Contains the Concourse pipeline definition for building a line-server container
You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

356 lines
8.8 KiB

9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
  1. package main
  2. import (
  3. "bytes"
  4. "encoding/json"
  5. "errors"
  6. "fmt"
  7. "io"
  8. "net/http"
  9. "net/url"
  10. "os"
  11. "path"
  12. "path/filepath"
  13. "regexp"
  14. "strconv"
  15. "strings"
  16. "time"
  17. "bitbucket.org/taruti/mimemagic"
  18. "github.com/dchest/uniuri"
  19. "github.com/zenazn/goji/web"
  20. )
  21. var fileBlacklist = map[string]bool{
  22. "favicon.ico": true,
  23. "index.htm": true,
  24. "index.html": true,
  25. "index.php": true,
  26. "robots.txt": true,
  27. "crossdomain.xml": true,
  28. }
  29. // Describes metadata directly from the user request
  30. type UploadRequest struct {
  31. src io.Reader
  32. filename string
  33. expiry time.Duration // Seconds until expiry, 0 = never
  34. randomBarename bool
  35. deletionKey string // Empty string if not defined
  36. }
  37. // Metadata associated with a file as it would actually be stored
  38. type Upload struct {
  39. Filename string // Final filename on disk
  40. Metadata Metadata
  41. }
  42. func uploadPostHandler(c web.C, w http.ResponseWriter, r *http.Request) {
  43. if !strictReferrerCheck(r, Config.siteURL, []string{"Linx-Delete-Key", "Linx-Expiry", "Linx-Randomize", "X-Requested-With"}) {
  44. badRequestHandler(c, w, r)
  45. return
  46. }
  47. upReq := UploadRequest{}
  48. uploadHeaderProcess(r, &upReq)
  49. contentType := r.Header.Get("Content-Type")
  50. if strings.HasPrefix(contentType, "multipart/form-data") {
  51. file, headers, err := r.FormFile("file")
  52. if err != nil {
  53. oopsHandler(c, w, r, RespHTML, "Could not upload file.")
  54. return
  55. }
  56. defer file.Close()
  57. r.ParseForm()
  58. if r.Form.Get("randomize") == "true" {
  59. upReq.randomBarename = true
  60. }
  61. upReq.expiry = parseExpiry(r.Form.Get("expires"))
  62. upReq.src = file
  63. upReq.filename = headers.Filename
  64. } else {
  65. if r.FormValue("content") == "" {
  66. oopsHandler(c, w, r, RespHTML, "Empty file")
  67. return
  68. }
  69. extension := r.FormValue("extension")
  70. if extension == "" {
  71. extension = "txt"
  72. }
  73. upReq.src = strings.NewReader(r.FormValue("content"))
  74. upReq.expiry = parseExpiry(r.FormValue("expires"))
  75. upReq.filename = r.FormValue("filename") + "." + extension
  76. }
  77. upload, err := processUpload(upReq)
  78. if strings.EqualFold("application/json", r.Header.Get("Accept")) {
  79. if err != nil {
  80. oopsHandler(c, w, r, RespJSON, "Could not upload file: "+err.Error())
  81. return
  82. }
  83. js := generateJSONresponse(upload)
  84. w.Header().Set("Content-Type", "application/json; charset=UTF-8")
  85. w.Write(js)
  86. } else {
  87. if err != nil {
  88. oopsHandler(c, w, r, RespHTML, "Could not upload file: "+err.Error())
  89. return
  90. }
  91. http.Redirect(w, r, "/"+upload.Filename, 303)
  92. }
  93. }
  94. func uploadPutHandler(c web.C, w http.ResponseWriter, r *http.Request) {
  95. upReq := UploadRequest{}
  96. uploadHeaderProcess(r, &upReq)
  97. defer r.Body.Close()
  98. upReq.filename = c.URLParams["name"]
  99. upReq.src = r.Body
  100. upload, err := processUpload(upReq)
  101. if strings.EqualFold("application/json", r.Header.Get("Accept")) {
  102. if err != nil {
