openclaw/CHFS-NG
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

security: remediate review B findings

Browse Source
This commit is contained in:
kory
2026-10-03 01:37:02 +08:00
parent ca4d54d5b3
commit 56b05b11d9
11 changed files with 674 additions and 35 deletions
Download Patch File Download Diff File Expand all files Collapse all files
internal/config/config.go
+61 -18
View File
@@ -20,27 +20,36 @@ type AccountConfig struct {
}
type Config struct {
Path []string
Port int
Allow string
Rules []string
Log string
FileRemove int
ImagePreview bool
FolderDownload string
SessionTimeout int
JWTSecret string
HTMLTitle string
HTMLNotice string
UserFile string
UserHome string
SSLCert string
SSLKey string
Accounts []AccountConfig
Path []string
Port int
Allow string
TrustedProxies string
Rules []string
Log string
FileRemove int
ImagePreview bool
FolderDownload string
SessionTimeout int
JWTSecret string
HTMLTitle string
HTMLNotice string
UserFile string
UserHome string
ThumbnailMaxSize int64
ThumbnailMaxPixels int64
ZipMaxSize int64
ZipMaxFiles int
UploadMaxSize int64
UploadMaxTotalSize int64
UploadMaxFiles int
SearchMaxResults int
SSLCert string
SSLKey string
Accounts []AccountConfig
}
func Default() Config {
return Config{Path: []string{"."}, Port: 80, FileRemove: 1, ImagePreview: true, FolderDownload: "enable", SessionTimeout: 30, UserHome: "users"}
return Config{Path: []string{"."}, Port: 80, FileRemove: 1, ImagePreview: true, FolderDownload: "enable", SessionTimeout: 30, UserHome: "users", ThumbnailMaxSize: 32 << 20, ThumbnailMaxPixels: 40_000_000, ZipMaxSize: 2 << 30, ZipMaxFiles: 5000, UploadMaxSize: 2 << 30, UploadMaxTotalSize: 4 << 30, UploadMaxFiles: 100, SearchMaxResults: 500}
}
func Load(path string) (Config, error) {
@@ -101,6 +110,8 @@ func Load(path string) (Config, error) {
}
case "allow":
c.Allow = val
case "trusted-proxies":
c.TrustedProxies = val
case "rule":
if val != "" {
c.Rules = append(c.Rules, val)
@@ -133,6 +144,38 @@ func Load(path string) (Config, error) {
c.UserFile = val
case "user.home":
c.UserHome = strings.Trim(val, "/")
case "thumbnail.max-size":
if n, e := strconv.ParseInt(val, 10, 64); e == nil && n >= 0 {
c.ThumbnailMaxSize = n
}
case "thumbnail.max-pixels":
if n, e := strconv.ParseInt(val, 10, 64); e == nil && n >= 0 {
c.ThumbnailMaxPixels = n
}
case "zip.max-size":
if n, e := strconv.ParseInt(val, 10, 64); e == nil && n >= 0 {
c.ZipMaxSize = n
}
case "zip.max-files":
if n, e := strconv.Atoi(val); e == nil && n >= 0 {
c.ZipMaxFiles = n
}
case "upload.max-size":
if n, e := strconv.ParseInt(val, 10, 64); e == nil && n >= 0 {
c.UploadMaxSize = n
}
case "upload.max-total-size":
if n, e := strconv.ParseInt(val, 10, 64); e == nil && n >= 0 {
c.UploadMaxTotalSize = n
}
case "upload.max-files":
if n, e := strconv.Atoi(val); e == nil && n >= 0 {
c.UploadMaxFiles = n
}
case "search.max-results":
if n, e := strconv.Atoi(val); e == nil && n >= 0 {
c.SearchMaxResults = n
}
case "ssl.cert":
c.SSLCert = val
case "ssl.key":