224 | {info}
225 |
249 | {footer}
250 |
232 |
247 | {submitter}
248 | {errorState.content}
45 |')).toBeGreaterThan(-1)
55 |
56 | const bigMd = "1".repeat(1024 * 1024)
57 | const bigUrl = (await upload(ctx, { c: bigMd })).url
58 | const bigResp = await (await workerFetch(ctx, addRole(bigUrl, "a"))).text()
59 | expect(bigResp.indexOf("Untitled")).toBeGreaterThan(-1)
60 | })
61 |
62 | test("meta with role m", async () => {
63 | beforeEach(vi.useFakeTimers)
64 | afterEach(vi.useRealTimers)
65 | const t1 = new Date(2035, 0, 0)
66 | vi.setSystemTime(t1)
67 |
68 | const content = `# Hello`
69 | const ctx = createExecutionContext()
70 | const uploadResp = await upload(ctx, { c: content })
71 | expect(new Date(uploadResp.expireAt).getTime()).toStrictEqual(t1.getTime() + uploadResp.expirationSeconds * 1000)
72 | const url = uploadResp.url
73 |
74 | const metaResponse = await workerFetch(ctx, addRole(url, "m"))
75 | expect(metaResponse.status).toStrictEqual(200)
76 | expect(metaResponse.headers.get("Content-Type")).toStrictEqual("application/json;charset=UTF-8")
77 | const meta: MetaResponse = await metaResponse.json()
78 |
79 | expect(meta.location).toStrictEqual("KV")
80 | expect(meta.filename).toBeUndefined()
81 | expect(new Date(meta.lastModifiedAt).getTime()).toStrictEqual(t1.getTime())
82 | expect(new Date(meta.createdAt).getTime()).toStrictEqual(t1.getTime())
83 |
84 | const t2 = new Date(2035, 0, 1)
85 | vi.setSystemTime(t2)
86 | const updateResp = await upload(ctx, { c: content, e: "1d" }, { method: "PUT", url: uploadResp.manageUrl })
87 | expect(new Date(updateResp.expireAt).getTime()).toStrictEqual(t2.getTime() + updateResp.expirationSeconds * 1000)
88 | const updatedMeta: MetaResponse = await (await workerFetch(ctx, addRole(url, "m"))).json()
89 | expect(new Date(updatedMeta.lastModifiedAt).getTime()).toStrictEqual(t2.getTime())
90 | expect(new Date(updatedMeta.createdAt).getTime()).toStrictEqual(t1.getTime())
91 | })
92 |
93 | describe("url redirect with role u", () => {
94 | const ctx = createExecutionContext()
95 | it("should redirect", async () => {
96 | const contentUrl = "https://example.com:1234/abc-def?g=hi&jk=l"
97 | const uploadResp = await upload(ctx, { c: contentUrl })
98 | const url = uploadResp.url
99 |
100 | const resp = await workerFetch(ctx, addRole(url, "u"))
101 | expect(resp.status).toStrictEqual(302)
102 | expect(resp.headers.get("location")).toStrictEqual(contentUrl)
103 | })
104 |
105 | it("should refuse illegal url", async () => {
106 | const contentUrl = "xxxx"
107 | const uploadResp = await upload(ctx, { c: contentUrl })
108 | const url = uploadResp.url
109 |
110 | const resp = await workerFetch(ctx, addRole(url, "u"))
111 | expect(resp.status).toStrictEqual(400)
112 | })
113 |
114 | it("should refuse overlong url", async () => {
115 | const contentUrl = genRandStr(4096)
116 | const uploadResp = await upload(ctx, { c: contentUrl })
117 | const url = uploadResp.url
118 |
119 | const resp = await workerFetch(ctx, addRole(url, "u"))
120 | expect(resp.status).toStrictEqual(400)
121 | })
122 | })
123 |
--------------------------------------------------------------------------------
/worker/handlers/handleMPU.ts:
--------------------------------------------------------------------------------
1 | import { MPUCreateResponse } from "../../shared/interfaces.js"
2 | import { NAME_REGEX, PASTE_NAME_LEN, PRIVATE_PASTE_NAME_LEN } from "../../shared/constants.js"
3 | import { genRandStr, WorkerError } from "../common.js"
4 | import { getPasteMetadata, pasteNameAvailable } from "../storage/storage.js"
5 | import { parseSize } from "../../shared/parsers.js"
6 |
7 | // POST /mpu/create?n=&p=
8 | // returns JSON { name: string, key: string, uploadId: string }
9 | export async function handleMPUCreate(request: Request, env: Env): Promise {
10 | const url = new URL(request.url)
11 | const n = url.searchParams.get("n")
12 | const isPrivate = url.searchParams.get("p") !== null
13 |
14 | let name: string | undefined
15 | if (n) {
16 | if (!NAME_REGEX.test(n)) {
17 | throw new WorkerError(400, `illegal paste name ‘${n}’ for MPU create`)
18 | }
19 | name = "~" + n
20 | if (!(await pasteNameAvailable(env, n))) {
21 | throw new WorkerError(409, `name ‘${name}’ is already used`)
22 | }
23 | } else {
24 | name = genRandStr(isPrivate ? PRIVATE_PASTE_NAME_LEN : PASTE_NAME_LEN)
25 | }
26 |
27 | const multipartUpload = await env.R2.createMultipartUpload(name)
28 | const resp: MPUCreateResponse = {
29 | name,
30 | key: multipartUpload.key,
31 | uploadId: multipartUpload.uploadId,
32 | }
33 | return new Response(JSON.stringify(resp))
34 | }
35 |
36 | // POST /mpu/create-update?name=&password=
37 | // returns JSON { name: string, key: string, uploadId: string }
38 | export async function handleMPUCreateUpdate(request: Request, env: Env): Promise {
39 | const url = new URL(request.url)
40 | const name = url.searchParams.get("name")
41 | const password = url.searchParams.get("password")
42 | if (name === null || password === null) {
43 | throw new WorkerError(400, `missing name or password (password) in searchParams`)
44 | }
45 |
46 | const metadata = await getPasteMetadata(env, name)
47 | if (metadata === null) {
48 | throw new WorkerError(404, `paste of name ‘${name}’ is not found`)
49 | }
50 | if (password !== metadata.passwd) {
51 | throw new WorkerError(403, `incorrect password for paste ‘${name}’`)
52 | }
53 |
54 | const multipartUpload = await env.R2.createMultipartUpload(name)
55 | const resp: MPUCreateResponse = {
56 | name,
57 | key: multipartUpload.key,
58 | uploadId: multipartUpload.uploadId,
59 | }
60 | return new Response(JSON.stringify(resp))
61 | }
62 |
63 | // PUT /mpu/resume?key=&uploadId=&partNumber=
64 | // return JSON { partNumber: number, etag: string }
65 | export async function handleMPUResume(request: Request, env: Env): Promise {
66 | const url = new URL(request.url)
67 |
68 | const uploadId = url.searchParams.get("uploadId")
69 | const partNumberString = url.searchParams.get("partNumber")
70 | const key = url.searchParams.get("key")
71 | if (partNumberString === null || uploadId === null || key === null) {
72 | throw new WorkerError(400, "missing partNumber or uploadId or key in searchParams")
73 | }
74 | if (request.body === null) {
75 | throw new WorkerError(400, "missing request body")
76 | }
77 |
78 | const partNumber = parseInt(partNumberString)
79 | const multipartUpload = env.R2.resumeMultipartUpload(key, uploadId)
80 | const uploadedPart: R2UploadedPart = await multipartUpload.uploadPart(partNumber, request.body)
81 | return new Response(JSON.stringify(uploadedPart))
82 | }
83 |
84 | // POST /mpu/complete?name=&key=&uploadId=
85 | // formdata same as POST/PUT a normal paste, but
86 | // - field `c` is interpreted as JSON { partNumber: number, etag: string }[]
87 | // - field `n` is ignored
88 | export async function handleMPUComplete(request: Request, env: Env, completeBody: R2UploadedPart[]): Promise {
89 | const url = new URL(request.url)
90 | const uploadId = url.searchParams.get("uploadId")
91 | const key = url.searchParams.get("key")
92 | const name = url.searchParams.get("name")
93 | if (uploadId === null || key === null || name === null) {
94 | throw new WorkerError(400, `no uploadId or key for MPU complete`)
95 | }
96 |
97 | const multipartUpload = env.R2.resumeMultipartUpload(key, uploadId)
98 | if (name !== multipartUpload.key) {
99 | throw new WorkerError(400, `name ‘${name}’ is not consistent with the originally specified name`)
100 | }
101 |
102 | const object = await multipartUpload.complete(completeBody)
103 | if (object.size > parseSize(env.R2_MAX_ALLOWED)!) {
104 | await env.R2.delete(object.key)
105 | throw new WorkerError(413, `payload too large (max ${parseSize(env.R2_MAX_ALLOWED)!} bytes allowed)`)
106 | }
107 | return object
108 | }
109 |
--------------------------------------------------------------------------------
/frontend/components/PasteInputPanel.tsx:
--------------------------------------------------------------------------------
1 | import { Card, CardBody, CardProps, Tab, Tabs } from "@heroui/react"
2 | import React, { useRef, useState, DragEvent } from "react"
3 | import { formatSize } from "../utils/utils.js"
4 | import { XIcon } from "./icons.js"
5 | import { cardOverrides, tst } from "../utils/overrides.js"
6 | import { CodeEditor } from "./CodeEditor.js"
7 |
8 | export type EditKind = "edit" | "file"
9 |
10 | export type PasteEditState = {
11 | editKind: EditKind
12 | editContent: string
13 | editFilename?: string
14 | editHighlightLang?: string
15 | file: File | null
16 | }
17 |
18 | interface PasteEditorProps extends CardProps {
19 | isPasteLoading: boolean
20 | state: PasteEditState
21 | onStateChange: (state: PasteEditState) => void
22 | }
23 |
24 | export function PasteInputPanel({ isPasteLoading, state, onStateChange, ...rest }: PasteEditorProps) {
25 | const fileInput = useRef(null)
26 | const [isDragged, setDragged] = useState(false)
27 |
28 | function setFile(file: File | null) {
29 | onStateChange({ ...state, editKind: "file", file })
30 | }
31 |
32 | function onDrop(e: DragEvent) {
33 | e.preventDefault()
34 | const items = e.dataTransfer?.items
35 | if (items) {
36 | for (let i = 0; i < items.length; i++) {
37 | if (items[i].kind === "file") {
38 | const file = items[i].getAsFile()!
