yeuimu
9c1106586a
- Lock public registration to first-user bootstrap (403 afterwards) - Require JwtAuthGuard on upload + whitelist png/jpg/webp/gif (SVG/XSS blocked) - Add global throttling (login/register 5/min, upload 10/min) - Add helmet security headers; serve uploads with nosniff - Replace permissive CORS (origin:true+credentials) with CORS_ORIGINS whitelist - Disable Swagger outside development; sanitize 500 error responses - Enforce 32+ char JWT_SECRET; make token expiry configurable (TOKEN_EXPIRES_IN) - Re-check user in DB on every JWT validation (revocation on user delete) - Dummy bcrypt compare to prevent login user-enumeration via timing - Map malformed BigInt inputs to 400 instead of 500 - Widen .gitignore to .env* and add apps/api/.env.example - Disable Nuxt devtools and sourcemaps
55 lines
1.8 KiB
TypeScript
55 lines
1.8 KiB
TypeScript
import {
|
|
Controller,
|
|
Post,
|
|
UseGuards,
|
|
UseInterceptors,
|
|
UploadedFile,
|
|
BadRequestException,
|
|
} from '@nestjs/common';
|
|
import { Throttle } from '@nestjs/throttler';
|
|
import { FileInterceptor } from '@nestjs/platform-express';
|
|
import { diskStorage } from 'multer';
|
|
import { extname, join } from 'path';
|
|
import { randomUUID } from 'crypto';
|
|
import { JwtAuthGuard } from '../auth/guards/jwt-auth.guard';
|
|
|
|
const UPLOAD_DIR = join(process.cwd(), 'uploads');
|
|
|
|
// Explicit safe-image whitelist. SVG is deliberately excluded: it can
|
|
// carry scripts and is served from the same origin (stored XSS).
|
|
const ALLOWED_EXTENSIONS = /\.(png|jpe?g|webp|gif)$/i;
|
|
const ALLOWED_MIMETYPES = /^image\/(png|jpe?g|webp|gif)$/i;
|
|
|
|
@UseGuards(JwtAuthGuard)
|
|
@Controller('upload')
|
|
export class UploadController {
|
|
@Post('image')
|
|
@Throttle({ default: { limit: 10, ttl: 60_000 } })
|
|
@UseInterceptors(
|
|
FileInterceptor('file', {
|
|
storage: diskStorage({
|
|
destination: UPLOAD_DIR,
|
|
filename: (_req, file, cb) => {
|
|
const ext = ALLOWED_EXTENSIONS.test(extname(file.originalname))
|
|
? extname(file.originalname).toLowerCase()
|
|
: '.png';
|
|
cb(null, `${randomUUID()}${ext}`);
|
|
},
|
|
}),
|
|
limits: { fileSize: 5 * 1024 * 1024 },
|
|
fileFilter: (_req, file, cb) => {
|
|
if (!ALLOWED_EXTENSIONS.test(file.originalname) || !ALLOWED_MIMETYPES.test(file.mimetype)) {
|
|
return cb(new BadRequestException('仅支持 png/jpg/webp/gif 图片'), false);
|
|
}
|
|
cb(null, true);
|
|
},
|
|
}),
|
|
)
|
|
uploadImage(@UploadedFile() file: Express.Multer.File) {
|
|
if (!file) {
|
|
throw new BadRequestException('请选择要上传的文件');
|
|
}
|
|
return { url: `/uploads/${file.filename}`, filename: file.filename };
|
|
}
|
|
}
|