chore: sync commits from swe-productivity study (#616) by C4illin · Pull Request #617 · C4illin/ConvertX

C4illin · 2026-08-19T20:48:45Z

Summary by cubic

Adds opt-in URL imports, folder drag-and-drop, and file sharing on the results page. Filename sanitization now gives way to safe-path validation, preserving nested paths while rejecting traversal.

ALLOW_URL_UPLOAD is off by default and controls both the URL field and POST /url.
URL imports accept HTTP(S), follow up to five redirects within 30 seconds, derive a safe filename, and return its size.
Folder drops preserve relative paths, and conversion output creates missing parent directories.
Results expose file sharing only when the browser supports the Web Share API; the downloaded file is cached for a second tap if needed.
Downloads now use /download/:userId/:jobId/*; clients that hardcode the old route must update.
Upload, delete, convert, and download reject unsafe paths with "Unsafe filename" while allowing nested paths.
Docker starts through entrypoint.sh, which validates ImageMagick dimension values and applies them to its policy.

^{Written for commit 917c118. Summary will update on new commits.}

Co-authored-by: Jennifer Wang <jennifer123wang@gmail.com> Co-authored-by: strawberry-raccoon <253751817+strawberry-raccoon@users.noreply.github.com>

cubic-dev-ai

2 issues found and verified against the latest diff

Prompt for AI agents (unresolved issues)


Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="src/pages/url.tsx">

<violation number="1" location="src/pages/url.tsx:55">
P2: When a remote server supplies an all-dot or reserved filename, `getFilename` returns an empty name and the download fails. Fall back to a non-empty generated filename after sanitization, preserving the MIME extension when available.</violation>

<violation number="2" location="src/pages/url.tsx:56">
P1: A remote server can make this handler wait indefinitely and buffer an arbitrarily large body. Add an abort timeout and stream the response through an enforced maximum byte count instead of calling `res.blob()` without a limit.</violation>
</file>

_{Reply with feedback, questions, or to request a fix.

Re-trigger cubic}

cubic-dev-ai · 2026-08-19T21:05:54Z

+      throw new Error(`Failed to download URL, received ${res.status}`);
+    }
+    const filename = getFilename(body.url, res.headers);
+    const fileSizeBytes = await Bun.write(`${userUploadsDir}${filename}`, await res.blob());


P1: A remote server can make this handler wait indefinitely and buffer an arbitrarily large body. Add an abort timeout and stream the response through an enforced maximum byte count instead of calling res.blob() without a limit.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At src/pages/url.tsx, line 56: <comment>A remote server can make this handler wait indefinitely and buffer an arbitrarily large body. Add an abort timeout and stream the response through an enforced maximum byte count instead of calling `res.blob()` without a limit.</comment> <file context> @@ -0,0 +1,65 @@ + throw new Error(`Failed to download URL, received ${res.status}`); + } + const filename = getFilename(body.url, res.headers); + const fileSizeBytes = await Bun.write(`${userUploadsDir}${filename}`, await res.blob()); + + return { </file context>

cubic-dev-ai

7 issues found across 14 files (changes from recent commits).

Prompt for AI agents (unresolved issues)


Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="tests/validateUrl.test.ts">

<violation number="1" location="tests/validateUrl.test.ts:11">
P1: These expectations enshrine an SSRF-prone contract: an enabled URL upload can use the server to fetch `localhost` and private-network resources. Remove the private-host allow cases and reject resolved loopback, link-local, private, and other internal destinations before every fetch and redirect.</violation>
</file>

<file name="public/results.js">

<violation number="1" location="public/results.js:31">
P2: After the first attempt caches the file, this branch skips `isFetching = true`, so rapid clicks can start concurrent `navigator.share` calls. Set `isFetching` before the cache check and leave `finally` to clear it.</violation>
</file>

<file name="entrypoint.sh">

<violation number="1" location="entrypoint.sh:5">
P2: When `MAGICK_MAX_WIDTH` or `MAGICK_MAX_HEIGHT` is set to `0`, this check accepts it despite requiring a positive integer, then writes a zero ImageMagick dimension limit. Reject zero values so invalid configuration fails at startup rather than making normal image conversions exceed the limit.</violation>
</file>

<file name="src/pages/url.tsx">

<violation number="1" location="src/pages/url.tsx:15">
P2: When URL uploads are disabled, throwing a plain `Error` changes the response into an unhandled 500 instead of the 403 set immediately above. Return an error body after setting the status, or throw Elysia’s explicit 403 response.</violation>

<violation number="2" location="src/pages/url.tsx:59">
P2: When the origin sends headers and then stalls the response body, this clears the abort timer before `res.blob()` consumes that body, so the request can hang indefinitely. Keep the timer active through body consumption, or apply a separate timeout to the response stream.</violation>
</file>

<file name="src/helpers/getFilename.ts">

<violation number="1" location="src/helpers/getFilename.ts:12">
P2: When a response uses a valid RFC 5987 language tag, this regex ignores the supplied filename and falls back to the URL name. Allow the optional language token between `UTF-8'` and the encoded value.</violation>

<violation number="2" location="src/helpers/getFilename.ts:47">
P2: When the sanitized response filename is already 255 bytes and the MIME type supplies an extension, this appends the extension after truncation and makes the URL upload fail. Keep the final basename within 255 bytes, for example by falling back to a UUID when the suffix would exceed the limit.</violation>
</file>

_{Tip: Review your code locally with the cubic CLI to iterate faster.