39 | setFile(file)
40 | break
41 | }
42 | }
43 | }
44 | setDragged(false)
45 | }
46 |
47 | return (
48 |
49 |
50 | {
60 | onStateChange({ ...state, editKind: k as EditKind })
61 | }}
62 | >
63 | {/*Possibly a bug of chrome, but Tab sometimes has a transient unexpected scrollbar when resizing*/}
64 |
65 | onStateChange({ ...state, editContent: k })}
68 | lang={state.editHighlightLang}
69 | setLang={(lang) => onStateChange({ ...state, editHighlightLang: lang })}
70 | filename={state.editFilename}
71 | setFilename={(name) => onStateChange({ ...state, editFilename: name })}
72 | disabled={isPasteLoading}
73 | placeholder={isPasteLoading ? "Loading..." : "Edit your paste here"}
74 | />
75 |
76 |
77 | setDragged(true)}
86 | onDragLeave={() => setDragged(false)}
87 | onDragOver={(e) => {
88 | e.preventDefault()
89 | setDragged(true)
90 | }}
91 | onClick={() => fileInput.current?.click()}
92 | >
93 | {
98 | const files = e.target.files
99 | if (files && files.length) {
100 | setFile(files[0])
101 | }
102 | }}
103 | />
104 | Select File
105 |
106 |
107 | {state.file !== null
108 | ? `${state.file.name} (${formatSize(state.file.size)})`
109 | : "Click or drag & drop file here"}
110 |
111 |
112 | {state.file && (
113 | {
118 | e.stopPropagation()
119 | setFile(null)
120 | }}
121 | />
122 | )}
123 |
124 |
125 |
126 |
127 |
128 | )
129 | }
130 |
--------------------------------------------------------------------------------
/frontend/components/icons.tsx:
--------------------------------------------------------------------------------
1 | import { HTMLAttributes } from "react"
2 |
3 | export const MoonIcon = (props: HTMLAttributes) => (
4 |
19 | )
20 |
21 | export const SunIcon = (props: HTMLAttributes) => (
22 |
36 | )
37 |
38 | export const ComputerIcon = (props: HTMLAttributes) => (
39 |
53 | )
54 |
55 | export const XIcon = (props: HTMLAttributes) => (
56 |
70 | )
71 |
72 | export const DownloadIcon = (props: HTMLAttributes) => (
73 |
87 | )
88 |
89 | export const CopyIcon = (props: HTMLAttributes) => (
90 |
104 | )
105 |
106 | export const CheckIcon = (props: HTMLAttributes) => (
107 |
117 | )
118 |
119 | export const InfoIcon = (props: HTMLAttributes) => (
120 |
134 | )
135 |
136 | export const HomeIcon = (props: HTMLAttributes) => (
137 |
151 | )
152 |
--------------------------------------------------------------------------------
/shared/uploadPaste.ts:
--------------------------------------------------------------------------------
1 | // we will move this file to a shared directory later
2 |
3 | import { MPUCreateResponse, PasteResponse } from "./interfaces.js"
4 | import type { EncryptionScheme } from "../frontend/utils/encryption.js"
5 | import { parsePath } from "./parsers.js"
6 |
7 | export class UploadError extends Error {
8 | public statusCode: number
9 |
10 | constructor(statusCode: number, msg: string) {
11 | super(msg)
12 | this.statusCode = statusCode
13 | }
14 | }
15 |
16 | export type UploadOptions = {
17 | content: File
18 | isUpdate: boolean
19 |
20 | // we allow it to be undefined for convenience
21 | isPrivate?: boolean
22 |
23 | password?: string
24 | name?: string
25 |
26 | highlightLanguage?: string
27 | encryptionScheme?: EncryptionScheme
28 | expire?: string
29 | manageUrl?: string
30 | }
31 |
32 | // note that apiUrl should be manageUrl when isUpload
33 | export async function uploadNormal(
34 | apiUrl: string,
35 | {
36 | content,
37 | isUpdate,
38 | isPrivate,
39 | password,
40 | name,
41 | highlightLanguage,
42 | encryptionScheme,
43 | expire,
44 | manageUrl,
45 | }: UploadOptions,
46 | ): Promise {
47 | const fd = new FormData()
48 |
49 | // typescript cannot handle overload on union types
50 | fd.set("c", content)
51 |
52 | if (isUpdate && manageUrl === undefined) {
53 | throw TypeError("uploadMPU: no manageUrl specified in update")
54 | }
55 |
56 | if (expire !== undefined) fd.set("e", expire)
57 | if (password !== undefined) fd.set("s", password)
58 | if (!isUpdate && name !== undefined) fd.set("n", name)
59 | if (encryptionScheme !== undefined) fd.set("encryption-scheme", encryptionScheme)
60 | if (highlightLanguage !== undefined) fd.set("lang", highlightLanguage)
61 | if (isPrivate) fd.set("p", "1")
62 |
63 | const resp = isUpdate
64 | ? await fetch(manageUrl!, {
65 | method: "PUT",
66 | body: fd,
67 | })
68 | : await fetch(apiUrl, {
69 | method: "POST",
70 | body: fd,
71 | })
72 |
73 | if (!resp.ok) {
74 | throw new UploadError(resp.status, await resp.text())
75 | }
76 |
77 | return await resp.json()
78 | }
79 |
80 | export async function uploadMPU(
81 | apiUrl: string,
82 | chunkSize: number,
83 | {
84 | content,
85 | isUpdate,
86 | isPrivate,
87 | password,
88 | name,
89 | highlightLanguage,
90 | encryptionScheme,
91 | expire,
92 | manageUrl,
93 | }: UploadOptions,
94 | progressCallback?: (doneBytes: number, allBytes: number) => void,
95 | ) {
96 | const createReqUrl = isUpdate ? new URL(`${apiUrl}/mpu/create-update`) : new URL(`${apiUrl}/mpu/create`)
97 | if (!isUpdate) {
98 | if (name !== undefined) {
99 | createReqUrl.searchParams.set("n", name)
100 | }
101 | if (isPrivate) {
102 | createReqUrl.searchParams.set("p", "1")
103 | }
104 | } else {
105 | if (manageUrl === undefined) {
106 | throw TypeError("uploadMPU: no manageUrl specified in update")
107 | }
108 | const { name: nameFromUrl, password: passwordFromUrl } = parsePath(new URL(manageUrl).pathname)
109 | if (passwordFromUrl === undefined) {
110 | throw TypeError("uploadMPU: password not specified in manageUrl")
111 | }
112 | createReqUrl.searchParams.set("name", nameFromUrl)
113 | createReqUrl.searchParams.set("password", passwordFromUrl)
114 | }
115 |
116 | const createReqResp = await fetch(createReqUrl, { method: "POST" })
117 | if (!createReqResp.ok) {
118 | throw new UploadError(createReqResp.status, await createReqResp.text())
119 | }
120 | const createResp: MPUCreateResponse = await createReqResp.json()
121 |
122 | const numParts = Math.ceil(content.size / chunkSize)
123 |
124 | // TODO: parallelize
125 | const uploadedParts: R2UploadedPart[] = []
126 | let uploadedBytes = 0
127 | for (let i = 0; i < numParts; i++) {
128 | const resumeUrl = new URL(`${apiUrl}/mpu/resume`)
129 | resumeUrl.searchParams.set("key", createResp.key)
130 | resumeUrl.searchParams.set("uploadId", createResp.uploadId)
131 | resumeUrl.searchParams.set("partNumber", (i + 1).toString()) // because partNumber need to nonzero
132 | const chunk = content.slice(i * chunkSize, (i + 1) * chunkSize)
133 | const resumeReqResp = await fetch(resumeUrl, { method: "PUT", body: chunk })
134 | if (!resumeReqResp.ok) {
135 | throw new UploadError(resumeReqResp.status, await resumeReqResp.text())
136 | }
137 | const resumeResp: R2UploadedPart = await resumeReqResp.json()
138 | uploadedParts.push(resumeResp)
139 | uploadedBytes += chunk.size
140 | if (progressCallback) {
141 | progressCallback(uploadedBytes, content.size)
142 | }
143 | }
144 |
145 | const completeFormData = new FormData()
146 | const completeUrl = new URL(`${apiUrl}/mpu/complete`)
147 | completeUrl.searchParams.set("name", createResp.name)
148 | completeUrl.searchParams.set("key", createResp.key)
149 | completeUrl.searchParams.set("uploadId", createResp.uploadId)
150 | completeFormData.set("c", new File([JSON.stringify(uploadedParts)], content.name))
151 | if (expire !== undefined) {
152 | completeFormData.set("e", expire)
153 | }
154 | if (password !== undefined) {
155 | completeFormData.set("s", password)
156 | }
157 | if (highlightLanguage !== undefined) {
158 | completeFormData.set("lang", highlightLanguage)
159 | }
160 | if (encryptionScheme !== undefined) {
161 | completeFormData.set("encryption-scheme", encryptionScheme)
162 | }
163 | const completeReqResp = await fetch(completeUrl, {
164 | method: isUpdate ? "PUT" : "POST",
165 | body: completeFormData,
166 | })
167 | if (!completeReqResp.ok) {
168 | throw new UploadError(completeReqResp.status, await completeReqResp.text())
169 | }
170 | const completeResp: PasteResponse = await completeReqResp.json()
171 | return completeResp
172 | }
173 |
--------------------------------------------------------------------------------
/frontend/components/PasteSettingPanel.tsx:
--------------------------------------------------------------------------------
1 | import {
2 | Card,
3 | CardBody,
4 | CardHeader,
5 | CardProps,
6 | Divider,
7 | Input,
8 | mergeClasses,
9 | Radio,
10 | RadioGroup,
11 | Switch,
12 | Tooltip,
13 | } from "@heroui/react"
14 | import { BaseUrl, verifyExpiration, verifyManageUrl, verifyName } from "../utils/utils.js"
15 | import React from "react"
16 | import { InfoIcon } from "./icons.js"
17 | import { cardOverrides, inputOverrides, radioOverrides, switchOverrides, tst } from "../utils/overrides.js"
18 |
19 | export type UploadKind = "short" | "long" | "custom" | "manage"
20 |
21 | export type PasteSetting = {
22 | uploadKind: UploadKind
23 | expiration: string
24 | password: string
25 | name: string
26 | manageUrl: string
27 |
28 | doEncrypt: boolean
29 | }
30 |
31 | interface PasteSettingPanelProps extends CardProps {
32 | setting: PasteSetting
33 | onSettingChange: (setting: PasteSetting) => void
34 | }
35 |
36 | export function PanelSettingsPanel({ setting, onSettingChange, ...rest }: PasteSettingPanelProps) {
37 | const radioClassNames = mergeClasses(radioOverrides, { labelWrapper: "ml-2.5" })
38 | return (
39 |
40 | Settings
41 |
43 |
44 | onSettingChange({ ...setting, expiration: e })}
57 | isInvalid={!verifyExpiration(setting.expiration)[0]}
58 | errorMessage={verifyExpiration(setting.expiration)[1]}
59 | description={verifyExpiration(setting.expiration)[1]}
60 | />
61 | onSettingChange({ ...setting, password: p })}
67 | classNames={inputOverrides}
68 | placeholder={"Generated randomly"}
69 | description="Used to update/delete your paste"
70 | />
71 |
72 | onSettingChange({ ...setting, uploadKind: v as UploadKind })}
76 | >
77 |
78 | Generate a short random URL
79 |
80 |
88 | Generate a long random URL
89 |
90 |
91 | Set by your own
92 |
93 | {setting.uploadKind === "custom" ? (
94 | onSettingChange({ ...setting, name: n })}
97 | type="text"
98 | classNames={radioClassNames}
99 | isInvalid={!verifyName(setting.name)[0]}
100 | errorMessage={verifyName(setting.name)[1]}
101 | startContent={
102 |
103 | {`${BaseUrl}/~`}
104 |
105 | }
106 | />
107 | ) : null}
108 |
109 | Update or delete
110 |
111 | {setting.uploadKind === "manage" ? (
112 | onSettingChange({ ...setting, manageUrl: m })}
115 | type="text"
116 | className="shrink"
117 | isInvalid={!verifyManageUrl(setting.manageUrl)[0]}
118 | errorMessage={verifyManageUrl(setting.manageUrl)[1]}
119 | placeholder={`Manage URL`}
120 | />
121 | ) : null}
122 |
123 | onSettingChange({ ...setting, doEncrypt: v })}
129 | >
130 | Client-side encryption
131 |
132 |
135 | Client-side encryption
136 |
137 | Your paste is shared via a URL containing the decryption key in the URL hash, which is never sent to
138 | the server. Decryption happens in the browser, so only those with the key (not the server) can view
139 | the decrypted content.
