kazu634/tver
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

ファイル名の上限を拡大し、動画の配信・削除を os.Root に置き換え（エピソード ID は 64 バイト上限）

Browse Source
This commit is contained in:
kazu634
2026-10-04 13:43:07 +09:00
parent f963dea2d1
commit 9b856d63fa
7 changed files with 345 additions and 115 deletions
Download Patch File Download Diff File Expand all files Collapse all files
internal/web/library.go
+18 -60
View File
@@ -7,7 +7,6 @@ import (
"os"
"path/filepath"
"strconv"
"strings"
"gitea.kazu634.com/kazu634/tver/internal/store"
"github.com/jackc/pgx/v5"
@@ -76,12 +75,13 @@ func (s *server) serveVideo(w http.ResponseWriter, r *http.Request) {
}
return
}
path, err := secureVideoPath(s.videoDir, *job.FilePath, true)
root, err := os.OpenRoot(s.videoDir)
if err != nil {
http.NotFound(w, r)
return
}
file, err := os.Open(path)
defer root.Close()
file, err := root.Open(*job.FilePath)
if err != nil {
http.NotFound(w, r)
return
@@ -93,7 +93,7 @@ func (s *server) serveVideo(w http.ResponseWriter, r *http.Request) {
return
}
w.Header().Set("Content-Type", "video/mp4")
http.ServeContent(w, r, filepath.Base(path), info.ModTime(), file)
http.ServeContent(w, r, filepath.Base(*job.FilePath), info.ModTime(), file)
}
func (s *server) deleteVideo(w http.ResponseWriter, r *http.Request) {
@@ -102,12 +102,24 @@ func (s *server) deleteVideo(w http.ResponseWriter, r *http.Request) {
return
}
if job.FilePath != nil {
path, err := secureVideoPath(s.videoDir, *job.FilePath, false)
if !filepath.IsLocal(*job.FilePath) {
http.Error(w, "動画ファイルの場所が不正です", http.StatusConflict)
return
}
root, err := os.OpenRoot(s.videoDir)
if err != nil {
http.Error(w, "動画ファイルの場所が不正です", http.StatusConflict)
return
}
if err := os.Remove(path); err != nil && !errors.Is(err, os.ErrNotExist) {
defer root.Close()
file, err := root.Open(*job.FilePath)
if err == nil {
_ = file.Close()
} else if !errors.Is(err, os.ErrNotExist) {
http.Error(w, "動画ファイルの場所が不正です", http.StatusConflict)
return
}
if err := root.Remove(*job.FilePath); err != nil && !errors.Is(err, os.ErrNotExist) {
s.logger.Printf("動画ファイルの削除に失敗: %v", err)
http.Error(w, "動画ファイルを削除できませんでした", http.StatusInternalServerError)
return
@@ -139,57 +151,3 @@ func (s *server) succeededJob(w http.ResponseWriter, r *http.Request) (store.Job
}
return job, true
}
func secureVideoPath(root, relative string, mustExist bool) (string, error) {
if relative == "" || filepath.IsAbs(relative) {
return "", errors.New("video path must be relative")
}
clean := filepath.Clean(relative)
if clean == "." || clean == ".." || strings.HasPrefix(clean, ".."+string(filepath.Separator)) {
return "", errors.New("video path leaves root")
}
rootAbs, err := filepath.Abs(root)
if err != nil {
return "", err
}
rootReal, err := filepath.EvalSymlinks(rootAbs)
if err != nil {
return "", err
}
candidate := filepath.Join(rootAbs, clean)
if err := insideRoot(rootAbs, candidate); err != nil {
return "", err
}
resolved, err := filepath.EvalSymlinks(candidate)
if err == nil {
if err := insideRoot(rootReal, resolved); err != nil {
return "", err
}
return candidate, nil
}
if mustExist || !errors.Is(err, os.ErrNotExist) {
return "", err
}
ancestor := filepath.Dir(candidate)
for {
resolvedAncestor, evalErr := filepath.EvalSymlinks(ancestor)
if evalErr == nil {
if err := insideRoot(rootReal, resolvedAncestor); err != nil {
return "", err
}
return candidate, nil
}
if !errors.Is(evalErr, os.ErrNotExist) || ancestor == rootAbs {
return "", evalErr
}
ancestor = filepath.Dir(ancestor)
}
}
func insideRoot(root, path string) error {
rel, err := filepath.Rel(root, path)
if err != nil || rel == ".." || strings.HasPrefix(rel, ".."+string(filepath.Separator)) {
return errors.New("path leaves video root")
}
return nil
}
internal/web/library_test.go
+100 -1
View File
@@ -135,7 +135,23 @@ func TestVideoPathTraversalAndSymlinkAreRejected(t *testing.T) {
if err := os.Symlink(outside, filepath.Join(dir, "linked-directory")); err != nil {
t.Fatal(err)
}
for _, relative := range []string{"../outside.mp4", "show/../../outside.mp4", outsideFile, "link.mp4", "linked-directory/outside.mp4", "linked-directory/missing.mp4"} {
relativeOutsideFile, err := filepath.Rel(dir, outsideFile)
if err != nil {
t.Fatal(err)
}
relativeOutsideDir, err := filepath.Rel(dir, outside)
if err != nil {
t.Fatal(err)
}
if err := os.Symlink(relativeOutsideFile, filepath.Join(dir, "relative-link.mp4")); err != nil {
t.Fatal(err)
}