Re-trigger cubic}

cubic-dev-ai · 2026-09-15T20:34:38Z

+  });
+
+  test("allows local IP and LAN addresses for self-hosted usage", () => {
+    expect(() => validateSafeUrl("http://localhost:3000/test.jpg")).not.toThrow();


P1: These expectations enshrine an SSRF-prone contract: an enabled URL upload can use the server to fetch localhost and private-network resources. Remove the private-host allow cases and reject resolved loopback, link-local, private, and other internal destinations before every fetch and redirect.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At tests/validateUrl.test.ts, line 11: <comment>These expectations enshrine an SSRF-prone contract: an enabled URL upload can use the server to fetch `localhost` and private-network resources. Remove the private-host allow cases and reject resolved loopback, link-local, private, and other internal destinations before every fetch and redirect.</comment> <file context> @@ -0,0 +1,36 @@ + }); + + test("allows local IP and LAN addresses for self-hosted usage", () => { + expect(() => validateSafeUrl("http://localhost:3000/test.jpg")).not.toThrow(); + expect(() => validateSafeUrl("http://192.168.1.50/file.png")).not.toThrow(); + expect(() => validateSafeUrl("http://10.0.0.5/doc.pdf")).not.toThrow(); </file context>

cubic-dev-ai · 2026-09-15T20:34:38Z

+        if (!cachedFile) {
+          isFetching = true;


P2: After the first attempt caches the file, this branch skips isFetching = true, so rapid clicks can start concurrent navigator.share calls. Set isFetching before the cache check and leave finally to clear it.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At public/results.js, line 31: <comment>After the first attempt caches the file, this branch skips `isFetching = true`, so rapid clicks can start concurrent `navigator.share` calls. Set `isFetching` before the cache check and leave `finally` to clear it.</comment> <file context> @@ -21,17 +21,31 @@ const setupShareButtons = () => { - const blob = await response.blob(); - const file = new File([blob], filename, { type: mimeType }); - await navigator.share({ files: [file] }); + if (!cachedFile) { + isFetching = true; + const response = await fetch(fileUrl); </file context>

Suggested change

if (!cachedFile) {

isFetching = true;

isFetching = true;

if (!cachedFile) {

cubic-dev-ai · 2026-09-15T20:34:38Z

+set -e
+
+if [ -n "$MAGICK_MAX_WIDTH" ]; then
+  if ! [[ "$MAGICK_MAX_WIDTH" =~ ^[0-9]+$ ]]; then


P2: When MAGICK_MAX_WIDTH or MAGICK_MAX_HEIGHT is set to 0, this check accepts it despite requiring a positive integer, then writes a zero ImageMagick dimension limit. Reject zero values so invalid configuration fails at startup rather than making normal image conversions exceed the limit.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At entrypoint.sh, line 5: <comment>When `MAGICK_MAX_WIDTH` or `MAGICK_MAX_HEIGHT` is set to `0`, this check accepts it despite requiring a positive integer, then writes a zero ImageMagick dimension limit. Reject zero values so invalid configuration fails at startup rather than making normal image conversions exceed the limit.</comment> <file context> @@ -1,20 +1,44 @@ set -e +if [ -n "$MAGICK_MAX_WIDTH" ]; then + if ! [[ "$MAGICK_MAX_WIDTH" =~ ^[0-9]+$ ]]; then + echo "Error: MAGICK_MAX_WIDTH must be a positive integer in pixels" >&2 + exit 1 </file context>

cubic-dev-ai · 2026-09-15T20:34:38Z

+  async ({ body, redirect, user, cookie: { jobId }, set }) => {
+    if (!ALLOW_URL_UPLOAD) {
+      set.status = 403;
+      throw new Error("URL upload is disabled");


P2: When URL uploads are disabled, throwing a plain Error changes the response into an unhandled 500 instead of the 403 set immediately above. Return an error body after setting the status, or throw Elysia’s explicit 403 response.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At src/pages/url.tsx, line 15: <comment>When URL uploads are disabled, throwing a plain `Error` changes the response into an unhandled 500 instead of the 403 set immediately above. Return an error body after setting the status, or throw Elysia’s explicit 403 response.</comment> <file context> @@ -1,39 +1,20 @@ + async ({ body, redirect, user, cookie: { jobId }, set }) => { + if (!ALLOW_URL_UPLOAD) { + set.status = 403; + throw new Error("URL upload is disabled"); + } + </file context>

Suggested change

throw new Error("URL upload is disabled");

return { message: "URL upload is disabled" };

cubic-dev-ai · 2026-09-15T20:34:39Z

+        break;
+      }
+    } finally {
+      clearTimeout(timeout);