140 |
141 |
142 | }
143 | >
144 |
148 |
149 | )
150 | }
151 |
--------------------------------------------------------------------------------
/worker/test/basic.spec.ts:
--------------------------------------------------------------------------------
1 | import { test, it, expect, describe } from "vitest"
2 |
3 | import { genRandStr } from "../common"
4 |
5 | import {
6 | genRandomBlob,
7 | areBlobsEqual,
8 | workerFetch,
9 | upload,
10 | BASE_URL,
11 | RAND_NAME_REGEX,
12 | uploadExpectStatus,
13 | staticPages,
14 | addRole,
15 | } from "./testUtils"
16 | import { createExecutionContext } from "cloudflare:test"
17 | import { DEFAULT_PASSWD_LEN, PASTE_NAME_LEN } from "../../shared/constants"
18 | import { parsePath } from "../../shared/parsers"
19 |
20 | describe("upload", () => {
21 | const blob1 = genRandomBlob(1024)
22 | const ctx = createExecutionContext()
23 |
24 | it("should upload", async () => {
25 | // upload
26 | const responseJson = await upload(ctx, { c: blob1 })
27 |
28 | // check url
29 | const url: string = responseJson.url
30 | expect(url.startsWith(BASE_URL))
31 |
32 | // check name
33 | const name: string = url.slice(BASE_URL.length + 1)
34 | expect(name.length).toStrictEqual(PASTE_NAME_LEN)
35 | expect(RAND_NAME_REGEX.test(name))
36 |
37 | // check manageUrl
38 | const manageUrl: string = responseJson.manageUrl
39 | expect(manageUrl).toBeDefined()
40 | expect(manageUrl.startsWith(BASE_URL))
41 | expect(manageUrl.slice(BASE_URL.length + 1, manageUrl.lastIndexOf(":"))).toStrictEqual(name)
42 |
43 | // check passwd
44 | const passwd = manageUrl.slice(manageUrl.lastIndexOf(":") + 1)
45 | expect(passwd.length).toStrictEqual(DEFAULT_PASSWD_LEN)
46 | })
47 |
48 | it("should return original paste", async () => {
49 | const resp = await upload(ctx, { c: blob1 })
50 | const revisitSesponse = await workerFetch(ctx, resp.url)
51 | expect(revisitSesponse.status).toStrictEqual(200)
52 | expect(await areBlobsEqual(await revisitSesponse.blob(), blob1)).toStrictEqual(true)
53 | })
54 |
55 | it("should return 404 for non-existent", async () => {
56 | const resp = await upload(ctx, { c: blob1 })
57 | const name: string = resp.url.slice(BASE_URL.length + 1)
58 | let newName
59 | do {
60 | newName = genRandStr(PASTE_NAME_LEN)
61 | } while (newName === name) // roll until finding a different name
62 | const missingResponse = await workerFetch(ctx, new Request(`${BASE_URL}/${newName}`))
63 | expect(missingResponse.status).toStrictEqual(404)
64 | })
65 | })
66 |
67 | describe("update", () => {
68 | const blob1 = genRandomBlob(1024)
69 | const blob2 = new Blob(["hello"])
70 | const passwd1 = "7365ca6eac619ca3f118"
71 | const ctx = createExecutionContext()
72 |
73 | it("should disallow modify with wrong manageUrl", async () => {
74 | const resp = await upload(ctx, { c: blob1 })
75 | await uploadExpectStatus(ctx, { c: blob2 }, 403, { method: "PUT", url: `${resp.url}:${passwd1}` })
76 | })
77 |
78 | it("should allow modify with manageUrl", async () => {
79 | const resp = await upload(ctx, { c: blob1 })
80 |
81 | const putResponseJson = await upload(ctx, { c: blob2 }, { method: "PUT", url: resp.manageUrl })
82 | expect(putResponseJson.url).toStrictEqual(resp.url)
83 | expect(putResponseJson.manageUrl).toStrictEqual(resp.manageUrl)
84 |
85 | // check visit modified
86 | const revisitModifiedResponse = await workerFetch(ctx, resp.url)
87 | expect(revisitModifiedResponse.status).toStrictEqual(200)
88 | const revisitBlob = await revisitModifiedResponse.blob()
89 | expect(await areBlobsEqual(revisitBlob, blob2)).toStrictEqual(true)
90 | })
91 | })
92 |
93 | describe("delete", () => {
94 | const blob1 = genRandomBlob(1024)
95 | const passwd1 = "7365ca6eac619ca3f118"
96 | const ctx = createExecutionContext()
97 |
98 | it("should disallow delete with wrong manageUrl", async () => {
99 | const resp = await upload(ctx, { c: blob1 })
100 | // check delete with wrong manageUrl
101 | expect((await workerFetch(ctx, new Request(`${resp.url}:${passwd1}`, { method: "DELETE" }))).status).toStrictEqual(
102 | 403,
103 | )
104 | })
105 |
106 | it("should allow delete with wrong manageUrl", async () => {
107 | const resp = await upload(ctx, { c: blob1 })
108 |
109 | const deleteResponse = await workerFetch(ctx, new Request(resp.manageUrl, { method: "DELETE" }))
110 | expect(deleteResponse.status).toStrictEqual(200)
111 |
112 | // check visit deleted
113 | const revisitDeletedResponse = await workerFetch(ctx, resp.url)
114 | expect(revisitDeletedResponse.status).toStrictEqual(404)
115 | })
116 | })
117 |
118 | test("static pages", async () => {
119 | const ctx = createExecutionContext()
120 | for (const page of staticPages) {
121 | const url = `${BASE_URL}/${page}`
122 | expect((await workerFetch(ctx, url)).status, `visiting ${url}`).toStrictEqual(200)
123 | }
124 | })
125 |
126 | test("GET special static pages", async () => {
127 | const blob1 = genRandomBlob(1024)
128 | const ctx = createExecutionContext()
129 | const resp = await upload(ctx, { c: blob1 })
130 |
131 | // test display page
132 | const decUrl = addRole(resp.url, "d")
133 | const { name } = parsePath(new URL(resp.url).pathname)
134 | const decResp = await workerFetch(ctx, decUrl)
135 | expect(decResp.status, `visiting ${decUrl}`).toStrictEqual(200)
136 | expect(decResp.headers.get("Content-Type")).toStrictEqual("text/html;charset=UTF-8")
137 |
138 | const testPairs = [
139 | [name, name],
140 | [name + ".jpg", name + ".jpg"],
141 | [name + ".jpg?lang=cpp", name + ".jpg"],
142 | [name + "/a.jpg", name + "/a.jpg"],
143 | ]
144 | for (const [accessPath, expectedTitle] of testPairs) {
145 | const resp = await (await workerFetch(ctx, `${BASE_URL}/d/${accessPath}`)).text()
146 | expect(
147 | resp.includes(`/ ${expectedTitle}`),
148 | `testing access ${accessPath}, returning ${resp}`,
149 | ).toStrictEqual(true)
150 | }
151 |
152 | // test manage page
153 | const manageUrl = resp.manageUrl
154 | const manageResp = await workerFetch(ctx, manageUrl)
155 | expect(manageResp.status, `visiting ${manageUrl}`).toStrictEqual(200)
156 | expect(manageResp.headers.get("Content-Type")).toStrictEqual("text/html;charset=UTF-8")
157 | })
158 |
--------------------------------------------------------------------------------
/worker/test/controlHeaders.spec.ts:
--------------------------------------------------------------------------------
1 | import { createExecutionContext, env } from "cloudflare:test"
2 | import { afterEach, beforeEach, expect, test, vi } from "vitest"
3 |
4 | import { BASE_URL, genRandomBlob, upload, workerFetch } from "./testUtils"
5 |
6 | test("mime type", async () => {
7 | const ctx = createExecutionContext()
8 | const url = (await upload(ctx, { c: genRandomBlob(1024) })).url
9 |
10 | const url_pic = (await upload(ctx, { c: { content: genRandomBlob(1024), filename: "xx.jpg" } })).url
11 |
12 | async function testMime(accessUrl: string, mime: string) {
13 | const resp = await workerFetch(ctx, accessUrl)
14 | expect(resp.headers.get("Content-Type")).toStrictEqual(mime)
15 | }
16 |
17 | await testMime(url, "text/plain;charset=UTF-8")
18 | await testMime(`${url}.jpg`, "image/jpeg")
19 | await testMime(`${url}/test.jpg`, "image/jpeg")
20 | await testMime(`${url}?mime=random-mime`, "random-mime")
21 | await testMime(`${url}.jpg?mime=random-mime`, "random-mime")
22 | await testMime(`${url}/test.jpg?mime=random-mime`, "random-mime")
23 |
24 | await testMime(url_pic, "image/jpeg")
25 | await testMime(`${url_pic}.png`, "image/png")
26 |
27 | // test disallowed mimetypes
28 | await testMime(`${url_pic}.html`, "text/plain;charset=UTF-8")
29 | await testMime(`${url_pic}?mime=text/html`, "text/plain;charset=UTF-8")
30 | })
31 |
32 | test("cache control", async () => {
33 | beforeEach(vi.useFakeTimers)
34 | afterEach(vi.useRealTimers)
35 | const t1 = new Date(2035, 0, 0)
36 | vi.setSystemTime(t1)
37 |
38 | const ctx = createExecutionContext()
39 | const uploadResp = await upload(ctx, { c: genRandomBlob(1024) })
40 | const url = uploadResp["url"]
41 | const resp = await workerFetch(ctx, url)
42 | expect(resp.headers.has("Last-Modified")).toStrictEqual(true)
43 | expect(new Date(resp.headers.get("Last-Modified")!).getTime()).toStrictEqual(t1.getTime())
44 |
45 | if ("CACHE_PASTE_AGE" in env) {
46 | expect(resp.headers.get("Cache-Control")).toStrictEqual(`public, max-age=${env.CACHE_PASTE_AGE}`)
47 | } else {
48 | expect(resp.headers.get("Cache-Control")).toBeUndefined()
49 | }
50 |
51 | const indexResp = await workerFetch(ctx, BASE_URL)
52 | if ("CACHE_STATIC_PAGE_AGE" in env) {
53 | expect(indexResp.headers.get("Cache-Control")).toStrictEqual(`public, max-age=${env.CACHE_STATIC_PAGE_AGE}`)
54 | } else {
55 | expect(indexResp.headers.get("Cache-Control")).toBeUndefined()
56 | }
57 |
58 | const t2 = new Date(2035, 0, 1)
59 | const staleResp = await workerFetch(
60 | ctx,
61 | new Request(url, {
62 | headers: {
63 | "If-Modified-Since": t2.toUTCString(),
64 | },
65 | }),
66 | )
67 | expect(staleResp.status).toStrictEqual(304)
68 | })
69 |
70 | test("content disposition without specifying filename", async () => {
71 | const content = "hello" // not using Blob here, since FormData.append() automatically add filename for Blob
72 | const filename = "hello.jpg"
73 | const ctx = createExecutionContext()
74 |
75 | const uploadResp = await upload(ctx, { c: content })
76 | const url = uploadResp["url"]
77 |
78 | expect(
79 | (await workerFetch(ctx, url)).headers.get("Access-Control-Expose-Headers")?.includes("Content-Disposition"),
80 | ).toStrictEqual(true)
81 | expect((await workerFetch(ctx, url)).headers.get("Content-Disposition")).toStrictEqual("inline")
82 | expect((await workerFetch(ctx, `${url}?a`)).headers.get("Content-Disposition")).toStrictEqual("attachment")
83 |
84 | expect((await workerFetch(ctx, `${url}/${filename}`)).headers.get("Content-Disposition")).toStrictEqual(
85 | `inline; filename*=UTF-8''${filename}`,
86 | )
87 | expect((await workerFetch(ctx, `${url}/${filename}?a`)).headers.get("Content-Disposition")).toStrictEqual(
88 | `attachment; filename*=UTF-8''${filename}`,
89 | )
90 | })
91 |
92 | test("content disposition with specifying filename", async () => {
93 | const content = genRandomBlob(1024)
94 | const filename = "りんご たいへん.jpg"
95 | const filenameEncoded = encodeURIComponent(filename)
96 | const altFilename = "التفاح"
97 | const altFilenameEncoded = encodeURIComponent(altFilename)
98 |
99 | const ctx = createExecutionContext()
100 |
101 | const uploadResp = await upload(ctx, { c: { content, filename } })
102 | const url = uploadResp.url
103 |
104 | expect((await workerFetch(ctx, url)).headers.get("Content-Disposition")).toStrictEqual(
105 | `inline; filename*=UTF-8''${filenameEncoded}`,
106 | )
107 | expect((await workerFetch(ctx, `${url}?a`)).headers.get("Content-Disposition")).toStrictEqual(
108 | `attachment; filename*=UTF-8''${filenameEncoded}`,
109 | )
110 |
111 | expect((await workerFetch(ctx, `${url}/${altFilename}`)).headers.get("Content-Disposition")).toStrictEqual(
112 | `inline; filename*=UTF-8''${altFilenameEncoded}`,
113 | )
114 | expect((await workerFetch(ctx, `${url}/${altFilename}?a`)).headers.get("Content-Disposition")).toStrictEqual(
115 | `attachment; filename*=UTF-8''${altFilenameEncoded}`,
116 | )
117 | })
118 |
119 | test("other HTTP methods", async () => {
120 | const ctx = createExecutionContext()
121 | const resp = await workerFetch(
122 | ctx,
123 | new Request(BASE_URL, {
124 | method: "PATCH",
125 | }),
126 | )
127 | expect(resp.status).toStrictEqual(405)
128 | expect(resp.headers.has("Allow")).toStrictEqual(true)
129 | })
130 |
131 | test("option method", async () => {
132 | const ctx = createExecutionContext()
133 |
134 | const resp = await workerFetch(
135 | ctx,
136 | new Request(BASE_URL, {
137 | method: "OPTIONS",
138 | headers: {
139 | Origin: "https://example.com",
140 | "Access-Control-Request-Method": "PUT",
141 | },
142 | }),
143 | )
144 | expect(resp.status).toStrictEqual(200)
145 | expect(resp.headers.has("Access-Control-Allow-Origin")).toStrictEqual(true)
146 | expect(resp.headers.has("Access-Control-Allow-Methods")).toStrictEqual(true)
147 | expect(resp.headers.has("Access-Control-Max-Age")).toStrictEqual(true)
148 |
149 | const resp1 = await workerFetch(
150 | ctx,
151 | new Request(BASE_URL, {
152 | method: "OPTIONS",
153 | headers: {
154 | Origin: "https://example.com",
155 | },
156 | }),
157 | )
158 | expect(resp1.status).toStrictEqual(200)
159 | expect(resp1.headers.has("Allow")).toStrictEqual(true)
160 | })
161 |
--------------------------------------------------------------------------------
/worker/test/uploadOptions.spec.ts:
--------------------------------------------------------------------------------
1 | import { expect, test } from "vitest"
2 | import {
3 | addRole,
4 | areBlobsEqual,
5 | BASE_URL,
6 | genRandomBlob,
7 | RAND_NAME_REGEX,
8 | upload,
9 | uploadExpectStatus,
10 | workerFetch,
11 | } from "./testUtils"
12 | import { createExecutionContext, env } from "cloudflare:test"
13 | import { MetaResponse } from "../../shared/interfaces"
14 | import { MAX_PASSWD_LEN, MIN_PASSWD_LEN, PRIVATE_PASTE_NAME_LEN } from "../../shared/constants"
15 | import { parseExpiration } from "../../shared/parsers"
16 |
17 | test("privacy url with option p", async () => {
18 | const blob1 = genRandomBlob(1024)
19 | const ctx = createExecutionContext()
20 |
21 | // upload
22 | const responseJson = await upload(ctx, { c: blob1, p: "1" })
23 |
24 | // check url
25 | const url = responseJson["url"]
26 | expect(url.startsWith(BASE_URL))
27 |
28 | // check name
29 | const name = url.slice(BASE_URL.length + 1)
30 | expect(name.length).toStrictEqual(PRIVATE_PASTE_NAME_LEN)
31 | expect(RAND_NAME_REGEX.test(name))
32 |
33 | // check revisit
34 | const revisitSesponse = await workerFetch(ctx, url)
35 | expect(revisitSesponse.status).toStrictEqual(200)
36 | expect(await areBlobsEqual(await revisitSesponse.blob(), blob1)).toStrictEqual(true)
37 | })
38 |
39 | test("expire with option e", async () => {
40 | const blob1 = genRandomBlob(1024)
41 | const ctx = createExecutionContext()
42 |
43 | async function testExpireParse(expire: string, expireSecs: number | null) {
44 | const responseJson = await upload(ctx, { c: blob1, e: expire })
45 | expect(responseJson["expirationSeconds"]).toStrictEqual(expireSecs)
46 | }
47 |
48 | const maxExpirationSeconds = parseExpiration(env.MAX_EXPIRATION)!