if err := os.Symlink(relativeOutsideDir, filepath.Join(dir, "relative-linked-directory")); err != nil {
t.Fatal(err)
}
for _, relative := range []string{"../outside.mp4", "show/../../outside.mp4", outsideFile,
"link.mp4", "linked-directory/outside.mp4", "linked-directory/missing.mp4",
"relative-link.mp4", "relative-linked-directory/outside.mp4", "relative-linked-directory/missing.mp4"} {
jobs := &fakeJobStore{jobs: map[string]store.Job{"ep1": libraryJob(1, relative)}}
handler := newTestHandlerWithVideoDir(&fakeFetcher{}, jobs, dir, nil)
if got := getPage(handler, "/videos/1").Code; got != http.StatusNotFound {
@@ -146,6 +162,89 @@ func TestVideoPathTraversalAndSymlinkAreRejected(t *testing.T) {
t.Errorf("delete path %q status=%d jobs=%d", relative, deleted.Code, len(jobs.jobs))
}
}
if got, err := os.ReadFile(outsideFile); err != nil || string(got) != "secret" {
t.Fatalf("outside target was changed: content=%q err=%v", got, err)
}
for _, link := range []string{"link.mp4", "linked-directory", "relative-link.mp4", "relative-linked-directory"} {
if _, err := os.Lstat(filepath.Join(dir, link)); err != nil {
t.Errorf("rejected link %q was changed: %v", link, err)
}
}
}
func TestVideoSymlinkWithinRootCanBeServedAndDeleted(t *testing.T) {
dir := t.TempDir()
target := filepath.Join(dir, "target.mp4")
if err := os.WriteFile(target, []byte("video"), 0o644); err != nil {
t.Fatal(err)
}
if err := os.Symlink("target.mp4", filepath.Join(dir, "link.mp4")); err != nil {
t.Fatal(err)
}
jobs := &fakeJobStore{jobs: map[string]store.Job{"ep1": libraryJob(1, "link.mp4")}}
handler := newTestHandlerWithVideoDir(&fakeFetcher{}, jobs, dir, nil)
if response := getPage(handler, "/videos/1"); response.Code != http.StatusOK || response.Body.String() != "video" {
t.Fatalf("serve: status=%d body=%q", response.Code, response.Body.String())
}
if response := postForm(handler, "/library/1/delete", nil); response.Code != http.StatusSeeOther || len(jobs.jobs) != 0 {
t.Fatalf("delete: status=%d jobs=%d", response.Code, len(jobs.jobs))
}
if _, err := os.Stat(target); err != nil {
t.Fatalf("symlink target was removed: %v", err)
}
if _, err := os.Lstat(filepath.Join(dir, "link.mp4")); !errors.Is(err, os.ErrNotExist) {
t.Fatalf("symlink itself remains: %v", err)
}
}
func TestVideoSymlinkedDirectoryWithinRootCanBeServedAndDeleted(t *testing.T) {
dir := t.TempDir()
if err := os.Mkdir(filepath.Join(dir, "target"), 0o755); err != nil {
t.Fatal(err)
}
target := filepath.Join(dir, "target", "video.mp4")
if err := os.WriteFile(target, []byte("video"), 0o644); err != nil {
t.Fatal(err)
}
if err := os.Symlink("target", filepath.Join(dir, "linked-directory")); err != nil {
t.Fatal(err)
}
jobs := &fakeJobStore{jobs: map[string]store.Job{"ep1": libraryJob(1, "linked-directory/video.mp4")}}
handler := newTestHandlerWithVideoDir(&fakeFetcher{}, jobs, dir, nil)
if response := getPage(handler, "/videos/1"); response.Code != http.StatusOK || response.Body.String() != "video" {
t.Fatalf("serve: status=%d body=%q", response.Code, response.Body.String())
}
if response := postForm(handler, "/library/1/delete", nil); response.Code != http.StatusSeeOther || len(jobs.jobs) != 0 {
t.Fatalf("delete: status=%d jobs=%d", response.Code, len(jobs.jobs))
}
if _, err := os.Stat(target); !errors.Is(err, os.ErrNotExist) {
t.Fatalf("target file remains: %v", err)
}
if _, err := os.Lstat(filepath.Join(dir, "linked-directory")); err != nil {
t.Fatalf("directory symlink was removed: %v", err)
}
}
func TestVideoAbsoluteSymlinkWithinRootIsRejectedByOSRoot(t *testing.T) {
dir := t.TempDir()
target := filepath.Join(dir, "target.mp4")
if err := os.WriteFile(target, []byte("video"), 0o644); err != nil {
t.Fatal(err)
}
if err := os.Symlink(target, filepath.Join(dir, "absolute-link.mp4")); err != nil {
t.Fatal(err)
}
jobs := &fakeJobStore{jobs: map[string]store.Job{"ep1": libraryJob(1, "absolute-link.mp4")}}
handler := newTestHandlerWithVideoDir(&fakeFetcher{}, jobs, dir, nil)
if got := getPage(handler, "/videos/1").Code; got != http.StatusNotFound {
t.Fatalf("absolute symlink serve status=%d", got)
}
if response := postForm(handler, "/library/1/delete", nil); response.Code != http.StatusConflict || len(jobs.jobs) != 1 {
t.Fatalf("absolute symlink delete: status=%d jobs=%d", response.Code, len(jobs.jobs))
}
if _, err := os.Stat(target); err != nil {
t.Fatalf("target was changed: %v", err)
}
}
func TestDeleteVideoFileThenRecord(t *testing.T) {