  103. oopsHandler(c, w, r, RespJSON, "Could not upload file: "+err.Error())
  104. return
  105. }
  106. js := generateJSONresponse(upload)
  107. w.Header().Set("Content-Type", "application/json; charset=UTF-8")
  108. w.Write(js)
  109. } else {
  110. if err != nil {
  111. oopsHandler(c, w, r, RespPLAIN, "Could not upload file: "+err.Error())
  112. return
  113. }
  114. fmt.Fprintf(w, Config.siteURL+upload.Filename)
  115. }
  116. }
  117. func uploadRemote(c web.C, w http.ResponseWriter, r *http.Request) {
  118. if Config.remoteAuthFile != "" {
  119. result, err := checkAuth(remoteAuthKeys, []byte(r.FormValue("key")))
  120. if err != nil || !result {
  121. unauthorizedHandler(c, w, r)
  122. }
  123. } else {
  124. // strict referrer checking is mandatory without remote auth keys
  125. if !strictReferrerCheck(r, Config.siteURL, []string{"Linx-Delete-Key", "Linx-Expiry", "Linx-Randomize", "X-Requested-With"}) {
  126. badRequestHandler(c, w, r)
  127. return
  128. }
  129. }
  130. if r.FormValue("url") == "" {
  131. http.Redirect(w, r, "/", 303)
  132. return
  133. }
  134. upReq := UploadRequest{}
  135. grabUrl, _ := url.Parse(r.FormValue("url"))
  136. resp, err := http.Get(grabUrl.String())
  137. if err != nil {
  138. oopsHandler(c, w, r, RespAUTO, "Could not retrieve URL")
  139. return
  140. }
  141. upReq.filename = filepath.Base(grabUrl.Path)
  142. upReq.src = resp.Body
  143. upReq.deletionKey = r.FormValue("deletekey")
  144. upReq.expiry = parseExpiry(r.FormValue("expiry"))
  145. upload, err := processUpload(upReq)
  146. if strings.EqualFold("application/json", r.Header.Get("Accept")) {
  147. if err != nil {
  148. oopsHandler(c, w, r, RespJSON, "Could not upload file: "+err.Error())
  149. return
  150. }
  151. js := generateJSONresponse(upload)
  152. w.Header().Set("Content-Type", "application/json; charset=UTF-8")
  153. w.Write(js)
  154. } else {
  155. if err != nil {
  156. oopsHandler(c, w, r, RespHTML, "Could not upload file: "+err.Error())
  157. return
  158. }
  159. http.Redirect(w, r, "/"+upload.Filename, 303)
  160. }
  161. }
  162. func uploadHeaderProcess(r *http.Request, upReq *UploadRequest) {
  163. if r.Header.Get("Linx-Randomize") == "yes" {
  164. upReq.randomBarename = true
  165. }
  166. upReq.deletionKey = r.Header.Get("Linx-Delete-Key")
  167. // Get seconds until expiry. Non-integer responses never expire.
  168. expStr := r.Header.Get("Linx-Expiry")
  169. upReq.expiry = parseExpiry(expStr)
  170. }
  171. func processUpload(upReq UploadRequest) (upload Upload, err error) {
  172. // Determine the appropriate filename, then write to disk
  173. barename, extension := barePlusExt(upReq.filename)
  174. if upReq.randomBarename || len(barename) == 0 {
  175. barename = generateBarename()
  176. }
  177. var header []byte
  178. if len(extension) == 0 {
  179. // Pull the first 512 bytes off for use in MIME detection
  180. header = make([]byte, 512)
  181. n, _ := upReq.src.Read(header)
  182. if n == 0 {
  183. return upload, errors.New("Empty file")
  184. }
  185. header = header[:n]
  186. // Determine the type of file from header
  187. mimetype := mimemagic.Match("", header)
  188. // If the mime type is in our map, use that
  189. // otherwise just use "ext"
  190. if val, exists := mimeToExtension[mimetype]; exists {
  191. extension = val
  192. } else {
  193. extension = "ext"
  194. }
  195. }
  196. upload.Filename = strings.Join([]string{barename, extension}, ".")