49 | const defaultExpirationSeconds = parseExpiration(env.DEFAULT_EXPIRATION)!
50 | await testExpireParse("1000", 1000)
51 | await testExpireParse("100m", 6000)
52 | await testExpireParse("100h", 360000)
53 | await testExpireParse("1d", 86400)
54 | await testExpireParse("100d", maxExpirationSeconds) // longer expiration will be clipped to 30d
55 | await testExpireParse("100 m", 6000)
56 | await testExpireParse("", defaultExpirationSeconds)
57 |
58 | const testFailParse = async (expire: string) => {
59 | await uploadExpectStatus(ctx, { c: blob1, e: expire }, 400)
60 | }
61 |
62 | await testFailParse("abc")
63 | await testFailParse("1c")
64 | await testFailParse("-100m")
65 | })
66 |
67 | test("custom path with option n", async () => {
68 | const blob1 = genRandomBlob(1024)
69 | const ctx = createExecutionContext()
70 |
71 | // check bad names
72 | const badNames = ["a", "ab", "..."]
73 | for (const name of badNames) {
74 | await uploadExpectStatus(ctx, { c: blob1, n: name }, 400)
75 | }
76 |
77 | // check good name upload
78 | const goodName = "goodName123+_-[]*$@,;"
79 | const uploadResponseJson = await upload(ctx, {
80 | c: blob1,
81 | n: goodName,
82 | })
83 | expect(uploadResponseJson["url"]).toStrictEqual(`${BASE_URL}/~${goodName}`)
84 |
85 | // check revisit
86 | const revisitResponse = await workerFetch(ctx, uploadResponseJson["url"])
87 | expect(revisitResponse.status).toStrictEqual(200)
88 | expect(await areBlobsEqual(await revisitResponse.blob(), blob1)).toStrictEqual(true)
89 | })
90 |
91 | test("custom passwd with option s", async () => {
92 | const blob1 = genRandomBlob(1024)
93 | const ctx = createExecutionContext()
94 |
95 | // check good name upload
96 | const passwd = "1366eaa20c071763dc94"
97 | const wrongPasswd = "7365ca6eac619ca3f118"
98 | const uploadResponseJson = await upload(ctx, { c: blob1, s: passwd })
99 | const url = uploadResponseJson.url
100 | const manageUrl = uploadResponseJson.manageUrl
101 | const parsedPasswd = manageUrl.slice(manageUrl.lastIndexOf(":") + 1)
102 | expect(parsedPasswd).toStrictEqual(passwd)
103 |
104 | // check password format verification
105 | await uploadExpectStatus(ctx, { c: blob1, s: "1".repeat(MIN_PASSWD_LEN - 1) }, 400)
106 | await uploadExpectStatus(ctx, { c: blob1, s: "1".repeat(MIN_PASSWD_LEN) + "\n" }, 400)
107 | await uploadExpectStatus(ctx, { c: blob1, s: "1".repeat(MAX_PASSWD_LEN + 1) }, 400)
108 |
109 | // check modify with wrong manageUrl
110 | await uploadExpectStatus(ctx, { c: blob1 }, 403, { method: "PUT", url: `${url}:${wrongPasswd}` })
111 |
112 | // check modify
113 | const putResponseJson = await upload(ctx, { c: blob1, s: wrongPasswd }, { method: "PUT", url: manageUrl })
114 | expect(putResponseJson.url).toStrictEqual(url) // url will not change
115 | expect(putResponseJson.manageUrl).toStrictEqual(`${url}:${wrongPasswd}`) // passwd may change
116 | })
117 |
118 | test("encryption with option encryption-scheme", async () => {
119 | const blob1 = genRandomBlob(1024)
120 | const ctx = createExecutionContext()
121 |
122 | // check good name upload
123 | const uploadResponseJson = await upload(ctx, {
124 | c: { content: blob1, filename: "a.pdf" },
125 | "encryption-scheme": "AES-GCM",
126 | })
127 | const url = uploadResponseJson.url
128 |
129 | const fetchPaste = await workerFetch(ctx, url)
130 | await fetchPaste.bytes()
131 | expect(fetchPaste.headers.get("Content-Type")).toStrictEqual("application/octet-stream")
132 | expect(fetchPaste.headers.get("Content-Disposition")).toStrictEqual("inline; filename*=UTF-8''a.pdf.encrypted")
133 | expect(fetchPaste.headers.get("X-PB-Encryption-Scheme")).toStrictEqual("AES-GCM")
134 | expect(fetchPaste.headers.get("Access-Control-Expose-Headers")?.includes("X-PB-Encryption-Scheme")).toStrictEqual(
135 | true,
136 | )
137 |
138 | // fetch with filename, now the content-disposition and content-type should be changed
139 | const fetchPasteWithFilename = await workerFetch(ctx, url + "/b.pdf")
140 | await fetchPasteWithFilename.bytes()
141 | expect(fetchPasteWithFilename.headers.get("Content-Disposition")).toStrictEqual("inline; filename*=UTF-8''b.pdf")
142 | expect(fetchPasteWithFilename.headers.get("Content-Type")).toStrictEqual("application/pdf")
143 |
144 | // fetch with ext, now only the content-type is chaanged
145 | const fetchPasteWithExt = await workerFetch(ctx, url + ".pdf")
146 | await fetchPasteWithExt.bytes()
147 | expect(fetchPasteWithExt.headers.get("Content-Disposition")).toStrictEqual("inline; filename*=UTF-8''a.pdf.encrypted")
148 | expect(fetchPasteWithExt.headers.get("Content-Type")).toStrictEqual("application/pdf")
149 |
150 | const fetchMeta: MetaResponse = await (await workerFetch(ctx, addRole(url, "m"))).json()
151 | expect(fetchMeta.encryptionScheme).toStrictEqual("AES-GCM")
152 | })
153 |
154 | test("highlight with option lang", async () => {
155 | const blob1 = genRandomBlob(1024)
156 | const ctx = createExecutionContext()
157 | const lang = "cpp"
158 |
159 | const uploadResp = await upload(ctx, { c: blob1, lang: lang })
160 | const metaResp: MetaResponse = await (await workerFetch(ctx, addRole(uploadResp.url, "m"))).json()
161 | expect(metaResp.highlightLanguage).toStrictEqual(lang)
162 |
163 | const getResp = await workerFetch(ctx, uploadResp.url)
164 | expect(getResp.headers.get("X-PB-Highlight-Language")).toStrictEqual(lang)
165 | expect(getResp.headers.get("Access-Control-Expose-Headers")?.includes("X-PB-Highlight-Language")).toStrictEqual(true)
166 | expect(metaResp.highlightLanguage).toStrictEqual(lang)
167 | })
168 |
--------------------------------------------------------------------------------
/frontend/components/CodeEditor.tsx:
--------------------------------------------------------------------------------
1 | // inspired by https://css-tricks.com/creating-an-editable-textarea-that-supports-syntax-highlighted-code/
2 |
3 | import React, { useEffect, useRef, useState } from "react"
4 | import { Autocomplete, AutocompleteItem, Input, Select, SelectItem } from "@heroui/react"
5 |
6 | import { autoCompleteOverrides, inputOverrides, selectOverrides, tst } from "../utils/overrides.js"
7 | import { useHLJS, highlightHTML } from "../utils/HighlightLoader.js"
8 |
9 | import "../styles/highlight-theme-light.css"
10 | import "../styles/highlight-theme-dark.css"
11 |
12 | // TODO:
13 | // - line number
14 | // - clear button
15 | interface CodeInputProps extends React.HTMLProps {
16 | content: string
17 | setContent: (code: string) => void
18 | lang?: string
19 | setLang: (lang?: string) => void
20 | filename?: string
21 | setFilename: (filename?: string) => void
22 | placeholder?: string
23 | disabled?: boolean
24 | }
25 |
26 | interface TabSetting {
27 | char: "tab" | "space"
28 | width: 2 | 4 | 8
29 | }
30 |
31 | function formatTabSetting(s: TabSetting, forHuman: boolean) {
32 | if (forHuman) {
33 | if (s.char === "tab") {
34 | return `Tab: ${s.width}`
35 | } else {
36 | return `Spaces: ${s.width}`
37 | }
38 | } else {
39 | return `${s.char} ${s.width}`
40 | }
41 | }
42 |
43 | function parseTabSetting(s: string): TabSetting | undefined {
44 | const match = s.match(/^(tab|space) ([24])$/)
45 | if (match) {
46 | return { char: match[1] as TabSetting["char"], width: parseInt(match[2]) as TabSetting["width"] }
47 | } else {
48 | return undefined
49 | }
50 | }
51 |
52 | const tabSettings: TabSetting[] = [
53 | { char: "tab", width: 2 },
54 | { char: "tab", width: 4 },
55 | { char: "tab", width: 8 },
56 | { char: "space", width: 2 },
57 | { char: "space", width: 4 },
58 | { char: "space", width: 8 },
59 | ]
60 |
61 | function handleNewLines(str: string): string {
62 | if (str.at(-1) === "\n") {
63 | str += " "
64 | }
65 | return str
66 | }
67 |
68 | export function CodeEditor({
69 | content,
70 | setContent,
71 | lang,
72 | setLang,
73 | filename,
74 | setFilename,
75 | placeholder,
76 | disabled,
77 | className,
78 | ...rest
79 | }: CodeInputProps) {
80 | const refHighlighting = useRef(null)
81 | const refTextarea = useRef(null)
82 | const refLineNumbers = useRef(null)
83 |
84 | const [heightPx, setHeightPx] = useState(0)
85 | const hljs = useHLJS()
86 | const [tabSetting, setTabSettings] = useState({ char: "space", width: 2 })
87 |
88 | const lineCount = (content?.match(/\n/g)?.length || 0) + 1
89 |
90 | function syncScroll() {
91 | refHighlighting.current!.scrollLeft = refTextarea.current!.scrollLeft
92 | refHighlighting.current!.scrollTop = refTextarea.current!.scrollTop
93 | if (refLineNumbers.current) {
94 | refLineNumbers.current.scrollTop = refTextarea.current!.scrollTop
95 | }
96 | }
97 |
98 | function handleInput(_: React.FormEvent) {
99 | const editing = refTextarea.current!
