non-greedy [\s\S]*? - H10: Path-style vs virtual-hosted key decode mismatch MEDIUM severity fixes: - M1: Add Date header fallback for x-amz-date - M2/M3: Validate service/termination in credential scope - M4: Temp file leak when forwardToStorage throws in handleUploadPart - M5: Multipart key consistency check (s3Key matches URL) - M7: Use stored content-type from multipart initiate - M9: Copy conditional headers skip when fileHash is null - M11: Add 1000-key limit on DeleteObjects - M13: Stricter bucket name validation (no .., no IP format) - M14: NaN partNumber bypasses validation LOW fixes: - normalizeUri: dot-segment removal per RFC 3986 - localeCompare -> byte-order comparison in canonical query string - Validate host in signed headers - Server: AmazonS3 header on all responses - x-amz-id-2 separate from x-amz-request-id - IPv6 handling in stripPort - Quiet element whitespace tolerance in XML parser - content-type: application/xml on empty 2xx responses - Duplicate interfaces/s3/ -> re-exports from utils/s3/ Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
28 lines
995 B
TypeScript
28 lines
995 B
TypeScript
const stripPort = (host: string): string => {
|
|
// Handle IPv6: [::1]:8080 -> [::1]
|
|
if (host.startsWith('[')) {
|
|
const closeBracket = host.indexOf(']');
|
|
return host.slice(0, closeBracket + 1).toLowerCase();
|
|
}
|
|
return host.split(':')[0].toLowerCase().replace(/\.$/, '');
|
|
};
|
|
|
|
const isValidBucketLabel = (bucket: string): boolean =>
|
|
/^[a-z0-9][a-z0-9.-]{1,61}[a-z0-9]$/.test(bucket) &&
|
|
!bucket.includes('..') &&
|
|
!bucket.includes('.-') &&
|
|
!bucket.includes('-.');
|
|
|
|
export const extractS3BucketFromHost = (host: string, domains: string[]): string | null => {
|
|
const normalizedHost = stripPort(host);
|
|
for (const domain of domains) {
|
|
const normalizedDomain = stripPort(domain);
|
|
if (!normalizedDomain || normalizedHost === normalizedDomain) continue;
|
|
if (!normalizedHost.endsWith(`.${normalizedDomain}`)) continue;
|
|
|
|
const bucket = normalizedHost.slice(0, -(normalizedDomain.length + 1));
|
|
return isValidBucketLabel(bucket) ? bucket : null;
|
|
}
|
|
return null;
|
|
};
|