  197. _, err = os.Stat(path.Join(Config.filesDir, upload.Filename))
  198. fileexists := err == nil
  199. // Check if the delete key matches, in which case overwrite
  200. if fileexists {
  201. metad, merr := metadataRead(upload.Filename)
  202. if merr == nil {
  203. if upReq.deletionKey == metad.DeleteKey {
  204. fileexists = false
  205. }
  206. }
  207. }
  208. for fileexists {
  209. counter, err := strconv.Atoi(string(barename[len(barename)-1]))
  210. if err != nil {
  211. barename = barename + "1"
  212. } else {
  213. barename = barename[:len(barename)-1] + strconv.Itoa(counter+1)
  214. }
  215. upload.Filename = strings.Join([]string{barename, extension}, ".")
  216. _, err = os.Stat(path.Join(Config.filesDir, upload.Filename))
  217. fileexists = err == nil
  218. }
  219. if fileBlacklist[strings.ToLower(upload.Filename)] {
  220. return upload, errors.New("Prohibited filename")
  221. }
  222. dst, err := os.Create(path.Join(Config.filesDir, upload.Filename))
  223. if err != nil {
  224. return
  225. }
  226. defer dst.Close()
  227. // Get the rest of the metadata needed for storage
  228. var expiry time.Time
  229. if upReq.expiry == 0 {
  230. expiry = neverExpire
  231. } else {
  232. expiry = time.Now().Add(upReq.expiry)
  233. }
  234. bytes, err := io.Copy(dst, io.MultiReader(bytes.NewReader(header), upReq.src))
  235. if bytes == 0 {
  236. os.Remove(path.Join(Config.filesDir, upload.Filename))
  237. return upload, errors.New("Empty file")
  238. } else if err != nil {
  239. os.Remove(path.Join(Config.filesDir, upload.Filename))
  240. return
  241. } else if bytes > Config.maxSize {
  242. os.Remove(path.Join(Config.filesDir, upload.Filename))
  243. return upload, errors.New("File too large")
  244. }
  245. upload.Metadata, err = generateMetadata(upload.Filename, expiry, upReq.deletionKey)
  246. if err != nil {
  247. os.Remove(path.Join(Config.filesDir, upload.Filename))
  248. os.Remove(path.Join(Config.metaDir, upload.Filename))
  249. return
  250. }
  251. err = metadataWrite(upload.Filename, &upload.Metadata)
  252. if err != nil {
  253. os.Remove(path.Join(Config.filesDir, upload.Filename))
  254. os.Remove(path.Join(Config.metaDir, upload.Filename))
  255. return
  256. }
  257. return
  258. }
  259. func generateBarename() string {
  260. return uniuri.NewLenChars(8, []byte("abcdefghijklmnopqrstuvwxyz0123456789"))
  261. }
  262. func generateJSONresponse(upload Upload) []byte {
  263. js, _ := json.Marshal(map[string]string{
  264. "url": Config.siteURL + upload.Filename,
  265. "filename": upload.Filename,
  266. "delete_key": upload.Metadata.DeleteKey,
  267. "expiry": strconv.FormatInt(upload.Metadata.Expiry.Unix(), 10),
  268. "size": strconv.FormatInt(upload.Metadata.Size, 10),
  269. "mimetype": upload.Metadata.Mimetype,
  270. "sha256sum": upload.Metadata.Sha256sum,
  271. })
  272. return js
  273. }
  274. var barePlusRe = regexp.MustCompile(`[^A-Za-z0-9\-]`)
  275. func barePlusExt(filename string) (barename, extension string) {
  276. filename = strings.TrimSpace(filename)
  277. filename = strings.ToLower(filename)
  278. extension = path.Ext(filename)
  279. barename = filename[:len(filename)-len(extension)]
  280. extension = barePlusRe.ReplaceAllString(extension, "")
  281. barename = barePlusRe.ReplaceAllString(barename, "")
  282. return
  283. }
  284. func parseExpiry(expStr string) time.Duration {
  285. if expStr == "" {
  286. return 0
  287. } else {
  288. expiry, err := strconv.ParseInt(expStr, 10, 64)
  289. if err != nil {
  290. return 0
  291. } else {
  292. return time.Duration(expiry) * time.Second
  293. }
  294. }
  295. }