adds file extension blacklist logic

Author: tdjsnelling

api/src/controllers/torrent.js

@@ -97,6 +97,19 @@ export const uploadTorrent = async (req, res, next) => {
         ];
       }
 
+      const hasBlackListedFiles = files.some((file) =>
+        (process.env.SQ_EXTENSION_BLACKLIST ?? []).some((ext) =>
+          file.path.endsWith(`.${ext}`)
+        )
+      );
+
+      if (hasBlackListedFiles) {
+        res
+          .status(403)
+          .send("One or more files have blacklisted file extensions");
+        return;
+      }
+
       let groupId;
 
       if (req.body.groupWith) {

api/src/utils/validateConfig.js

@@ -49,6 +49,7 @@ const configSchema = yup
           text: yup.string().matches(hexRegex),
           grey: yup.string().matches(hexRegex),
         }),
+        SQ_EXTENSION_BLACKLIST: yup.array().of(yup.string()).min(0),
         SQ_BASE_URL: yup.string().matches(httpRegex).required(),
         SQ_API_URL: yup.string().matches(httpRegex).required(),
         SQ_MONGO_URL: yup.string().matches(mongoRegex).required(),

client/pages/upload.js

@@ -33,7 +33,7 @@ const FileUpload = styled(Box)(() =>
     borderColor: "border",
     borderRadius: 2,
     cursor: "pointer",
-    p: 5,
+    p: 6,
     "&:hover": {
       bg: "sidebar",
     },
@@ -191,6 +191,7 @@ const Upload = ({ token, userId }) => {
       SQ_API_URL,
       SQ_TORRENT_CATEGORIES,
       SQ_ALLOW_ANONYMOUS_UPLOAD,
+      SQ_EXTENSION_BLACKLIST,
     },
   } = getConfig();
 
@@ -322,6 +323,26 @@ const Upload = ({ token, userId }) => {
           </Text>
         </Text>
       </Box>
+      {!!SQ_EXTENSION_BLACKLIST.length && (
+        <Infobox mb={5}>
+          <Text mb={3}>
+            The following file extensions are blacklisted. Any torrent
+            containing files of these types will not be uploaded.
+          </Text>
+          <Text
+            fontFamily="mono"
+            display="inline-block"
+            bg="background"
+            border="1px solid"
+            borderColor="border"
+            borderRadius={1}
+            px={3}
+            py={1}
+          >
+            {SQ_EXTENSION_BLACKLIST.join(", ")}
+          </Text>
+        </Infobox>
+      )}
       <form onSubmit={handleUpload}>
         <Box mb={4}>
           <WrapLabel label="Torrent file" as="div">

config.example.js

@@ -70,6 +70,9 @@ module.exports = {
     // Enable if you want torrents to be indexed to help search traffic.
     SQ_ALLOW_UNREGISTERED_VIEW: false,
 
+    // An array of blacklisted file extensions. Torrents containing files with these extensions will fail to upload.
+    SQ_EXTENSION_BLACKLIST: ["exe"],
+
     // The URL of your tracker site.
     SQ_BASE_URL: "https://sqtracker.dev",