upload

2026-06-30 17:49:51 +08:00
commit 292c09619e
200 changed files with 23718 additions and 0 deletions
@@ -0,0 +1,257 @@
+#include "FileReceiver.h"
+#include <cstring>
+#include <json/json.h>
+#include "ServerLogger.h"
+#include "PathTraversal.h"
+#include "HTTPObjectsBridge.h"
+#include "UNSResponseBuilder.h"
+
+class FileReceiver::Impl
+{
+public:
+	bool EnableCORS = false;
+	bool HTMLResponse = false;
+	std::string TempRoot;
+	IPTablePtr BlockedIPs = nullptr;
+	WebFileInfoVec FileInfo;
+	FileProcessorCallback Callback = nullptr;
+};
+
+FileReceiver::FileReceiver() : pimpl(std::make_unique<Impl>())
+{
+}
+
+FileReceiver::~FileReceiver() = default;
+
+bool FileReceiver::CallFileProcesser()
+{
+	if (pimpl->Callback == nullptr)
+		return false;
+	std::thread thFileProcesser(pimpl->Callback, pimpl->FileInfo, pimpl->TempRoot);    //Use copy construst to avoid repeat data process.
+	if (!thFileProcesser.joinable())
+		return false;
+	thFileProcesser.detach();
+	pimpl->FileInfo.clear();
+	SCLOGF_TRACE("FileProcesser Function (Address: {}) Started.", pimpl->Callback);
+	return true;
+}
+
+void FileReceiver::SetResponseMode(bool html)
+{
+	pimpl->HTMLResponse = html;
+	SCLOG_DEBUG("FileReceiver init mode: %s", (html ? "html" : "json"));
+}
+
+void FileReceiver::SetCORSEnable(bool enable)
+{
+	pimpl->EnableCORS = enable;
+	SCLOG_DEBUG("FileReceiver CORS mode: %s", (enable ? "enabled" : "disabled"));
+}
+
+void FileReceiver::SetTempRoot(std::string temp_root)
+{
+	pimpl->TempRoot = temp_root;
+	SCLOG_TRACE("FR-TempRoot: %s", pimpl->TempRoot.c_str());
+	return;
+}
+
+void FileReceiver::SetFileCallback(FileProcessorCallback fpcb)
+{
+	pimpl->Callback = fpcb;
+	return;
+}
+
+void FileReceiver::UpdateBlockedIPs(IPTablePtr ip)
+{
+	pimpl->BlockedIPs = ip;
+	return;
+}
+
+void FileReceiver::AppenedBlockedIP(DateTime::Span block_time, std::string ip)
+{
+	DateTime expr_time = (DateTime::Now() += block_time);
+	IPList li{ ip };
+	pimpl->BlockedIPs->Appened(expr_time, li);
+	pimpl->BlockedIPs->Update();
+	SCLOG_INFO("IP: [%s] has been blocked untill {%s}", ip.c_str(), std::string(expr_time).c_str());
+	return;
+}
+
+uns::HTTPMethod FileReceiver::GetMethod(uns::RequestPtr request)
+{
+	std::string method = request->GetImpl()->webcc_req->method();
+	if (method == "GET")
+		return uns::HTTPMethod::H_GET;
+	else if (method == "PUT")
+		return uns::HTTPMethod::H_PUT;
+	else if (method == "POST")
+		return uns::HTTPMethod::H_POST;
+	else if (method == "HEAD")
+		return uns::HTTPMethod::H_HEAD;
+	else if (method == "TRACE")
+		return uns::HTTPMethod::H_TRACE;
+	else if (method == "PATCH")
+		return uns::HTTPMethod::H_PATCH;
+	else if (method == "DELETE")
+		return uns::HTTPMethod::H_DELETE;
+	else if (method == "OPTIONS")
+		return uns::HTTPMethod::H_OPTIONS;
+	else if (method == "CONNECT")
+		return uns::HTTPMethod::H_CONNECT;
+	else
+		return uns::HTTPMethod::H_UNKNOWN;
+}
+
+bool FileReceiver::WriteFile(const std::string& path, const std::string& bytes)
+{
+	//Code from WebCC source (commit 554470ac65f9fa08b53ee9adeb819ae7c70ef698).
