aboutsummaryrefslogtreecommitdiffstats
path: root/src/routes
diff options
context:
space:
mode:
authorMatt Strapp <matt@mattstrapp.net>2022-02-15 15:38:38 -0600
committerMatt Strapp <matt@mattstrapp.net>2022-02-15 15:38:38 -0600
commitebfa5e541c873dcbdaff3a82bbdc86c1997036b1 (patch)
tree7e7169cdf8d5a7dfcb8841317581788f3bc88bf2 /src/routes
parentorganize imports (diff)
downloadee4511w-web-ebfa5e541c873dcbdaff3a82bbdc86c1997036b1.tar
ee4511w-web-ebfa5e541c873dcbdaff3a82bbdc86c1997036b1.tar.gz
ee4511w-web-ebfa5e541c873dcbdaff3a82bbdc86c1997036b1.tar.bz2
ee4511w-web-ebfa5e541c873dcbdaff3a82bbdc86c1997036b1.tar.lz
ee4511w-web-ebfa5e541c873dcbdaff3a82bbdc86c1997036b1.tar.xz
ee4511w-web-ebfa5e541c873dcbdaff3a82bbdc86c1997036b1.tar.zst
ee4511w-web-ebfa5e541c873dcbdaff3a82bbdc86c1997036b1.zip
Fix bug involving missing a return
Diffstat (limited to 'src/routes')
-rw-r--r--src/routes/api.ts162
1 files changed, 81 insertions, 81 deletions
diff --git a/src/routes/api.ts b/src/routes/api.ts
index c3518d6..77b3c79 100644
--- a/src/routes/api.ts
+++ b/src/routes/api.ts
@@ -17,12 +17,12 @@ const csrf = csurf({ cookie: true });
// For file uploads
api.use(fileUpload({
- preserveExtension: true, // Preserve file extension on upload
- safeFileNames: true, // Only allow alphanumeric characters in file names
- limits: { fileSize: 1 * 1024 * 1024 }, // Limit file size to 1MB
- useTempFiles: true, // Store files in temp instead of memory
- tempFileDir: '/tmp/', // Store files in /tmp/
- debug: false, // Log debug information
+ preserveExtension: true, // Preserve file extension on upload
+ safeFileNames: true, // Only allow alphanumeric characters in file names
+ limits: { fileSize: 1 * 1024 * 1024 }, // Limit file size to 1MB
+ useTempFiles: true, // Store files in temp instead of memory
+ tempFileDir: '/tmp/', // Store files in /tmp/
+ debug: false, // Log debug information
}));
@@ -46,33 +46,33 @@ api.use(fileUpload({
500 for any other errors
*/
api.route('/upload')
- .post(csrf, (req: Request, res: Response) => {
- try {
- // Check if anything was actually uploaded
- if (!req.files || Object.keys(req.files).length === 0)
- return res.status(400).json({ error: 'No file uploaded.' });
-
- const file: UploadedFile = req.files.file as UploadedFile; // Kludge to prevent a compiler error, only one file gets uploaded so this should be fine
-
- // Check if the file is too large (see fileUpload.limits for the limit)
- if (file.truncated)
- return res.status(413).json({ error: 'File uploaded was too large.' });
-
- // Check if the file is a python file
- if (file.mimetype !== 'text/x-python')
- return res.status(415).json({ error: 'File uploaded was not a Python file.' });
-
- res.status(201).json({ file: file.name, path: file.tempFilePath, msg: 'File uploaded successfully.', csrf: req.csrfToken() });
- } catch (err) {
- // Generic error handler
- res.status(500).json({ error: 'An unknown error occurred while uploading the file.', error_msg: err });
- }
- })
- // Fallback
- .all(csrf, (req: Request, res: Response) => {
- res.set('Allow', 'POST');
- res.status(405).json({ error: 'Method not allowed.' });
- });
+ .post(csrf, (req: Request, res: Response) => {
+ try {
+ // Check if anything was actually uploaded
+ if (!req.files || Object.keys(req.files).length === 0)
+ return res.status(400).json({ error: 'No file uploaded.' });
+
+ const file: UploadedFile = req.files.file as UploadedFile; // Kludge to prevent a compiler error, only one file gets uploaded so this should be fine
+
+ // Check if the file is too large (see fileUpload.limits for the limit)
+ if (file.truncated)
+ return res.status(413).json({ error: 'File uploaded was too large.' });
+
+ // Check if the file is a python file
+ if (file.mimetype !== 'text/x-python')
+ return res.status(415).json({ error: 'File uploaded was not a Python file.' });
+
+ res.status(201).json({ file: file.name, path: file.tempFilePath, msg: 'File uploaded successfully.', csrf: req.csrfToken() });
+ } catch (err) {