100 | setContent(editing.value)
101 | syncScroll()
102 | }
103 |
104 | function handleKeyDown(event: React.KeyboardEvent) {
105 | const element = refTextarea.current!
106 | if (event.key === "Tab") {
107 | event.preventDefault() // stop normal
108 | const beforeTab = content.slice(0, element.selectionStart)
109 | const afterTab = content.slice(element.selectionEnd, element.value.length)
110 | const insertedString = tabSetting.char === "tab" ? "\t" : " ".repeat(tabSetting.width)
111 | const curPos = element.selectionStart + insertedString.length
112 | setContent(beforeTab + insertedString + afterTab)
113 | // move cursor
114 | element.selectionStart = curPos
115 | element.selectionEnd = curPos
116 | } else if (event.key === "Escape") {
117 | element.blur()
118 | }
119 | }
120 |
121 | useEffect(() => {
122 | setHeightPx(refTextarea.current!.clientHeight)
123 | const observer = new ResizeObserver((entries) => {
124 | for (const entry of entries) {
125 | if (entry.contentRect) {
126 | setHeightPx(entry.contentRect.height)
127 | }
128 | }
129 | })
130 |
131 | observer.observe(refTextarea.current!)
132 |
133 | return () => {
134 | observer.disconnect()
135 | }
136 | }, [])
137 |
138 | const lineNumOffset = `${Math.floor(Math.log10(lineCount)) + 3}ch`
139 |
140 | return (
141 |
142 |
143 |
151 | ({ key: lang })) : []}
157 | // we must not use undefined here to avoid conversion from uncontrolled component to controlled component
158 | selectedKey={hljs && lang && hljs.listLanguages().includes(lang) ? lang : ""}
159 | onSelectionChange={(key) => {
160 | setLang((key as string) || undefined) // when key is empty string, convert back to undefined
161 | }}
162 | >
163 | {(language) => {language.key} }
164 |
165 |
179 |
180 |
181 |
185 |
186 |
192 |
200 | {Array.from({ length: lineCount }, (_, idx) => {
201 | return
202 | })}
203 |
204 |
205 |
220 |
221 |
222 |
223 | )
224 | }
225 |
--------------------------------------------------------------------------------
/frontend/pages/PasteBin.tsx:
--------------------------------------------------------------------------------
1 | import React, { useEffect, useState, useTransition } from "react"
2 |
3 | import { Button, Link } from "@heroui/react"
4 |
5 | import { DarkModeToggle, useDarkModeSelection } from "../components/DarkModeToggle.js"
6 | import { useErrorModal } from "../components/ErrorModal.js"
7 | import { PanelSettingsPanel, PasteSetting } from "../components/PasteSettingPanel.js"
8 | import { UploadedPanel } from "../components/UploadedPanel.js"
9 | import { PasteInputPanel, PasteEditState } from "../components/PasteInputPanel.js"
10 |
11 | import type { PasteResponse } from "../../shared/interfaces.js"
12 | import { parsePath, parseFilenameFromContentDisposition } from "../../shared/parsers.js"
13 |
14 | import {
15 | verifyExpiration,
16 | verifyManageUrl,
17 | verifyName,
18 | maxExpirationReadable,
19 | BaseUrl,
20 | APIUrl,
21 | } from "../utils/utils.js"
22 | import { uploadPaste } from "../utils/uploader.js"
23 | import { tst } from "../utils/overrides.js"
24 |
25 | import "../style.css"
26 |
27 | export function PasteBin() {
28 | const [editorState, setEditorState] = useState({
29 | editKind: "edit",
30 | editContent: "",
31 | file: null,
32 | editHighlightLang: "plaintext",
33 | })
34 |
35 | const [pasteSetting, setPasteSetting] = useState({
36 | expiration: DEFAULT_EXPIRATION,
37 | manageUrl: "",
38 | name: "",
39 | password: "",
40 | uploadKind: "short",
41 | doEncrypt: false,
42 | })
43 |
44 | const [pasteResponse, setPasteResponse] = useState(undefined)
45 | const [uploadedEncryptionKey, setUploadedEncryptionKey] = useState(undefined)
46 |
47 | const [isUploadPending, startUpload] = useTransition()
48 | const [loadingProgress, setLoadingProgress] = useState(undefined)
49 | const [isInitPasteLoading, startFetchingInitPaste] = useTransition()
50 |
51 | const [_, modeSelection, setModeSelection] = useDarkModeSelection()
52 |
53 | const { ErrorModal, showModal, handleError, handleFailedResp } = useErrorModal()
54 |
55 | // handle admin URL
56 | useEffect(() => {
57 | // TODO: do not fetch paste for a large file paste
58 | const pathname = location.pathname
59 | // const pathname = new URL("http://localhost:8787/ds2W:ShNkSKdf5rZypdcJEcAdFmw3").pathname
60 | const { name, password, filename, ext } = parsePath(pathname)
61 |
62 | if (password !== undefined && pasteSetting.manageUrl === "") {
63 | setPasteSetting({
64 | ...pasteSetting,
65 | uploadKind: "manage",
66 | manageUrl: `${APIUrl}/${name}:${password}`,
67 | })
68 |
69 | let pasteUrl = `${APIUrl}/${name}`
70 | if (filename) pasteUrl = `${pasteUrl}/${filename}`
71 | if (ext) pasteUrl = `${pasteUrl}${ext}`
72 |
73 | startFetchingInitPaste(async () => {
74 | try {
75 | const resp = await fetch(pasteUrl)
76 | if (!resp.ok) {
77 | await handleFailedResp(`Error on Fetching ${pasteUrl}`, resp)
78 | return
79 | }
80 | const contentType = resp.headers.get("Content-Type")
81 | const contentDisp = resp.headers.get("Content-Disposition")
82 | const contentLang = resp.headers.get("X-PB-Highlight-Language")
83 |
84 | let pasteFilename = filename
85 | if (pasteFilename === undefined && contentDisp !== null) {
86 | pasteFilename = parseFilenameFromContentDisposition(contentDisp)
87 | }
88 |
89 | if (contentLang || (contentType && contentType.startsWith("text/"))) {
90 | setEditorState({
91 | editKind: "edit",
92 | editContent: await resp.text(),
93 | file: null,
94 | editHighlightLang: contentLang || undefined,
95 | editFilename: pasteFilename,
96 | })
97 | } else {
98 | setEditorState({
99 | editKind: "file",
100 | editContent: "",
101 | file: new File([await resp.blob()], pasteFilename || "[unknown filename]"),
102 | })
103 | }
104 | } catch (e) {
105 | handleError(`Error on Fetching ${pasteUrl}`, e as Error)
106 | }
107 | })
108 | }
109 | }, [])
110 |
111 | function onStartUpload() {
112 | startUpload(async () => {
113 | try {
114 | const uploaded = await uploadPaste(pasteSetting, editorState, setUploadedEncryptionKey, setLoadingProgress)
115 | setPasteResponse(uploaded)
116 | } catch (e) {
117 | handleError("Error on Uploading Paste", e as Error)
118 | }
119 | })
120 | }
121 |
122 | function onStartDelete() {
123 | startUpload(async () => {
124 | try {
125 | const resp = await fetch(pasteSetting.manageUrl, { method: "DELETE" })
126 | if (resp.ok) {
127 | showModal("Deleted Successfully", "It may takes 60 seconds for the deletion to propagate to the world")
128 | setPasteResponse(undefined)
129 | } else {
130 | await handleFailedResp("Error on Delete Paste", resp)
131 | }
132 | } catch (e) {
133 | handleError("Error on Delete Paste", e as Error)
134 | }
135 | })
136 | }
137 |
138 | function canUpload(): boolean {
139 | if (editorState.editKind === "edit" && editorState.editContent.length === 0) {
140 | return false
141 | } else if (editorState.editKind === "file" && editorState.file === null) {
142 | return false
143 | }
144 |
145 | if (verifyExpiration(pasteSetting.expiration)[0]) {
146 | if (pasteSetting.uploadKind === "short" || pasteSetting.uploadKind === "long") {
147 | return true
148 | } else if (pasteSetting.uploadKind === "custom") {
149 | return verifyName(pasteSetting.name)[0]
150 | } else if (pasteSetting.uploadKind === "manage") {
151 | return verifyManageUrl(pasteSetting.manageUrl)[0]
152 | } else {
153 | return false
154 | }
155 | } else {
156 | return false
157 | }
158 | }
159 |
160 | function canDelete(): boolean {
161 | return verifyManageUrl(pasteSetting.manageUrl)[0]
162 | }
163 |
164 | const info = (
165 |
166 |
167 | {INDEX_PAGE_TITLE}
168 | An open source pastebin deployed on Cloudflare Workers.
175 |
176 | Usage: Paste text or file here. Upload. Share it with a URL. Or access with our{" "}
177 |
178 | APIs
179 |
180 | .
181 |
182 |
183 | Warning: Only for temporary share (max {maxExpirationReadable}). Files could be deleted without
184 | notice!