+	std::ofstream stream{ path, std::ios::binary };
+	if (stream.fail())
+	{
+		SCLOG_WARNING("Failed to write file [%s]: can't open stream", path.c_str());
+		return false;
+	}
+	stream.write(bytes.data(), bytes.size());
+	if (stream.fail())
+		SCLOG_WARNING("Failed to write file [%s]: can't write to stream", path.c_str());
+	return !stream.fail();
+}
+
+uns::PathTraversalDefenceLevel FileReceiver::PTDefence()
+{
+	return uns::PathTraversalDefenceLevel::DenyAll;
+}
+
+bool FileReceiver::IsPathSafe(const std::string& raw_path)
+{
+	// 无外部重载时认为所有路径均不能通过检查
+	return false;
+}
+
+std::string FileReceiver::EncodeUploadResult()
+{
+	Json::Value root;
+	Json::FastWriter writer;
+	root["AcceptedCount"] = pimpl->FileInfo.size();
+	root["AcceptedFiles"] = Json::Value(Json::arrayValue);
+	for (auto& ele : pimpl->FileInfo)
+	{
+		Json::Value sub;
+		sub["FileName"] = ele.GetStorageFileName();
+		sub["UploadTime"] = ele.GetUploadTime().GetTimeStamp();
+		root["AcceptedFiles"].append(sub);
+	}
+	return writer.write(root);
+}
+
+std::string FileReceiver::EncodeUploadResultHTML()
+{
+	const char* html = R"(
+<html>
+	<head>
+		<meta charset="utf-8"/>
+		<title>Upload Result</title>
+	</head>
+	<body>
+		<center>
+			<h1>Upload Result</h1>
+			<hr/>
+			<p>AcceptedCount: %lld</p>
+			<p>AcceptedFiles: <br>%s</p>
+		</center>
+	</body>
+</html>
+)";
+	std::string tmp;
+	for (auto& ele : pimpl->FileInfo)
+		tmp += "[" + ele.GetStorageFileName() + "] - {" + ele.GetUploadTime().Format("%Y-%m-%d %H:%M:%S") + "}<br>";
+	size_t html_size = strlen(html) + tmp.size() + 10;
+	char* result = new char[html_size];
+	memset(result, 0, sizeof(result));
+	sprintf(result, html, pimpl->FileInfo.size(), tmp.c_str());
+	tmp = std::string(result);
+	delete[] result;
+	return tmp;
+}
+
+uns::ResponsePtr FileReceiver::Execute(uns::RequestPtr request)
+{
+	uns::HTTPMethod method = GetMethod(request);
+	std::string x_real_ip;
+	if(request->GetImpl()->webcc_req->HasHeader("X-Real-IP"))
+		x_real_ip = request->GetImpl()->webcc_req->GetHeader("X-Real-IP");
+	std::string req_ip = (x_real_ip.empty() ? request->GetImpl()->webcc_req->address() : x_real_ip);
+	SCLOG_DEBUG("Request recived, ip: [%s], method: %s", req_ip.c_str(), request->GetImpl()->webcc_req->method().c_str());
+	// path test
+	std::string path = request->GetImpl()->webcc_req->url().path();
+	auto status = PathTraversal::AnalyzeUrlTraversal(path);
+	if(status != PathTraversal::UrlSafetyStatus::Safe)
+		SCLOGF_WARNING("PathTraversal Detected: {}, Level: {}", path, PathTraversal::ToString(status));
+	switch(PTDefence())
+	{
+		case uns::PathTraversalDefenceLevel::DenyAll:
+			if(status != PathTraversal::UrlSafetyStatus::Safe)
+				return (pimpl->EnableCORS ? uns::ResponseBuilder().Forbidden().EmptyBody().AutoCORS(request)() : uns::ResponseBuilder().Forbidden().EmptyBody()());
+			break;
+		case uns::PathTraversalDefenceLevel::AutoNormalize:
+		{
+			if(status == PathTraversal::UrlSafetyStatus::EvasiveTraversal)
