openclaw/CHFS-NG
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

test: harden multipart upload compatibility

Browse Source
This commit is contained in:
OpenClaw Agent
2026-09-22 00:17:25 +08:00
parent 05857b91a4
commit 0bdc206d6c
2 changed files with 184 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
chfs-ng/internal/api/server.go
+28 -2
View File
@@ -531,6 +531,9 @@ func (s *Server) upload(w http.ResponseWriter, r *http.Request) {
writeJSONError(w, http.StatusForbidden, "has no privilege")
return
}
// Preflight the complete multipart batch before creating anything.
// This prevents duplicate/bad entries from leaving a partial upload.
seen := make(map[string]struct{})
var saved []string
for _, hs := range r.MultipartForm.File {
for _, h := range hs {
@@ -540,6 +543,11 @@ func (s *Server) upload(w http.ResponseWriter, r *http.Request) {
return
}
target := path.Join(dir, name)
if _, ok := seen[target]; ok {
writeJSONError(w, http.StatusBadRequest, "invalid parameter")
return
}
seen[target] = struct{}{}
if _, e := s.Store.Stat(target); e == nil {
writeJSONError(w, http.StatusBadRequest, "invalid parameter")
return
@@ -547,6 +555,12 @@ func (s *Server) upload(w http.ResponseWriter, r *http.Request) {
http.Error(w, e.Error(), 500)
return
}
// Writing happens only after every part has passed validation.
}
}
for _, hs := range r.MultipartForm.File {
for _, h := range hs {
target := path.Join(dir, filepath.ToSlash(h.Filename))
if e := savePart(s.Store, target, h); e != nil {
http.Error(w, e.Error(), 500)
return
@@ -590,7 +604,9 @@ func (s *Server) upload2(w http.ResponseWriter, r *http.Request) {
http.Error(w, err.Error(), 400)
return
}
var saved []string
// Preflight the complete multipart batch before creating anything.
// This prevents duplicate/bad entries from leaving a partial upload.
seen := make(map[string]struct{})
for _, hs := range r.MultipartForm.File {
for _, h := range hs {
name := filepath.ToSlash(h.Filename)
@@ -600,6 +616,11 @@ func (s *Server) upload2(w http.ResponseWriter, r *http.Request) {
return
}
target := path.Join(dir, name)
if _, ok := seen[target]; ok {
writeJSONError(w, http.StatusBadRequest, "invalid parameter")
return
}
seen[target] = struct{}{}
if _, e := s.Store.Stat(target); e == nil {
writeJSONError(w, http.StatusBadRequest, "invalid parameter")
return
@@ -607,11 +628,16 @@ func (s *Server) upload2(w http.ResponseWriter, r *http.Request) {
http.Error(w, e.Error(), 500)
return
}
}
}
for _, hs := range r.MultipartForm.File {
for _, h := range hs {
name := strings.TrimPrefix(filepath.ToSlash(h.Filename), "/")
target := path.Join(dir, name)
if err := savePart(s.Store, target, h); err != nil {
http.Error(w, err.Error(), 500)
return
}
saved = append(saved, path.Join(dir, name))
}
}
writeCreated(w)