185 |
186 |
187 | )
188 |
189 | const submitter = (
190 |
191 |
199 | {pasteSetting.uploadKind === "manage" ? (
200 |
203 | ) : null}
204 |
205 | )
206 |
207 | const footer = (
208 |
219 | )
220 |
221 | return (
222 |
223 |
224 | {info}
225 |
252 | )
253 | }
254 |
--------------------------------------------------------------------------------
/worker/handlers/handleRead.ts:
--------------------------------------------------------------------------------
1 | import { decode, isLegalUrl, WorkerError } from "../common.js"
2 | import { getDocPage } from "../pages/docs.js"
3 | import { verifyAuth } from "../pages/auth.js"
4 | import mime from "mime"
5 | import { makeMarkdown } from "../pages/markdown.js"
6 | import { getPaste, getPasteMetadata, PasteMetadata, PasteWithMetadata } from "../storage/storage.js"
7 | import { MetaResponse } from "../../shared/interfaces.js"
8 | import { parsePath } from "../../shared/parsers.js"
9 | import { MAX_URL_REDIRECT_LEN } from "../../shared/constants.js"
10 |
11 | type Headers = Record
12 |
13 | async function decodeMaybeStream(content: ArrayBuffer | ReadableStream): Promise {
14 | if (content instanceof ArrayBuffer) {
15 | return decode(content)
16 | } else {
17 | const reader = content.pipeThrough(new TextDecoderStream()).getReader()
18 | let result = ""
19 | while (true) {
20 | const { done, value } = await reader.read()
21 | if (done) {
22 | break
23 | }
24 | result += value
25 | }
26 | return result
27 | }
28 | }
29 |
30 | function staticPageCacheHeader(env: Env): Headers {
31 | const age = env.CACHE_STATIC_PAGE_AGE
32 | return age ? { "Cache-Control": `public, max-age=${age}` } : {}
33 | }
34 |
35 | function pasteCacheHeader(env: Env): Headers {
36 | const age = env.CACHE_PASTE_AGE
37 | return age ? { "Cache-Control": `public, max-age=${age}` } : {}
38 | }
39 |
40 | function lastModifiedHeader(metadata: PasteMetadata): Headers {
41 | const lastModified = metadata.lastModifiedAtUnix
42 | return lastModified ? { "Last-Modified": new Date(lastModified * 1000).toUTCString() } : {}
43 | }
44 |
45 | async function handleStaticPages(request: Request, env: Env, _: ExecutionContext): Promise {
46 | const url = new URL(request.url)
47 |
48 | let path = url.pathname
49 | if (path.endsWith("/")) {
50 | path += "index.html"
51 | } else if (path.endsWith("/index")) {
52 | path += ".html"
53 | } else if (path.lastIndexOf("/") === 0 && path.indexOf(":") > 0) {
54 | path = "/index.html" // handle admin URL
55 | }
56 | if (path.startsWith("/assets/") || path === "/favicon.ico" || path === "/index.html") {
57 | if (path === "/index.html") {
58 | const authResponse = verifyAuth(request, env)
59 | if (authResponse !== null) {
60 | return authResponse
61 | }
62 | }
63 | const assetsUrl = url
64 | assetsUrl.pathname = path
65 | const resp = await env.ASSETS.fetch(assetsUrl)
66 | if (resp.status === 404) {
67 | throw new WorkerError(404, `asset '${path}' not found`)
68 | } else {
69 | const pageMime = mime.getType(path) || "text/plain"
70 | return new Response(await resp.blob(), {
71 | headers: {
72 | "Content-Type": `${pageMime};charset=UTF-8`,
73 | ...staticPageCacheHeader(env),
74 | },
75 | })
76 | }
77 | }
78 |
79 | const staticPageContent = getDocPage(url.pathname, env)
80 | if (staticPageContent) {
81 | // access to all static pages requires auth
82 | const authResponse = verifyAuth(request, env)
83 | if (authResponse !== null) {
84 | return authResponse
85 | }
86 | return new Response(staticPageContent, {
87 | headers: {
88 | "Content-Type": "text/html;charset=UTF-8",
89 | ...staticPageCacheHeader(env),
90 | },
91 | })
92 | }
93 |
94 | return null
95 | }
96 |
97 | async function getPasteWithoutContent(env: Env, name: string): Promise {
98 | const metadata = await getPasteMetadata(env, name)
99 | return metadata && { paste: new ArrayBuffer(), metadata }
100 | }
101 |
102 | export async function handleGet(request: Request, env: Env, ctx: ExecutionContext, isHead: boolean): Promise {
103 | // TODO: handle etag
104 | const staticPageResp = await handleStaticPages(request, env, ctx)
105 | if (staticPageResp !== null) {
106 | return staticPageResp
107 | }
108 |
109 | const url = new URL(request.url)
110 |
111 | const { role, name, ext, filename } = parsePath(url.pathname)
112 |
113 | const disp = url.searchParams.has("a") ? "attachment" : "inline"
114 |
115 | // when not isHead, always need to get paste unless "m"
116 | // when isHead, no need to get paste unless "u"
117 | const shouldGetPasteContent = (!isHead && role !== "m" && role !== "d") || (isHead && role === "u")
118 |
119 | const item: PasteWithMetadata | null = shouldGetPasteContent
120 | ? await getPaste(env, name, ctx)
121 | : await getPasteWithoutContent(env, name)
122 |
123 | // when paste is not found
124 | if (item === null) {
125 | throw new WorkerError(404, `paste of name '${name}' not found`)
126 | }
127 |
128 | let inferred_mime =
129 | url.searchParams.get("mime") ||
130 | (ext && mime.getType(ext)) ||
131 | (item.metadata.encryptionScheme && "application/octet-stream") ||
132 | (item.metadata.filename && mime.getType(item.metadata.filename)) ||
133 | "text/plain;charset=UTF-8"
134 |
135 | if (env.DISALLOWED_MIME_FOR_PASTE.includes(inferred_mime)) {
136 | inferred_mime = "text/plain;charset=UTF-8"
137 | }
138 |
139 | // check `if-modified-since`
140 | const pasteLastModifiedUnix = item.metadata.lastModifiedAtUnix
141 | const headerModifiedSince = request.headers.get("If-Modified-Since")
142 | if (headerModifiedSince) {
143 | const headerModifiedSinceUnix = Date.parse(headerModifiedSince) / 1000
144 | if (pasteLastModifiedUnix <= headerModifiedSinceUnix) {
145 | return new Response(null, {
146 | status: 304, // Not Modified
147 | headers: lastModifiedHeader(item.metadata),
148 | })
149 | }
150 | }
151 |
152 | // determine filename with priority: url path > meta
153 | let returnFilename = filename || item.metadata?.filename
154 | if (returnFilename && !filename && item.metadata.encryptionScheme) {
155 | returnFilename = returnFilename + ".encrypted" // to avoid clients choose open method with extension
156 | }
157 |
158 | // handle URL redirection
159 | if (role === "u") {
160 | if (item.metadata.sizeBytes > MAX_URL_REDIRECT_LEN) {
161 | throw new WorkerError(400, `URL too long to be redirected (max ${MAX_URL_REDIRECT_LEN} bytes)`)
162 | }
163 | const redirectURL = await decodeMaybeStream(item.paste)
164 | if (isLegalUrl(redirectURL)) {
165 | return Response.redirect(redirectURL)
166 | } else {
167 | throw new WorkerError(400, "cannot parse paste content as a legal URL")
168 | }
169 | }
170 |
171 | // handle article (render as markdown)
172 | if (role === "a") {
173 | return new Response(shouldGetPasteContent ? makeMarkdown(await decodeMaybeStream(item.paste)) : null, {
174 | headers: {
175 | "Content-Type": `text/html;charset=UTF-8`,
176 | ...pasteCacheHeader(env),
177 | ...lastModifiedHeader(item.metadata),
178 | },
179 | })
180 | }
181 |
182 | // handle metadata access
183 | if (role === "m") {
184 | const returnedMetadata: MetaResponse = {
185 | lastModifiedAt: new Date(item.metadata.lastModifiedAtUnix * 1000).toISOString(),
186 | createdAt: new Date(item.metadata.createdAtUnix * 1000).toISOString(),
187 | expireAt: new Date(item.metadata.willExpireAtUnix * 1000).toISOString(),
188 | sizeBytes: item.metadata.sizeBytes,
189 | location: item.metadata.location,
190 | filename: item.metadata.filename,
191 | highlightLanguage: item.metadata.highlightLanguage,
192 | encryptionScheme: item.metadata.encryptionScheme,
193 | }
194 | return new Response(isHead ? null : JSON.stringify(returnedMetadata, null, 2), {
195 | headers: {
196 | "Content-Type": `application/json;charset=UTF-8`,
197 | ...pasteCacheHeader(env),
198 | ...lastModifiedHeader(item.metadata),
199 | },
200 | })
201 | }
202 |
203 | // handle encrypted
204 | if (role === "d") {
205 | const pageUrl = url
206 | pageUrl.search = ""
207 | pageUrl.pathname = "/display.html"
208 | const page = decode(await (await env.ASSETS.fetch(pageUrl)).arrayBuffer()).replace(
209 | "{{PASTE_NAME}}",
210 | name + (filename ? "/" + filename : ext ? ext : ""),
211 | )
212 | return new Response(isHead ? null : page, {
213 | headers: {
214 | "Content-Type": `text/html;charset=UTF-8`,
215 | ...pasteCacheHeader(env),
216 | ...lastModifiedHeader(item.metadata),
217 | },
218 | })
219 | }
220 |
221 | // handle default
222 | const headers: Headers = {
223 | "Content-Type": `${inferred_mime}`,
224 | ...pasteCacheHeader(env),
225 | ...lastModifiedHeader(item.metadata),
226 | }
227 | const exposeHeaders = ["Content-Disposition"]
228 |
229 | if (item.metadata.encryptionScheme) {
230 | headers["X-PB-Encryption-Scheme"] = item.metadata.encryptionScheme
231 | exposeHeaders.push("X-PB-Encryption-Scheme")
232 | }
233 |
234 | if (item.metadata.highlightLanguage) {
235 | headers["X-PB-Highlight-Language"] = item.metadata.highlightLanguage
236 | exposeHeaders.push("X-PB-Highlight-Language")
237 | }
238 |
239 | if (item.httpEtag) {
240 | headers["etag"] = item.httpEtag
241 | }
242 |
243 | if (returnFilename) {
244 | const encodedFilename = encodeURIComponent(returnFilename)
245 | headers["Content-Disposition"] = `${disp}; filename*=UTF-8''${encodedFilename}`
246 | } else {
247 | headers["Content-Disposition"] = `${disp}`
248 | }
249 | headers["Access-Control-Expose-Headers"] = exposeHeaders.join(", ")
250 |
251 | // if content is nonempty, Content-Length will be set automatically
252 | if (!shouldGetPasteContent) {
253 | headers["Content-Length"] = item.metadata.sizeBytes.toString()
254 | }
255 | return new Response(shouldGetPasteContent ? item.paste : null, { headers })
256 | }
257 |
--------------------------------------------------------------------------------
/worker/handlers/handleWrite.ts:
--------------------------------------------------------------------------------
1 | import { verifyAuth } from "../pages/auth.js"
2 | import { decode, genRandStr, WorkerError } from "../common.js"
3 | import { createPaste, getPasteMetadata, pasteNameAvailable, updatePaste } from "../storage/storage.js"
4 | import {
5 | DEFAULT_PASSWD_LEN,
6 | NAME_REGEX,
7 | PASTE_NAME_LEN,
8 | PRIVATE_PASTE_NAME_LEN,
9 | PASSWD_SEP,
10 | MIN_PASSWD_LEN,
11 | MAX_PASSWD_LEN,
12 | } from "../../shared/constants.js"
13 | import { parsePath, parseSize, parseExpiration } from "../../shared/parsers.js"
14 | import { PasteResponse } from "../../shared/interfaces.js"
15 | import { MaxFileSizeExceededError, MultipartParseError, parseMultipartRequest } from "@mjackson/multipart-parser"
16 | import { handleMPUComplete, handleMPUCreate, handleMPUCreateUpdate, handleMPUResume } from "./handleMPU.js"
17 |
18 | type ParsedMultipartPart = {
19 | filename?: string
20 | content: ReadableStream | ArrayBuffer
21 | contentAsString: () => string
22 | contentLength: number
23 | }
24 |
25 | async function multipartToMap(req: Request, sizeLimit: number): Promise> {
26 | const partsMap = new Map()
27 | try {
28 | await parseMultipartRequest(req, { maxFileSize: sizeLimit }, async (part) => {
29 | if (part.name) {
30 | if (part.isFile) {
31 | const arrayBuffer = await part.arrayBuffer()
32 | partsMap.set(part.name, {
33 | filename: part.filename,
34 | content: arrayBuffer,
35 | contentLength: arrayBuffer.byteLength,
36 | contentAsString: () => decode(arrayBuffer),
37 | })
38 | } else {
39 | const arrayBuffer = await part.arrayBuffer()
40 | partsMap.set(part.name, {
41 | filename: part.filename,
42 | content: arrayBuffer,
43 | contentAsString: () => decode(arrayBuffer),
44 | contentLength: arrayBuffer.byteLength,
45 | })
46 | }
47 | }
48 | })
49 | } catch (err) {
50 | if (err instanceof MaxFileSizeExceededError) {
51 | throw new WorkerError(413, `payload too large (max ${sizeLimit} bytes allowed)`)
52 | } else if (err instanceof MultipartParseError) {
53 | console.error(err)
54 | throw new WorkerError(400, "Failed to parse multipart request")
55 | } else {
56 | throw err
57 | }
58 | }
59 | return partsMap
60 | }
61 |
62 | export async function handlePostOrPut(
63 | request: Request,
64 | env: Env,
65 | _: ExecutionContext,
66 | isPut: boolean,
67 | ): Promise {
68 | if (!isPut) {
69 | // only POST requires auth, since PUT request already contains auth
70 | const authResponse = verifyAuth(request, env)
71 | if (authResponse !== null) {
72 | return authResponse
73 | }
74 | }
75 |
76 | const url = new URL(request.url)
77 |
78 | let isMPUComplete = false
79 | if (url.pathname === "/mpu/create" && !isPut) {
80 | return handleMPUCreate(request, env)
81 | } else if (url.pathname === "/mpu/create-update" && !isPut) {
82 | return handleMPUCreateUpdate(request, env)
83 | } else if (url.pathname === "/mpu/resume" && isPut) {
84 | return handleMPUResume(request, env)
85 | } else if (url.pathname === "/mpu/complete") {
86 | isMPUComplete = true // we will handle mpu complete later since it is uploaded with formdata
87 | } else if (url.pathname.startsWith("/mpu/")) {
88 | throw new WorkerError(400, "illegal mpu operation")
89 | }
90 |
91 | const contentType = request.headers.get("Content-Type") || ""
92 |
93 | // parse formdata
94 | if (!contentType.includes("multipart/form-data")) {
95 | throw new WorkerError(400, `bad usage, please use 'multipart/form-data' instead of ${contentType}`)
96 | }
97 |
98 | const parts = await multipartToMap(request, parseSize(env.R2_MAX_ALLOWED)!)
