shell/seadisk
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

修复下载文件恶意调用导致内存耗尽的问题

Browse Source
This commit is contained in:
shell committed 2026-08-02 23:23:46 +08:00
1 parent ff5917ffbd
commit e9c88a7369
1 file changed
+43 -78
Download Patch File Download Diff File Expand all files Collapse all files
include/seafile/api/seafile_api.hpp
+43 -78
View File
@@ -12,6 +12,7 @@
#include <tl/expected.hpp> #include <tl/expected.hpp>
#include <ada.h> #include <ada.h>
#include <cpr/cpr.h> #include <cpr/cpr.h>
#include <algorithm>
#include "account_info.hpp" #include "account_info.hpp"
#include "auth_token.hpp" #include "auth_token.hpp"
@@ -25,10 +26,8 @@
#include "token_type.hpp" #include "token_type.hpp"
#include "seafile/util/version.hpp" #include "seafile/util/version.hpp"
namespace seafile::api namespace seafile::api {
{ class SeaFileApi final : public ISeaFileApi {
class SeaFileApi final : public ISeaFileApi
{
//base url of the seafile api server //base url of the seafile api server
std::string base_url; std::string base_url;
std::string token; std::string token;
@@ -40,50 +39,41 @@ namespace seafile::api
* @param path url path * @param path url path
* @return the whole url string * @return the whole url string
*/ */
[[nodiscard]] std::string makeUrl(const std::string& path) const [[nodiscard]] std::string makeUrl(const std::string &path) const {
{
auto url = ada::parse(this->base_url); auto url = ada::parse(this->base_url);
if (!url) if (!url) {
{
return {}; return {};
} }
url->set_pathname(path); url->set_pathname(path);
return std::string(url->get_href()); return std::string(url->get_href());
} }
template <typename T> template<typename T>
static tl::expected<T, SeafileException> static tl::expected<T, SeafileException>
parseResponse(const cpr::Response& response) parseResponse(const cpr::Response &response) {
{ if (response.error) {
if (response.error)
{
return tl::make_unexpected( return tl::make_unexpected(
SeafileException( SeafileException(
response.error.message)); response.error.message));
} }
if (response.status_code != 200 && response.status_code != 206) if (response.status_code != 200 && response.status_code != 206) {
{
return tl::make_unexpected( return tl::make_unexpected(
SeafileException( SeafileException(
std::format("Http Error: {}", std::format("Http Error: {}",
response.status_code))); response.status_code)));
} }
try try {
{
return nlohmann::json::parse(response.text) return nlohmann::json::parse(response.text)
.get<T>(); .get<T>();
} } catch (const std::exception &e) {
catch (const std::exception& e)
{
return tl::make_unexpected( return tl::make_unexpected(
SeafileException(e.what())); SeafileException(e.what()));
} }
} }
static std::string makeAuthToken(const std::string& token, const TokenType& token_type) static std::string makeAuthToken(const std::string &token, const TokenType &token_type) {
{
return token_type == TokenType::BEARER return token_type == TokenType::BEARER
? std::format("Bearer {}", token) ? std::format("Bearer {}", token)
: std::format("Token {}", token); : std::format("Token {}", token);
@@ -96,9 +86,8 @@ namespace seafile::api
* @param body post body data * @param body post body data
* @return T if success else SeafileException * @return T if success else SeafileException
*/ */
template <typename T> template<typename T>
tl::expected<T, SeafileException> post(const std::string& path, const nlohmann::json& body) tl::expected<T, SeafileException> post(const std::string &path, const nlohmann::json &body) {
{
const auto url = makeUrl(path); const auto url = makeUrl(path);
const auto response = cpr::Post( const auto response = cpr::Post(
cpr::Url{url}, cpr::Url{url},
@@ -114,8 +103,7 @@ namespace seafile::api
* @brief primary constructor * @brief primary constructor
* @param base_url base url of seafile server * @param base_url base url of seafile server
*/ */
explicit SeaFileApi(std::string base_url) : base_url(std::move(base_url)) explicit SeaFileApi(std::string base_url) : base_url(std::move(base_url)) {
{
} }
/** /**
@@ -125,25 +113,19 @@ namespace seafile::api
* @return token when success else SeafileException * @return token when success else SeafileException
*/ */