P2: When the origin sends headers and then stalls the response body, this clears the abort timer before res.blob() consumes that body, so the request can hang indefinitely. Keep the timer active through body consumption, or apply a separate timeout to the response stream.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At src/pages/url.tsx, line 59: <comment>When the origin sends headers and then stalls the response body, this clears the abort timer before `res.blob()` consumes that body, so the request can hang indefinitely. Keep the timer active through body consumption, or apply a separate timeout to the response stream.</comment> <file context> @@ -48,12 +29,47 @@ export const url = new Elysia().use(userService).post( + break; + } + } finally { + clearTimeout(timeout); + } + </file context>

cubic-dev-ai · 2026-09-15T20:34:39Z

+  let candidate = "";
+  const contentDisposition = headers.get("Content-Disposition");
+  if (contentDisposition) {
+    const utf8Match = /filename\*=UTF-8''([^;\s]+)/i.exec(contentDisposition);


P2: When a response uses a valid RFC 5987 language tag, this regex ignores the supplied filename and falls back to the URL name. Allow the optional language token between UTF-8' and the encoded value.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At src/helpers/getFilename.ts, line 12: <comment>When a response uses a valid RFC 5987 language tag, this regex ignores the supplied filename and falls back to the URL name. Allow the optional language token between `UTF-8'` and the encoded value.</comment> <file context> @@ -0,0 +1,51 @@ + let candidate = ""; + const contentDisposition = headers.get("Content-Disposition"); + if (contentDisposition) { + const utf8Match = /filename\*=UTF-8''([^;\s]+)/i.exec(contentDisposition); + if (utf8Match && utf8Match[1]) { + try { </file context>

cubic-dev-ai · 2026-09-15T20:34:39Z

+  }
+
+  if (!sanitized.includes(".") && extension) {
+    return `${sanitized}.${extension}`;


P2: When the sanitized response filename is already 255 bytes and the MIME type supplies an extension, this appends the extension after truncation and makes the URL upload fail. Keep the final basename within 255 bytes, for example by falling back to a UUID when the suffix would exceed the limit.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At src/helpers/getFilename.ts, line 47: <comment>When the sanitized response filename is already 255 bytes and the MIME type supplies an extension, this appends the extension after truncation and makes the URL upload fail. Keep the final basename within 255 bytes, for example by falling back to a UUID when the suffix would exceed the limit.</comment> <file context> @@ -0,0 +1,51 @@ + } + + if (!sanitized.includes(".") && extension) { + return `${sanitized}.${extension}`; + } + </file context>

C4illin and others added 2 commits August 19, 2026 22:48

sync commits from swe-productivity study (#616)

8665103

Co-authored-by: Jennifer Wang <jennifer123wang@gmail.com> Co-authored-by: strawberry-raccoon <253751817+strawberry-raccoon@users.noreply.github.com>

remove study config

99d2635

cubic-dev-ai Bot reviewed Aug 19, 2026

View reviewed changes

fix test

4685b75

Trithereon mentioned this pull request Sep 10, 2026

Folders & subfolders #450

Open

Merge remote-tracking branch 'origin/main' into sync-branch

3e87190

C4illin changed the title ~~sync commits from swe-productivity study (#616)~~ chore: sync commits from swe-productivity study (#616) Sep 12, 2026

autofix-ci Bot and others added 10 commits September 12, 2026 00:26

[autofix.ci] apply automated fixes

9b77670

correct default value

7c980f4

check MAGICK sizes are integer and edit policy instead of replacing

89c3bd2

use buildDownloadUrl

efec1d5

Disable url upload feature by default

3e3d2de

add more tests to validatePath

5eaca58

gate URL ui

c58b4f8

add more checks to file download

ed63bc5

cache file if it timeouts

610f1f6

many fixes from cubic

484545c

cubic-dev-ai Bot reviewed Sep 15, 2026

View reviewed changes

C4illin added 4 commits September 15, 2026 22:41

Merge branch 'main' into sync-branch

a90a5da

fix lockfile

666bc49

fix duplicate import

3bb36c4

format

917c118

	throw new Error("URL upload is disabled");
	return { message: "URL upload is disabled" };

Uh oh!

Conversation

C4illin commented Aug 19, 2026 • edited by cubic-dev-ai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary by cubic

Uh oh!

cubic-dev-ai Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

cubic-dev-ai Bot Aug 19, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

cubic-dev-ai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

cubic-dev-ai Bot Sep 15, 2026

Choose a reason for hiding this comment

Uh oh!

cubic-dev-ai Bot Sep 15, 2026

Choose a reason for hiding this comment

Uh oh!

cubic-dev-ai Bot Sep 15, 2026

Choose a reason for hiding this comment

Uh oh!

cubic-dev-ai Bot Sep 15, 2026

Choose a reason for hiding this comment

Uh oh!

cubic-dev-ai Bot Sep 15, 2026

Choose a reason for hiding this comment

Uh oh!

cubic-dev-ai Bot Sep 15, 2026

Choose a reason for hiding this comment

Uh oh!

cubic-dev-ai Bot Sep 15, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

C4illin commented Aug 19, 2026 •

edited by cubic-dev-ai Bot

Loading

cubic-dev-ai Bot left a comment •

edited

Loading