99 |
100 | if (!parts.has("c")) {
101 | throw new WorkerError(400, "cannot find content in formdata")
102 | }
103 | const { filename, content, contentAsString, contentLength } = parts.get("c")!
104 | const nameFromForm = parts.get("n")?.contentAsString()
105 | const isPrivate = parts.has("p")
106 | const passwdFromForm = parts.get("s")?.contentAsString()
107 | const expireFromForm: string | undefined = parts.get("e")?.contentAsString()
108 | const encryptionScheme: string | undefined = parts.get("encryption-scheme")?.contentAsString()
109 | const highlightLanguage = parts.get("lang")?.contentAsString()
110 | const expire = expireFromForm ? expireFromForm : env.DEFAULT_EXPIRATION
111 |
112 | const uploadedParts = isMPUComplete ? (JSON.parse(contentAsString()) as R2UploadedPart[]) : undefined
113 |
114 | // parse expiration
115 | let expirationSeconds = parseExpiration(expire)
116 | if (expirationSeconds === null) {
117 | throw new WorkerError(400, `‘${expire}’ is not a valid expiration specification`)
118 | }
119 | const maxExpiration = parseExpiration(env.MAX_EXPIRATION)!
120 | if (expirationSeconds > maxExpiration) {
121 | expirationSeconds = maxExpiration
122 | }
123 |
124 | // check if password is legal
125 | // TODO: sync checks to frontend
126 | if (passwdFromForm) {
127 | if (passwdFromForm.length > MAX_PASSWD_LEN) {
128 | throw new WorkerError(400, `password too long (${passwdFromForm.length} > ${MAX_PASSWD_LEN})`)
129 | } else if (passwdFromForm.length < MIN_PASSWD_LEN) {
130 | throw new WorkerError(400, `password too short (${passwdFromForm.length} < ${MIN_PASSWD_LEN})`)
131 | } else if (passwdFromForm.includes("\n")) {
132 | throw new WorkerError(400, `password should not contain newline`)
133 | }
134 | }
135 |
136 | // check if name is legal
137 | if (nameFromForm !== undefined && isPut) {
138 | throw new WorkerError(400, `Cannot set name for a PUT request`)
139 | }
140 | if (nameFromForm !== undefined && !NAME_REGEX.test(nameFromForm)) {
141 | throw new WorkerError(400, `Name ${nameFromForm} not satisfying regexp ${NAME_REGEX}`)
142 | }
143 |
144 | function makeResponse(created: PasteResponse, additionalHeaders: Record = {}): Response {
145 | return new Response(JSON.stringify(created, null, 2), {
146 | headers: { "Content-Type": "application/json;charset=UTF-8", ...additionalHeaders },
147 | })
148 | }
149 |
150 | function accessUrl(short: string): string {
151 | return env.DEPLOY_URL + "/" + short
152 | }
153 |
154 | function manageUrl(short: string, passwd: string): string {
155 | return env.DEPLOY_URL + "/" + short + PASSWD_SEP + passwd
156 | }
157 |
158 | const now = new Date()
159 | if (isPut) {
160 | let pasteName: string | undefined
161 | let password: string | undefined
162 | // if isMPCComplete, we cannot parse path
163 | if (!isMPUComplete) {
164 | const parsed = parsePath(url.pathname)
165 | if (parsed.password === undefined) {
166 | throw new WorkerError(403, `no password for PUT request`)
167 | }
168 | pasteName = parsed.name
169 | password = parsed.password
170 | } else {
171 | pasteName = url.searchParams.get("name") || undefined
172 | if (pasteName === undefined) {
173 | throw new WorkerError(400, `no name for MPU complete`)
174 | }
175 | }
176 |
177 | const r2Object = isMPUComplete ? await handleMPUComplete(request, env, uploadedParts!) : undefined
178 |
179 | const originalMetadata = await getPasteMetadata(env, pasteName)
180 | if (originalMetadata === null) {
181 | throw new WorkerError(404, `paste of name ‘${pasteName}’ is not found`)
182 | }
183 |
184 | // no need to check password for MPCComplete, it is already checked on creation
185 | if (!isMPUComplete && password !== originalMetadata.passwd) {
186 | throw new WorkerError(403, `incorrect password for paste ‘${pasteName}’`)
187 | }
188 |
189 | const newPasswd = passwdFromForm || originalMetadata.passwd
190 | await updatePaste(env, pasteName, content, originalMetadata, {
191 | expirationSeconds,
192 | now,
193 | passwd: newPasswd,
194 | contentLength: r2Object?.size || contentLength,
195 | filename,
196 | highlightLanguage,
197 | encryptionScheme,
198 | isMPUComplete,
199 | })
200 | return makeResponse(
201 | {
202 | url: accessUrl(pasteName),
203 | manageUrl: manageUrl(pasteName, newPasswd),
204 | expirationSeconds,
205 | expireAt: new Date(now.getTime() + 1000 * expirationSeconds).toISOString(),
206 | },
207 | { etag: r2Object?.httpEtag },
208 | )
209 | } else {
210 | let pasteName: string | undefined
211 | if (isMPUComplete) {
212 | if (url.searchParams.has("name")) {
213 | pasteName = url.searchParams.get("name")!
214 | } else {
215 | throw new WorkerError(400, `no name for MPU complete`)
216 | }
217 | } else if (nameFromForm !== undefined) {
218 | pasteName = "~" + nameFromForm
219 | if (!(await pasteNameAvailable(env, pasteName))) {
220 | throw new WorkerError(409, `name '${pasteName}' is already used`)
221 | }
222 | } else {
223 | pasteName = genRandStr(isPrivate ? PRIVATE_PASTE_NAME_LEN : PASTE_NAME_LEN)
224 | }
225 |
226 | const r2Object = isMPUComplete ? await handleMPUComplete(request, env, uploadedParts!) : undefined
227 |
228 | const password = passwdFromForm || genRandStr(DEFAULT_PASSWD_LEN)
229 | await createPaste(env, pasteName, content, {
230 | expirationSeconds,
231 | now,
232 | passwd: password,
233 | filename,
234 | highlightLanguage,
235 | contentLength: r2Object?.size || contentLength,
236 | encryptionScheme,
237 | isMPUComplete,
238 | })
239 |
240 | return makeResponse(
241 | {
242 | url: accessUrl(pasteName),
243 | manageUrl: manageUrl(pasteName, password),
244 | expirationSeconds,
245 | expireAt: new Date(now.getTime() + 1000 * expirationSeconds).toISOString(),
246 | },
247 | { etag: r2Object?.httpEtag },
248 | )
249 | }
250 | }
251 |
--------------------------------------------------------------------------------
/worker/storage/storage.ts:
--------------------------------------------------------------------------------
1 | import { dateToUnix, workerAssert, WorkerError } from "../common.js"
2 | import { parseSize } from "../../shared/parsers.js"
3 | import { PasteLocation } from "../../shared/interfaces.js"
4 |
5 | // since CF does not allow expiration shorter than 60s, extend the expiration to 70s
6 | const PASTE_EXPIRE_SPECIFIED_MIN = 70
7 |
8 | /* Since we need the metadata stored in KV to perform R2 cleanup,
9 | the paste in KV should not be deleted until it is cleaned in R2.
10 | We extend the lifetime by 2 days to avoid it being cleaned in VK too early
11 | */
12 | const PASTE_EXPIRE_EXTENSION_FOR_R2 = 2 * 24 * 60 * 60
13 |
14 | // TODO: allow admin to upload permanent paste
15 | // TODO: add filename length check
16 | export type PasteMetadata = {
17 | schemaVersion: 1
18 | location: PasteLocation // new field on V1
19 | passwd: string
20 |
21 | lastModifiedAtUnix: number
22 | createdAtUnix: number
23 | willExpireAtUnix: number
24 |
25 | accessCounter: number // a counter representing how frequent it is accessed, to administration usage
26 | sizeBytes: number
27 | filename?: string
28 | highlightLanguage?: string
29 | encryptionScheme?: string
30 | }
31 |
32 | type PasteMetadataInStorage = {
33 | schemaVersion: number
34 | location?: PasteLocation
35 | passwd: string
36 |
37 | lastModifiedAtUnix: number
38 | createdAtUnix: number
39 | willExpireAtUnix: number
40 |
41 | accessCounter?: number
42 | sizeBytes?: number
43 | filename?: string
44 | highlightLanguage?: string
45 | encryptionScheme?: string
46 | }
47 |
48 | function migratePasteMetadata(original: PasteMetadataInStorage): PasteMetadata {
49 | return {
50 | schemaVersion: 1,
51 | location: original.location || "KV",
52 | passwd: original.passwd,
53 |
54 | lastModifiedAtUnix: original.lastModifiedAtUnix,
55 | createdAtUnix: original.createdAtUnix,
56 | willExpireAtUnix: original.willExpireAtUnix,
57 |
58 | accessCounter: original.accessCounter || 0,
59 | sizeBytes: original.sizeBytes || 0,
60 | filename: original.filename,
61 | highlightLanguage: original.highlightLanguage,
62 | encryptionScheme: original.encryptionScheme,
63 | }
64 | }
65 |
66 | export type PasteWithMetadata = {
67 | paste: ArrayBuffer | ReadableStream
68 | metadata: PasteMetadata
69 | httpEtag?: string
70 | }
71 |
72 | async function updateAccessCounter(env: Env, short: string, value: ArrayBuffer, metadata: PasteMetadata) {
73 | // update counter with probability 1%
74 | if (Math.random() < 0.01) {
75 | metadata.accessCounter += 1
76 | try {
77 | await env.PB.put(short, value, {
78 | metadata: metadata,
79 | expiration: metadata.willExpireAtUnix,
80 | })
81 | } catch (e) {
82 | // ignore rate limit message
83 | if (!(e as Error).message.includes("KV PUT failed: 429 Too Many Requests")) {
84 | throw e
85 | }
86 | }
87 | }
88 | }
89 |
90 | export async function getPaste(env: Env, short: string, ctx: ExecutionContext): Promise {
91 | const item = await env.PB.getWithMetadata(short, {
92 | type: "arrayBuffer",
93 | })
94 |
95 | if (item.value === null) {
96 | return null
97 | } else {
98 | workerAssert(item.metadata != null, `paste of name '${short}' has no metadata`)
99 | const metadata = migratePasteMetadata(item.metadata)
100 | const expired = metadata.willExpireAtUnix < new Date().getTime() / 1000
101 |
102 | ctx.waitUntil(
103 | (async () => {
104 | if (expired) {
105 | await deletePaste(env, short, metadata)
106 | return null
107 | }
108 | await updateAccessCounter(env, short, item.value!, metadata)
109 | })(),
110 | )
111 |
112 | if (expired) {
113 | return null
114 | }
115 |
116 | if (metadata.location === "R2") {
117 | const object = await env.R2.get(short)
118 | if (object === null) {
119 | return null
120 | }
121 | return { paste: object.body, metadata, httpEtag: object.httpEtag }
122 | } else {
123 | return { paste: item.value, metadata }
124 | }
125 | }
126 | }
127 |
128 | // we separate usage of getPasteMetadata and getPaste to make access metric more reliable
129 | export async function getPasteMetadata(env: Env, short: string): Promise {
130 | const item = await env.PB.getWithMetadata(short, {
131 | type: "stream",
132 | })
133 |
134 | if (item.value === null) {
135 | return null
136 | } else if (item.metadata === null) {
137 | throw new WorkerError(500, `paste of name '${short}' has no metadata`)
138 | } else {
139 | if (item.metadata.willExpireAtUnix < new Date().getTime() / 1000) {
140 | return null
141 | }
142 | return migratePasteMetadata(item.metadata)
143 | }
144 | }
145 |
146 | interface WriteOptions {
147 | now: Date
148 | contentLength: number
149 | expirationSeconds: number
150 | passwd: string
151 | filename?: string
152 | highlightLanguage?: string
153 | encryptionScheme?: string
154 | isMPUComplete: boolean
155 | }
156 |
157 | export async function updatePaste(
158 | env: Env,
159 | pasteName: string,
160 | content: ArrayBuffer | ReadableStream,
161 | originalMetadata: PasteMetadata,
162 | options: WriteOptions,
163 | ) {
164 | const expirationUnix = dateToUnix(options.now) + options.expirationSeconds
165 | let expirationUnixSpecified =
166 | dateToUnix(options.now) + Math.max(options.expirationSeconds, PASTE_EXPIRE_SPECIFIED_MIN)
167 |
168 | if (originalMetadata.location === "R2") {
169 | expirationUnixSpecified = expirationUnixSpecified + PASTE_EXPIRE_EXTENSION_FOR_R2
170 |
171 | if (!options.isMPUComplete) {
172 | await env.R2.put(pasteName, content)
173 | }
174 | }
175 |
176 | // if the paste is previous on R2, we keep it on R2 to avoid losing reference to it
177 | const newLocation =
178 | originalMetadata.location === "R2" || options.isMPUComplete || options.contentLength > parseSize(env.R2_THRESHOLD)!