tl::expected<AuthToken, SeafileException> tl::expected<AuthToken, SeafileException>
auth(const std::string& username, const std::string& password) override auth(const std::string &username, const std::string &password) override {
{
const nlohmann::json body = { const nlohmann::json body = {
{"username", username}, {"username", username},
{"password", password} {"password", password}
}; };
const auto& auth_token = this->post<AuthToken>("/api2/auth-token/", body); const auto &auth_token = this->post<AuthToken>("/api2/auth-token/", body);
if (auth_token) if (auth_token) {
{
this->token = auth_token->token; this->token = auth_token->token;
if (const auto& server_info = this->serverInfo()) if (const auto &server_info = this->serverInfo()) {
{ if (const auto version = util::Version(server_info->version); version.major() < 11) {
if (const auto version = util::Version(server_info->version); version.major() < 11)
{
this->token_type = TokenType::TOKEN; this->token_type = TokenType::TOKEN;
} }
} } else {
else
{
return tl::make_unexpected(server_info.error()); return tl::make_unexpected(server_info.error());
} }
} }
@@ -151,8 +133,7 @@ namespace seafile::api
} }
tl::expected<ServerInfo, SeafileException> tl::expected<ServerInfo, SeafileException>
serverInfo() const override serverInfo() const override {
{
const auto response = cpr::Get( const auto response = cpr::Get(
cpr::Url{makeUrl("/api2/server-info/")}, cpr::Url{makeUrl("/api2/server-info/")},
cpr::Header{ cpr::Header{
@@ -167,8 +148,7 @@ namespace seafile::api
* @return default repo info * @return default repo info
*/ */
tl::expected<DefaultRepo, SeafileException> tl::expected<DefaultRepo, SeafileException>
defaultRepo() const override defaultRepo() const override {
{
const auto auth = makeAuthToken(token, token_type); const auto auth = makeAuthToken(token, token_type);
const auto url = makeUrl("/api2/default-repo/"); const auto url = makeUrl("/api2/default-repo/");
const auto response = cpr::Get(cpr::Url{url}, const auto response = cpr::Get(cpr::Url{url},
@@ -180,8 +160,7 @@ namespace seafile::api
} }
tl::expected<RepoInfo, SeafileException> tl::expected<RepoInfo, SeafileException>
repoInfo(const std::string& repo_id) const override repoInfo(const std::string &repo_id) const override {
{
const auto url = makeUrl(std::format("/api2/repos/{}/", repo_id)); const auto url = makeUrl(std::format("/api2/repos/{}/", repo_id));
const auto auth = makeAuthToken(token, token_type); const auto auth = makeAuthToken(token, token_type);
@@ -194,8 +173,7 @@ namespace seafile::api
} }
tl::expected<std::vector<RepoInfo>, SeafileException> tl::expected<std::vector<RepoInfo>, SeafileException>
repos(const std::string& type, const std::string& name_contains) const override repos(const std::string &type, const std::string &name_contains) const override {
{
const auto url = makeUrl("/api2/repos/"); const auto url = makeUrl("/api2/repos/");
const auto auth = makeAuthToken(token, token_type); const auto auth = makeAuthToken(token, token_type);
const auto response = cpr::Get(cpr::Url{url}, const auto response = cpr::Get(cpr::Url{url},
@@ -209,7 +187,7 @@ namespace seafile::api
}, connection_pool); }, connection_pool);
return parseResponse<std::vector<RepoInfo>>(response); return parseResponse<std::vector<RepoInfo> >(response);
} }
/** /**
@@ -219,8 +197,7 @@ namespace seafile::api
* @return repo entries * @return repo entries
*/ */
tl::expected<std::vector<RepoEntry>, SeafileException> tl::expected<std::vector<RepoEntry>, SeafileException>
repoDir(const std::string& repo_id, const std::string& path) const override repoDir(const std::string &repo_id, const std::string &path) const override {
{
const auto url = cpr::Url{makeUrl(std::format("/api2/repos/{}/dir/", repo_id))}; const auto url = cpr::Url{makeUrl(std::format("/api2/repos/{}/dir/", repo_id))};
const auto auth = makeAuthToken(token, token_type); const auto auth = makeAuthToken(token, token_type);
@@ -234,12 +211,11 @@ namespace seafile::api
}, },
connection_pool, connection_pool,
cpr::ReserveSize(512 * 1024)); cpr::ReserveSize(512 * 1024));
return parseResponse<std::vector<RepoEntry>>(response); return parseResponse<std::vector<RepoEntry> >(response);
} }