+				return (pimpl->EnableCORS ? uns::ResponseBuilder().Forbidden().EmptyBody().AutoCORS(request)() : uns::ResponseBuilder().Forbidden().EmptyBody()());
+			auto decoded_path = PathTraversal::UrlDecode(path);
+			if(!IsPathSafe(decoded_path))
+				return (pimpl->EnableCORS ? uns::ResponseBuilder().Forbidden().EmptyBody().AutoCORS(request)() : uns::ResponseBuilder().Forbidden().EmptyBody()()); 
+			auto url = request->GetImpl()->webcc_req->url();
+			url.ForceSet_Path(PathTraversal::NormalizeUrlPath(decoded_path));
+			request->GetImpl()->webcc_req->set_url(std::move(url));
+			break;
+		}
+		case uns::PathTraversalDefenceLevel::AllowNormal:
+		{
+			if(status == PathTraversal::UrlSafetyStatus::EvasiveTraversal)
+				return (pimpl->EnableCORS ? uns::ResponseBuilder().Forbidden().EmptyBody().AutoCORS(request)() : uns::ResponseBuilder().Forbidden().EmptyBody()());
+			auto decoded_path = PathTraversal::UrlDecode(path);
+			if(!IsPathSafe(decoded_path))
+				return (pimpl->EnableCORS ? uns::ResponseBuilder().Forbidden().EmptyBody().AutoCORS(request)() : uns::ResponseBuilder().Forbidden().EmptyBody()()); 
+			auto url = request->GetImpl()->webcc_req->url();
+			url.ForceSet_Path(decoded_path);
+			request->GetImpl()->webcc_req->set_url(std::move(url));
+			break;
+		}
+		default:
+			break;	//Check Bypassed by [AllowAll]
+	}
+	if ((method & uns::H_PUT) || (method & uns::H_POST))
+	{
+		if (pimpl->BlockedIPs != nullptr)
+		{
+			std::string req_ip = request->GetImpl()->webcc_req->address();
+			pimpl->BlockedIPs->Update();
+			if (pimpl->BlockedIPs->IPExist(req_ip))
+				return (pimpl->EnableCORS ? uns::ResponseBuilder().IPBlocked().EmptyBody().AutoCORS(request)() : uns::ResponseBuilder().IPBlocked().EmptyBody()());
+		}
+		webcc::Status tmpStatus = uns::ConvertStatus(PreCheckRequest(request));
+		if (tmpStatus != webcc::kOK)
+			return (pimpl->EnableCORS ? uns::ResponseBuilder().Code(tmpStatus).EmptyBody().AutoCORS(request)() : uns::ResponseBuilder().Code(tmpStatus).EmptyBody()());
+		else if (!request->GetImpl()->webcc_req->IsForm())
+			return (pimpl->EnableCORS ? uns::ResponseBuilder().RequestFormatError().EmptyBody().AutoCORS(request)() : uns::ResponseBuilder().RequestFormatError().EmptyBody()());
+		else
+		{
+			for (auto& form : request->GetFormParts())
+			{
+				if (form->GetFileName().empty())
+					continue;
+				if (!PreCheckForm(form))
+					continue;
+				SCLOGF_DEBUG("File recived: [{}], {} bytes", form->GetFileName(), form->GetDataSize());
+				WebFileInfo info(form->GetFileNameS(), form->GetDataSize());
+				WriteFile(info.MakePath(pimpl->TempRoot), form->GetData());
+				pimpl->FileInfo.push_back(info);
+			}
+			std::string resp_body = (pimpl->HTMLResponse ? EncodeUploadResultHTML() : EncodeUploadResult());
+			CallFileProcesser();
+			return (pimpl->EnableCORS ? uns::ResponseBuilder().Created().Body(resp_body).AutoCORS(request)() : uns::ResponseBuilder().Created().Body(resp_body)());
+		}
+	}
+	else
+		return (pimpl->EnableCORS ? uns::ResponseBuilder().IllegalUpload().EmptyBody().AutoCORS(request)() : uns::ResponseBuilder().IllegalUpload().EmptyBody()());
+}