shell/seadisk
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

修复下载文件恶意调用导致内存耗尽的问题

Browse Source
This commit is contained in:
shell committed 2026-08-02 23:23:46 +08:00
1 parent ff5917ffbd
commit e9c88a7369
1 file changed
+34 -69
Download Patch File Download Diff File Expand all files Collapse all files
include/seafile/api/seafile_api.hpp
+34 -69
View File
@@ -12,6 +12,7 @@
#include <tl/expected.hpp>
#include <ada.h>
#include <cpr/cpr.h>
#include <algorithm>
#include "account_info.hpp"
#include "auth_token.hpp"
@@ -25,10 +26,8 @@
#include "token_type.hpp"
#include "seafile/util/version.hpp"
namespace seafile::api
{
class SeaFileApi final : public ISeaFileApi
{
namespace seafile::api {
class SeaFileApi final : public ISeaFileApi {
//base url of the seafile api server
std::string base_url;
std::string token;
@@ -40,11 +39,9 @@ namespace seafile::api
* @param path url path
* @return the whole url string
*/
[[nodiscard]] std::string makeUrl(const std::string& path) const
{
[[nodiscard]] std::string makeUrl(const std::string &path) const {
auto url = ada::parse(this->base_url);
if (!url)
{
if (!url) {
return {};
}
url->set_pathname(path);
@@ -53,37 +50,30 @@ namespace seafile::api
template<typename T>
static tl::expected<T, SeafileException>
parseResponse(const cpr::Response& response)
{
if (response.error)
{
parseResponse(const cpr::Response &response) {
if (response.error) {
return tl::make_unexpected(
SeafileException(
response.error.message));
}
if (response.status_code != 200 && response.status_code != 206)
{
if (response.status_code != 200 && response.status_code != 206) {
return tl::make_unexpected(
SeafileException(
std::format("Http Error: {}",
response.status_code)));
}
try
{
try {
return nlohmann::json::parse(response.text)
.get<T>();
}
catch (const std::exception& e)
{
} catch (const std::exception &e) {
return tl::make_unexpected(
SeafileException(e.what()));
}
}
static std::string makeAuthToken(const std::string& token, const TokenType& token_type)
{
static std::string makeAuthToken(const std::string &token, const TokenType &token_type) {
return token_type == TokenType::BEARER
? std::format("Bearer {}", token)
: std::format("Token {}", token);
@@ -97,8 +87,7 @@ namespace seafile::api
* @return T if success else SeafileException
*/
template<typename T>
tl::expected<T, SeafileException> post(const std::string& path, const nlohmann::json& body)
{
tl::expected<T, SeafileException> post(const std::string &path, const nlohmann::json &body) {
const auto url = makeUrl(path);
const auto response = cpr::Post(
cpr::Url{url},
@@ -114,8 +103,7 @@ namespace seafile::api
* @brief primary constructor
* @param base_url base url of seafile server
*/
explicit SeaFileApi(std::string base_url) : base_url(std::move(base_url))
{
explicit SeaFileApi(std::string base_url) : base_url(std::move(base_url)) {
}
/**
@@ -125,25 +113,19 @@ namespace seafile::api
* @return token when success else SeafileException
*/
tl::expected<AuthToken, SeafileException>
auth(const std::string& username, const std::string& password) override
{
auth(const std::string &username, const std::string &password) override {
const nlohmann::json body = {
{"username", username},
{"password", password}
};
const auto &auth_token = this->post<AuthToken>("/api2/auth-token/", body);
if (auth_token)
{
if (auth_token) {
this->token = auth_token->token;
if (const auto& server_info = this->serverInfo())
{
if (const auto version = util::Version(server_info->version); version.major() < 11)
{
if (const auto &server_info = this->serverInfo()) {
if (const auto version = util::Version(server_info->version); version.major() < 11) {
this->token_type = TokenType::TOKEN;
}
}
else
{
} else {
return tl::make_unexpected(server_info.error());
}
}
@@ -151,8 +133,7 @@ namespace seafile::api
}
tl::expected<ServerInfo, SeafileException>
serverInfo() const override
{
serverInfo() const override {
const auto response = cpr::Get(
cpr::Url{makeUrl("/api2/server-info/")},
cpr::Header{
@@ -167,8 +148,7 @@ namespace seafile::api
* @return default repo info
*/
tl::expected<DefaultRepo, SeafileException>
defaultRepo() const override