tl::expected<AccountInfo, SeafileException> tl::expected<AccountInfo, SeafileException>
accountInfo() const override accountInfo() const override {
{
const auto url = cpr::Url{makeUrl("/api2/account/info/")}; const auto url = cpr::Url{makeUrl("/api2/account/info/")};
const auto auth = makeAuthToken(token, token_type); const auto auth = makeAuthToken(token, token_type);
@@ -252,8 +228,7 @@ namespace seafile::api
} }
tl::expected<FileInfo, SeafileException> tl::expected<FileInfo, SeafileException>
fileDetail(const std::string& repo_id, const std::string& path) const override fileDetail(const std::string &repo_id, const std::string &path) const override {
{
const auto url = cpr::Url{makeUrl(std::format("/api2/repos/{}/file/detail/", repo_id))}; const auto url = cpr::Url{makeUrl(std::format("/api2/repos/{}/file/detail/", repo_id))};
const auto auth = makeAuthToken(token, token_type); const auto auth = makeAuthToken(token, token_type);
@@ -268,8 +243,7 @@ namespace seafile::api
} }
tl::expected<std::string, SeafileException> tl::expected<std::string, SeafileException>
downloadFileUrl(const std::string& repo_id, const std::string& path) const override downloadFileUrl(const std::string &repo_id, const std::string &path) const override {
{
const auto auth = makeAuthToken(token, token_type); const auto auth = makeAuthToken(token, token_type);
const auto url = cpr::Url{makeUrl(std::format("/api2/repos/{}/file/", repo_id))}; const auto url = cpr::Url{makeUrl(std::format("/api2/repos/{}/file/", repo_id))};
const auto response = cpr::Get(url, const auto response = cpr::Get(url,
@@ -284,13 +258,11 @@ namespace seafile::api
tl::expected<std::string, SeafileException> tl::expected<std::string, SeafileException>
downloadFile(const std::string& repo_id, downloadFile(const std::string &repo_id,
const std::string& path, const std::string &path,
const std::optional<size_t> start, const std::optional<size_t> start,
const std::optional<size_t> end) const override const std::optional<size_t> end) const override {
{ if (auto download_url = downloadFileUrl(repo_id, path); download_url.has_value()) {
if (auto download_url = downloadFileUrl(repo_id, path); download_url.has_value())
{
const auto auth = makeAuthToken(token, token_type); const auto auth = makeAuthToken(token, token_type);
const auto url = cpr::Url{download_url.value()}; const auto url = cpr::Url{download_url.value()};
auto header = cpr::Header{ auto header = cpr::Header{
@@ -303,31 +275,24 @@ namespace seafile::api
header.emplace("range", range); header.emplace("range", range);
size_t content_size = 1024 * 4; size_t content_size = 1024 * 4;
if (start.has_value() && end.has_value()) if (start.has_value() && end.has_value()) {
{ content_size = std::min(end.value() - start.value(), 4 * 1024 * 1024ULL);
content_size = end.value() - start.value();
} }
if (const auto& response = cpr::Get(url, header, connection_pool, cpr::ReserveSize(content_size)); if (const auto &response = cpr::Get(url, header, connection_pool, cpr::ReserveSize(content_size));
response.error || (response.status_code != 200 && response.status_code != 206)) response.error || (response.status_code != 200 && response.status_code != 206)) {
{
return tl::make_unexpected(SeafileException{ return tl::make_unexpected(SeafileException{
std::format("Download bytes range {} failed, HTTP Error:{}", range, response.status_code) std::format("Download bytes range {} failed, HTTP Error:{}", range, response.status_code)
}); });
} } else {
else
{
return response.text; return response.text;
} }
} } else {
else
{
return download_url; return download_url;
} }
} }
tl::expected<DirInfo, SeafileException> tl::expected<DirInfo, SeafileException>
dirDetail(const std::string& repo_id, const std::string& path) const override dirDetail(const std::string &repo_id, const std::string &path) const override {
{
const auto auth = makeAuthToken(token, token_type); const auto auth = makeAuthToken(token, token_type);
const auto url = cpr::Url{makeUrl(std::format("/api/v2.1/repos/{}/dir/detail/", repo_id))}; const auto url = cpr::Url{makeUrl(std::format("/api/v2.1/repos/{}/dir/detail/", repo_id))};
const auto response = cpr::Get(url, cpr::Header{ const auto response = cpr::Get(url, cpr::Header{