+ // Generic error handler
+ res.status(500).json({ error: 'An unknown error occurred while uploading the file.', error_msg: err });
+ }
+ })
+ // Fallback
+ .all(csrf, (req: Request, res: Response) => {
+ res.set('Allow', 'POST');
+ res.status(405).json({ error: 'Method not allowed.' });
+ });
/*
Actuate the pendulum
@@ -99,54 +99,54 @@ api.route('/upload')
*/
api.route('/actuate')
- // Snyk error mitigation, should be fine since the rate limiting is already in place
- // file deepcode ignore NoRateLimitingForExpensiveWebOperation: This is already rate limited by the website, so we don't need to do it again
- .post(csrf, async (req: Request, res: Response) => {
- // Make sure the file being requested to run exists
- try {
- await access(req.body.path);
- } catch (err) {
- return res.status(403).json({ error: 'File is not accessible or does not exist.' });
- }
-
-
- const stats: Stats = await stat(req.body.path);
- // Make sure the file being requested to run is a regular file
- if (!stats.isFile())
- return res.status(400).json({ error: 'File is not a regular file.' });
- // Make sure the file being requested to run is not a directory
- if (stats.isDirectory())
- return res.status(400).json({ error: 'File is a directory.' });
-
- const escaped = quote( [ req.body.path ] );
- // Run the code
- /*
- TODO:
- - Potentially add the limiter to one-per-person here
- - Add a timeout
- - Communicate to the machine to give up (the user as well), maybe just kill the process?
- - Make this more secure
- - HOW?
- */
- let output = '';
- const actuation = spawn('python', escaped.split(' '));
- actuation.stdout.on('data', (data: Buffer) => {
- output += data.toString();
- });
- actuation.stderr.on('data', (data: Buffer) => {
- output += `STDERR: ${data.toString()}`;
- });
- actuation.on('close', (code: number) => {
- if (code !== 0)
- res.status(500).json({ error: `Program exited with exit code ${code}`, error_msg: output });
- res.status(200).json({ stdout: output });
- });
- })
- // Fallback
- .all(csrf, (req: Request, res: Response) => {
- res.set('Allow', 'POST');
- res.status(405).json({ error: 'Method not allowed.' });
+ // Snyk error mitigation, should be fine since the rate limiting is already in place
+ // file deepcode ignore NoRateLimitingForExpensiveWebOperation: This is already rate limited by the website, so we don't need to do it again
+ .post(csrf, async (req: Request, res: Response) => {
+ // Make sure the file being requested to run exists
+ try {
+ await access(req.body.path);
+ } catch (err) {
+ return res.status(403).json({ error: 'File is not accessible or does not exist.' });
+ }
+
+
+ const stats: Stats = await stat(req.body.path);
+ // Make sure the file being requested to run is a regular file
+ if (!stats.isFile())
+ return res.status(400).json({ error: 'File is not a regular file.' });
+ // Make sure the file being requested to run is not a directory
+ if (stats.isDirectory())
+ return res.status(400).json({ error: 'File is a directory.' });
+
+ const escaped = quote([req.body.path]);
+ // Run the code
+ /*
+ TODO:
+ - Potentially add the limiter to one-per-person here
+ - Add a timeout
+ - Communicate to the machine to give up (the user as well), maybe just kill the process?
+ - Make this more secure
+ - HOW?
+ */
+ let output = '';
+ const actuation = spawn('python', escaped.split(' '));
+ actuation.stdout.on('data', (data: Buffer) => {
+ output += data.toString();
+ });
+ actuation.stderr.on('data', (data: Buffer) => {
+ output += `STDERR: ${data.toString()}`;
+ });
+ actuation.on('close', (code: number) => {
+ if (code !== 0)
+ return res.status(500).json({ error: `Program exited with exit code ${code}`, error_msg: output });
+ return res.status(200).json({ stdout: output });
});
+ })
+ // Fallback
+ .all(csrf, (req: Request, res: Response) => {
+ res.set('Allow', 'POST');
+ res.status(405).json({ error: 'Method not allowed.' });
+ });
-export default api; \ No newline at end of file
+export default api;