Merge branch 'master' into jsdoc

.github/workflows/build.yml

@@ -21,9 +21,10 @@ jobs:
       - uses: actions/checkout@v3
 
       - name: Use Node.js ${{ matrix.node }}
-        uses: actions/setup-node@v1
+        uses: actions/setup-node@v4
         with:
           node-version: ${{ matrix.node }}
+          cache: 'npm'
 
       - run: npm ci
       - run: npm run build

.github/workflows/check.yml

@@ -22,9 +22,10 @@ jobs:
       - uses: actions/checkout@v3
 
       - name: Use Node.js ${{ matrix.node }}
-        uses: actions/setup-node@v1
+        uses: actions/setup-node@v4
         with:
           node-version: ${{ matrix.node }}
+          cache: npm
 
       - run: npm ci
       - run: npm run ${{ matrix.check }}

.github/workflows/codeql-analysis.yml

@@ -39,13 +39,13 @@ jobs:
 
       # Initializes the CodeQL tools for scanning.
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@v1
+        uses: github/codeql-action/init@v2
         with:
           languages: ${{ matrix.language }}
 
       # Autobuild attempts to build any compiled languages  (C/C++, C#, or Java).
       - name: Autobuild
-        uses: github/codeql-action/autobuild@v1
+        uses: github/codeql-action/autobuild@v2
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@v1
+        uses: github/codeql-action/analyze@v2

.github/workflows/distribute-debian.yml

@@ -19,10 +19,11 @@ jobs:
       - uses: actions/checkout@v3
 
       - name: Use Node.js ${{ matrix.node }}
-        uses: actions/setup-node@v1
+        uses: actions/setup-node@v4
         with:
           node-version: ${{ matrix.node }}
           registry-url: 'https://registry.npmjs.org'
+          cache: npm
 
       - name: Set up QEMU
         run: |

.github/workflows/publish-rolling.yml

@@ -17,10 +17,11 @@ jobs:
       - uses: actions/checkout@v3
 
       - name: Use Node.js ${{ matrix.node }}
-        uses: actions/setup-node@v1
+        uses: actions/setup-node@v4
         with:
           node-version: ${{ matrix.node }}
           registry-url: 'https://registry.npmjs.org'
+          cache: npm
 
       - run: npm ci
 
@@ -33,9 +34,9 @@ jobs:
           npm version --no-git-tag-version $build_version
           echo ::set-output name=BUILD_VERSION::$build_version
 
-      - name: Use @${{ github.actor }} scope
+      - name: Use @jesec scope
         run: |
-          jq '.name = "@${{ github.actor }}/flood"' package.json > package.new.json
+          jq '.name = "@jesec/flood"' package.json > package.new.json
           mv package.new.json package.json
 
       - run: npm pack
@@ -124,10 +125,11 @@ jobs:
       - uses: actions/checkout@v3
 
       - name: Use Node.js ${{ matrix.node }}
-        uses: actions/setup-node@v1
+        uses: actions/setup-node@v4
         with:
           node-version: ${{ matrix.node }}
           registry-url: 'https://registry.npmjs.org'
+          cache: npm
 
       - name: Set up QEMU
         uses: docker/setup-qemu-action@v2
@@ -177,7 +179,7 @@ jobs:
 
     steps:
       - name: Use Node.js ${{ matrix.node }}
-        uses: actions/setup-node@v1
+        uses: actions/setup-node@v4
         with:
           node-version: ${{ matrix.node }}
           registry-url: 'https://registry.npmjs.org'

.github/workflows/release.yml

@@ -17,10 +17,11 @@ jobs:
       - uses: actions/checkout@v3
 
       - name: Use Node.js ${{ matrix.node }}
-        uses: actions/setup-node@v1
+        uses: actions/setup-node@v4
         with:
           node-version: ${{ matrix.node }}
           registry-url: 'https://registry.npmjs.org'
+          cache: npm
 
       - run: sudo npm i -g pkg
       - run: npm ci

.github/workflows/test-backend.yml

@@ -10,20 +10,21 @@ on:
 
 jobs:
   test-backend:
-    runs-on: ubuntu-20.04
+    runs-on: ubuntu-22.04
 
     strategy:
       matrix:
-        node: [18, 20]
+        node: ['18', '20']
       fail-fast: false
 
     steps:
       - uses: actions/checkout@v3
 
       - name: Use Node.js ${{ matrix.node }}
-        uses: actions/setup-node@v1
+        uses: actions/setup-node@v4
         with:
           node-version: ${{ matrix.node }}
+          cache: npm
 
       - run: sudo add-apt-repository -y ppa:qbittorrent-team/qbittorrent-stable
       - run: sudo add-apt-repository -y ppa:transmissionbt/ppa
@@ -36,7 +37,7 @@ jobs:
       - run: npm ci
       - run: npm test || npm test || npm test
 
-      - uses: codecov/codecov-action@v1
+      - uses: codecov/codecov-action@v3
         if: matrix.node == 20
 
       - run: |

config.ts

@@ -35,7 +35,7 @@ const {argv: argvObj} = yargs(process.argv.slice(2))
     alias: 'p',
     default: 3000,
     describe: 'The port that Flood should listen for web connections on',
-    type: 'number',
+    type: 'string',
   })
   .option('secret', {
     alias: 's',

server/bin/web-server.ts

@@ -96,8 +96,11 @@ const startWebServer = () => {
 
   server.on('error', handleError);
   server.on('listening', handleListening);
+  process.on('exit', () => {
+    server.close();
+  });
 