179 | ? "R2"
180 | : "KV"
181 | const metadata: PasteMetadata = {
182 | schemaVersion: 1,
183 | location: newLocation,
184 | filename: options.filename,
185 | highlightLanguage: options.highlightLanguage,
186 | passwd: options.passwd,
187 |
188 | lastModifiedAtUnix: dateToUnix(options.now),
189 | createdAtUnix: originalMetadata.createdAtUnix,
190 | willExpireAtUnix: expirationUnix,
191 | accessCounter: originalMetadata.accessCounter,
192 | sizeBytes: options.contentLength,
193 | encryptionScheme: options.encryptionScheme,
194 | }
195 |
196 | await env.PB.put(pasteName, originalMetadata.location === "R2" ? "" : content, {
197 | metadata: metadata,
198 | expiration: expirationUnixSpecified,
199 | })
200 | }
201 |
202 | export async function createPaste(
203 | env: Env,
204 | pasteName: string,
205 | content: ArrayBuffer | ReadableStream,
206 | options: WriteOptions,
207 | ) {
208 | const expirationUnix = dateToUnix(options.now) + options.expirationSeconds
209 |
210 | let expirationUnixSpecified =
211 | dateToUnix(options.now) + Math.max(options.expirationSeconds, PASTE_EXPIRE_SPECIFIED_MIN)
212 |
213 | const location = options.isMPUComplete || options.contentLength > parseSize(env.R2_THRESHOLD)! ? "R2" : "KV"
214 | if (location === "R2") {
215 | expirationUnixSpecified = expirationUnixSpecified + PASTE_EXPIRE_EXTENSION_FOR_R2
216 |
217 | if (!options.isMPUComplete) {
218 | await env.R2.put(pasteName, content)
219 | }
220 | }
221 |
222 | const metadata: PasteMetadata = {
223 | schemaVersion: 1,
224 | location: location,
225 | filename: options.filename,
226 | highlightLanguage: options.highlightLanguage,
227 | passwd: options.passwd,
228 |
229 | lastModifiedAtUnix: dateToUnix(options.now),
230 | createdAtUnix: dateToUnix(options.now),
231 | willExpireAtUnix: expirationUnix,
232 | accessCounter: 0,
233 | sizeBytes: options.contentLength,
234 | encryptionScheme: options.encryptionScheme,
235 | }
236 |
237 | await env.PB.put(pasteName, location === "R2" ? "" : content, {
238 | metadata: metadata,
239 | expiration: expirationUnixSpecified,
240 | })
241 | }
242 |
243 | export async function pasteNameAvailable(env: Env, pasteName: string): Promise {
244 | const item = await env.PB.getWithMetadata(pasteName)
245 | if (item.value == null) {
246 | return true
247 | } else if (item.metadata === null) {
248 | throw new WorkerError(500, `paste of name '${pasteName}' has no metadata`)
249 | } else {
250 | return item.metadata.willExpireAtUnix < new Date().getTime() / 1000
251 | }
252 | }
253 |
254 | export async function deletePaste(env: Env, pasteName: string, originalMetadata: PasteMetadata): Promise {
255 | await env.PB.delete(pasteName)
256 | if (originalMetadata.location === "R2") {
257 | await env.R2.delete(pasteName)
258 | }
259 | }
260 |
261 | export async function cleanExpiredInR2(env: Env, controller: ScheduledController) {
262 | // types generated by wrangler somehow not working, so cast manually
263 | type Listed = {
264 | list_complete: false
265 | keys: KVNamespaceListKey[]
266 | cursor: string
267 | cacheStatus: string | null
268 | }
269 |
270 | const nowUnix = controller.scheduledTime / 1000
271 |
272 | let numCleaned = 0
273 | const r2NamesToClean: string[] = []
274 |
275 | async function clean() {
276 | await env.R2.delete(r2NamesToClean)
277 | numCleaned += r2NamesToClean.length
278 | r2NamesToClean.length = 0
279 | }
280 |
281 | let cursor: string | null = null
282 | while (true) {
283 | const listed = (await env.PB.list({ cursor })) as Listed
284 |
285 | cursor = listed.cursor
286 |
287 | for (const key of listed.keys) {
288 | if (key.metadata !== undefined) {
289 | const metadata = migratePasteMetadata(key.metadata)
290 | if (metadata.location === "R2" && metadata.willExpireAtUnix < nowUnix) {
291 | r2NamesToClean.push(key.name)
292 |
293 | if (r2NamesToClean.length === 1000) {
294 | await clean()
295 | }
296 | }
297 | }
298 | }
299 |
300 | if (listed.list_complete) break
301 | }
302 | await clean()
303 |
304 | console.log(`${numCleaned} buckets cleaned`)
305 | }
306 |
--------------------------------------------------------------------------------
/frontend/pages/DisplayPaste.tsx:
--------------------------------------------------------------------------------
1 | import React, { useEffect, useState } from "react"
2 |
3 | import { Button, CircularProgress, Link, Tooltip } from "@heroui/react"
4 | import chardet from "chardet"
5 |
6 | import { useErrorModal } from "../components/ErrorModal.js"
7 | import { DarkModeToggle, useDarkModeSelection } from "../components/DarkModeToggle.js"
8 | import { DownloadIcon, HomeIcon } from "../components/icons.js"
9 | import { CopyWidget } from "../components/CopyWidget.js"
10 |
11 | import { parseFilenameFromContentDisposition, parsePath } from "../../shared/parsers.js"
12 | import { decodeKey, decrypt, EncryptionScheme } from "../utils/encryption.js"
13 | import { formatSize } from "../utils/utils.js"
14 | import { tst } from "../utils/overrides.js"
15 | import { highlightHTML, useHLJS } from "../utils/HighlightLoader.js"
16 |
17 | import "../style.css"
18 | import "../styles/highlight-theme-light.css"
19 | import "../styles/highlight-theme-dark.css"
20 |
21 | const utf8CompatibleEncodings = ["UTF-8", "ASCII", "ISO-8859-1"]
22 |
23 | export function DisplayPaste() {
24 | const [pasteFile, setPasteFile] = useState(undefined)
25 | const [pasteContentBuffer, setPasteContentBuffer] = useState(undefined)
26 | const [pasteLang, setPasteLang] = useState(undefined)
27 |
28 | const [isFileBinary, setFileBinary] = useState(false)
29 | const [guessedEncoding, setGuessedEncoding] = useState(null)
30 | const [isDecrypted, setDecrypted] = useState<"not encrypted" | "encrypted" | "decrypted">("not encrypted")
31 | const [forceShowBinary, setForceShowBinary] = useState(false)
32 | const showFileContent = pasteFile !== undefined && (!isFileBinary || forceShowBinary)
33 |
34 | const [isLoading, setIsLoading] = useState(false)
35 |
36 | const { ErrorModal, showModal, handleFailedResp } = useErrorModal()
37 | const [_, modeSelection, setModeSelection] = useDarkModeSelection()
38 | const hljs = useHLJS()
39 |
40 | const pasteStringContent = pasteContentBuffer && new TextDecoder().decode(pasteContentBuffer)
41 |
42 | const highlightedHTML = pasteStringContent ? highlightHTML(hljs, pasteLang, pasteStringContent) : ""
43 | const pasteLineCount = (highlightedHTML?.match(/\n/g)?.length || 0) + 1
44 |
45 | // uncomment the following lines for testing
46 | // const url = new URL("http://localhost:8787/GQbf")
47 | const url = new URL(location.toString())
48 |
49 | const { name, ext, filename } = parsePath(url.pathname)
50 |
51 | useEffect(() => {
52 | const pasteUrl = `${API_URL}/${name}`
53 |
54 | const fetchPaste = async () => {
55 | try {
56 | setIsLoading(true)
57 | const resp = await fetch(pasteUrl)
58 | if (!resp.ok) {
59 | await handleFailedResp("Failed to Fetch Paste", resp)
60 | return
61 | }
62 |
63 | const scheme: EncryptionScheme | null = resp.headers.get("X-PB-Encryption-Scheme") as EncryptionScheme | null
64 | let filenameFromDisp = resp.headers.has("Content-Disposition")
65 | ? parseFilenameFromContentDisposition(resp.headers.get("Content-Disposition")!) || undefined
66 | : undefined
67 | if (filenameFromDisp && scheme !== null) {
68 | filenameFromDisp = filenameFromDisp.replace(/.encrypted$/, "")
69 | }
70 |
71 | const lang = url.searchParams.get("lang") || resp.headers.get("X-PB-Highlight-Language")
72 |
73 | const inferredFilename = filename || (ext && name + ext) || filenameFromDisp
74 | const respBytes = await resp.bytes()
75 | setPasteLang(lang || undefined)
76 |
77 | const keyString = url.hash.slice(1)
78 | if (scheme === null || keyString.length === 0) {
79 | setPasteFile(new File([respBytes], inferredFilename || name))
80 | setPasteContentBuffer(respBytes)
81 | if (scheme) {
82 | setDecrypted("encrypted")
83 | setFileBinary(true)
84 | } else {
85 | const encoding = chardet.detect(respBytes)
86 | setFileBinary(encoding === null || !utf8CompatibleEncodings.includes(encoding))
87 | setGuessedEncoding(encoding)
88 | }
89 | } else {
90 | let key: CryptoKey | undefined
91 | try {
92 | key = await decodeKey(scheme, keyString)
93 | } catch {
94 | showModal("Error", `Failed to parse “${keyString}” as ${scheme} key`)
95 | return
96 | }
97 | if (key === undefined) {
98 | showModal("Error", `Failed to parse “${keyString}” as ${scheme} key`)
99 | return
100 | }
101 |
102 | const decrypted = await decrypt(scheme, key, respBytes)
103 | if (decrypted === null) {
104 | showModal("Error", "Failed to decrypt content")
105 | return
106 | }
107 |
108 | setPasteFile(new File([decrypted], inferredFilename || name))
109 | setPasteContentBuffer(decrypted)
110 | setPasteLang(lang || undefined)
111 |
112 | const encoding = chardet.detect(decrypted)
113 | setFileBinary(encoding === null || !utf8CompatibleEncodings.includes(encoding))
114 | setDecrypted("decrypted")
115 | setGuessedEncoding(encoding)
116 | }
117 | } finally {
118 | setIsLoading(false)
119 | }
120 | }
121 | fetchPaste().catch((e) => {
122 | showModal(`Error on fetching ${pasteUrl}`, (e as Error).toString())
123 | console.error(e)
124 | })
125 | }, [])
126 |
127 | const binaryFileIndicator = pasteFile && (
128 |
129 | {`${pasteFile?.name} (${formatSize(pasteFile.size)})`}
130 |
131 | This file seems to be binary or not in UTF-8{guessedEncoding ? ` (${guessedEncoding} guessed). ` : ". "}
132 |
135 |
136 |
137 | )
138 |
139 | const lineNumOffset = `${Math.floor(Math.log10(pasteLineCount)) + 3}ch`
140 | const buttonClasses = `rounded-full bg-background hover:bg-default-100 ${tst}`
141 | return (
142 |
145 |
146 |
147 |
148 |
149 |
152 | {INDEX_PAGE_TITLE}
153 |
154 | {" / "}
155 | {name}
156 |
157 | {isDecrypted === "decrypted" ? " (Decrypted)" : isDecrypted === "encrypted" ? " (Encrypted)" : ""}
158 |
159 |
160 | {showFileContent && (
161 |
162 | pasteStringContent!} />
163 |
164 | )}
165 | {pasteFile && (
166 |
167 |
172 |
173 | )}
174 |
229 | )
230 | }
231 |
--------------------------------------------------------------------------------