Apply sanitation to chat names with extension

4b2c074399471cf674fa1e9691a41b09618ecb33

Cohee <18619528+Cohee1207@users.noreply.github.com>

src/endpoints/chats.js+12 -21 Viewed

         const directoryName = String(request.body.avatar_url).replace('.png', '');
         const chatData = request.body.chat;
         const jsonlData = chatData.map(JSON.stringify).join('\n');
         const fileName = `${sanitize(String(request.body.file_name))}.jsonl`;
         const filePath = path.join(request.user.directories.chats, directoryName, sanitize(fileName));
         writeFileAtomicSync(filePath, jsonlData, 'utf8');
         backupChat(request.user.directories.backups, directoryName, jsonlData);
         return response.send({ result: 'ok' });

             return response.send({});
+        }
         const fileName = path.join(directoryPath, `${sanitize(String(request.body.file_name))}.jsonl`);
         const chatFileExistsfilePath = fspath.existsSyncjoin(directoryPath, sanitize(fileName));
 +        const chatFileExists = fs.existsSync(filePath);
         if (!chatFileExists) {
             return response.send({});
+        }
         const data = fs.readFileSync(fileNamefilePath, 'utf8');
         const lines = data.split('\n');
         // Iterate through the array of strings and parse each line as JSON

 });
 router.post('/delete', jsonParser, function (request, response) {
 -    if (!request.body) {
 -        console.log('no request body seen');
 -        return response.sendStatus(400);
 -    }
+-
 -    if (request.body.chatfile !== sanitize(request.body.chatfile)) {
 -        console.error('Malicious chat name prevented');
 -        return response.sendStatus(403);
 -    }
+-
     const dirName = String(request.body.avatar_url).replace('.png', '');
     const fileName = path.join(request.user.directories.chats, dirName, sanitize(String(request.body.chatfile)));
     const chatFileExistsfilePath = fspath.existsSyncjoin(request.user.directories.chats, dirName, sanitize(fileName));
 +    const chatFileExists = fs.existsSync(filePath);
     if (!chatFileExists) {
         console.log(`Chat file not found '${fileNamefilePath}'`);
         return response.sendStatus(400);
 -    } else {
 -        fs.rmSync(fileName);
 -        console.log('Deleted chat file: ' + fileName);
+    }
 +    fs.rmSync(filePath);
 +    console.log('Deleted chat file: ' + filePath);
     return response.send('ok');
 });