-  const address = chalk.underline(`${useSSL ? 'https' : 'http'}://${host}:${port}`);
+  const address = chalk.underline(typeof port === 'string' ? port : `${useSSL ? 'https' : 'http'}://${host}:${port}`);
 
   console.log(chalk.green(`Flood server ${packageJSON.version} starting on ${address}\n`));
 

server/routes/api/torrents.ts

@@ -35,9 +35,17 @@ import {
   reannounceTorrentsSchema,
   setTorrentsTagsSchema,
 } from '../../../shared/schema/api/torrents';
-import {accessDeniedError, fileNotFoundError, isAllowedPath, sanitizePath} from '../../util/fileUtil';
+import {
+  accessDeniedError,
+  existAsync,
+  fileNotFoundError,
+  isAllowedPath,
+  isAllowedPathAsync,
+  sanitizePath,
+} from '../../util/fileUtil';
 import {getTempPath} from '../../models/TemporaryStorage';
 import {getToken} from '../../util/authUtil';
+import {asyncFilter} from '../../util/async';
 
 const getDestination = async (
   services: Express.Request['services'],
@@ -891,22 +899,22 @@ router.get<{hash: string}>(
         sanitizePath(path.join(torrentDirectory, content.path)),
       );
 
-      torrentContentPaths = torrentContentPaths.filter((contentPath) => isAllowedPath(contentPath));
+      torrentContentPaths = await asyncFilter(torrentContentPaths, (contentPath) => isAllowedPathAsync(contentPath));
       if (torrentContentPaths.length < 1) {
         const {code, message} = accessDeniedError();
         return res.status(403).json({code, message});
       }
 
-      torrentContentPaths = torrentContentPaths.filter((contentPath) => fs.existsSync(contentPath));
+      torrentContentPaths = await asyncFilter(torrentContentPaths, (contentPath) => existAsync(contentPath));
       if (torrentContentPaths.length < 1) {
         const {code, message} = fileNotFoundError();
         return res.status(404).json({code, message});
       }
 
       const mediainfoProcess = childProcess.execFile(
         'mediainfo',
-        torrentContentPaths,
-        {maxBuffer: 1024 * 2000, timeout: 1000 * 10},
+        torrentContentPaths.map((x) => path.relative(torrentDirectory, x)),
+        {maxBuffer: 1024 * 2000, timeout: 1000 * 10, cwd: torrentDirectory},
         (error, stdout) => {
           if (error) {
             return res.status(500).json({code: error.code, message: error.message});

server/util/async.ts

@@ -0,0 +1,14 @@
+export async function asyncFilter<T>(
+  array: Array<T>,
+  predicate: (item: T, index: number) => Promise<boolean>,
+): Promise<Array<T>> {
+  const results: T[] = [];
+
+  for (const [index, item] of array.entries()) {
+    if (await predicate(item, index)) {
+      results.push(item);
+    }
+  }
+
+  return results;
+}

server/util/fileUtil.ts

@@ -1,4 +1,5 @@
 import fs from 'fs';
+import {promises as fsp} from 'fs';
 import {homedir} from 'os';
 import path from 'path';
 
@@ -43,6 +44,46 @@ export const isAllowedPath = (resolvedPath: string) => {
   });
 };
 
+export async function isAllowedPathAsync(resolvedPath: string) {
+  if (config.allowedPaths == null) {
+    return true;
+  }
+
+  let realPath: string | null = null;
+  let parentPath: string = resolvedPath;
+  while (realPath == null) {
+    try {
+      realPath = await fsp.realpath(parentPath);
+    } catch (e) {
+      if ((e as NodeJS.ErrnoException).code === 'ENOENT') {
+        parentPath = path.resolve(parentPath, '..');
+      } else {
+        return false;
+      }
+    }
+  }
+
+  return config.allowedPaths.some((allowedPath) => {
+    if (realPath?.startsWith(allowedPath)) {
+      return true;
+    }
+    return false;
+  });
+}
+
+export async function existAsync(path: string): Promise<boolean> {
+  try {
+    await fsp.stat(path);
+  } catch (err: unknown) {
+    if ((err as NodeJS.ErrnoException).code === 'ENOENT') {
+      return false;
+    }
+    throw err;
+  }
+
+  return true;
+}
+
 export const sanitizePath = (input?: string): string => {
   if (typeof input !== 'string') {
     throw accessDeniedError();

shared/schema/Config.ts

@@ -67,11 +67,11 @@ export const configSchema = strictObject({
   // CLI argument: --host / -h
   // The host that Flood should listen for web connections on.
   // To listen on all interfaces, change to `floodServerHost: '0.0.0.0'`. [default: '127.0.0.1']
-  floodServerHost: string(),
+  floodServerHost: string().optional(),
 
   // CLI argument: --port / -p
-  // The port that Flood should listen for web connections on. [default: 3000]
-  floodServerPort: number().int().positive(),
+  // The port or path that Flood should listen for web connections on. [default: 3000]
+  floodServerPort: number().int().positive().or(string()),
 
   // CLI argument: --maxhistorystates
   // Flood keeps a history of torrent download and upload speeds.