{
defaultRepo() const override {
const auto auth = makeAuthToken(token, token_type);
const auto url = makeUrl("/api2/default-repo/");
const auto response = cpr::Get(cpr::Url{url},
@@ -180,8 +160,7 @@ namespace seafile::api
}
tl::expected<RepoInfo, SeafileException>
repoInfo(const std::string& repo_id) const override
{
repoInfo(const std::string &repo_id) const override {
const auto url = makeUrl(std::format("/api2/repos/{}/", repo_id));
const auto auth = makeAuthToken(token, token_type);
@@ -194,8 +173,7 @@ namespace seafile::api
}
tl::expected<std::vector<RepoInfo>, SeafileException>
repos(const std::string& type, const std::string& name_contains) const override
{
repos(const std::string &type, const std::string &name_contains) const override {
const auto url = makeUrl("/api2/repos/");
const auto auth = makeAuthToken(token, token_type);
const auto response = cpr::Get(cpr::Url{url},
@@ -219,8 +197,7 @@ namespace seafile::api
* @return repo entries
*/
tl::expected<std::vector<RepoEntry>, SeafileException>
repoDir(const std::string& repo_id, const std::string& path) const override
{
repoDir(const std::string &repo_id, const std::string &path) const override {
const auto url = cpr::Url{makeUrl(std::format("/api2/repos/{}/dir/", repo_id))};
const auto auth = makeAuthToken(token, token_type);
@@ -238,8 +215,7 @@ namespace seafile::api
}
tl::expected<AccountInfo, SeafileException>
accountInfo() const override
{
accountInfo() const override {
const auto url = cpr::Url{makeUrl("/api2/account/info/")};
const auto auth = makeAuthToken(token, token_type);
@@ -252,8 +228,7 @@ namespace seafile::api
}
tl::expected<FileInfo, SeafileException>
fileDetail(const std::string& repo_id, const std::string& path) const override
{
fileDetail(const std::string &repo_id, const std::string &path) const override {
const auto url = cpr::Url{makeUrl(std::format("/api2/repos/{}/file/detail/", repo_id))};
const auto auth = makeAuthToken(token, token_type);
@@ -268,8 +243,7 @@ namespace seafile::api
}
tl::expected<std::string, SeafileException>
downloadFileUrl(const std::string& repo_id, const std::string& path) const override
{
downloadFileUrl(const std::string &repo_id, const std::string &path) const override {
const auto auth = makeAuthToken(token, token_type);
const auto url = cpr::Url{makeUrl(std::format("/api2/repos/{}/file/", repo_id))};
const auto response = cpr::Get(url,
@@ -287,10 +261,8 @@ namespace seafile::api
downloadFile(const std::string &repo_id,
const std::string &path,
const std::optional<size_t> start,
const std::optional<size_t> end) const override
{
if (auto download_url = downloadFileUrl(repo_id, path); download_url.has_value())
{
const std::optional<size_t> end) const override {
if (auto download_url = downloadFileUrl(repo_id, path); download_url.has_value()) {
const auto auth = makeAuthToken(token, token_type);
const auto url = cpr::Url{download_url.value()};
auto header = cpr::Header{
@@ -303,31 +275,24 @@ namespace seafile::api
header.emplace("range", range);
size_t content_size = 1024 * 4;
if (start.has_value() && end.has_value())
{
content_size = end.value() - start.value();
if (start.has_value() && end.has_value()) {
content_size = std::min(end.value() - start.value(), 4 * 1024 * 1024ULL);
}
if (const auto &response = cpr::Get(url, header, connection_pool, cpr::ReserveSize(content_size));
response.error || (response.status_code != 200 && response.status_code != 206))
{
response.error || (response.status_code != 200 && response.status_code != 206)) {
return tl::make_unexpected(SeafileException{
std::format("Download bytes range {} failed, HTTP Error:{}", range, response.status_code)
});
}
else
{
} else {
return response.text;
}
}
else
{
} else {
return download_url;
}
}
tl::expected<DirInfo, SeafileException>
dirDetail(const std::string& repo_id, const std::string& path) const override
{
dirDetail(const std::string &repo_id, const std::string &path) const override {
const auto auth = makeAuthToken(token, token_type);
const auto url = cpr::Url{makeUrl(std::format("/api/v2.1/repos/{}/dir/detail/", repo_id))};
const auto response = cpr::Get(url, cpr::Header{