Update index.js

index.js

@@ -18,7 +18,7 @@ const app = express();
 app.use(express.json({ limit: "50mb" }));
 app.use(express.urlencoded({ extended: true }));
 
-// ROOT_DIR default ke os.tmpdir(), bisa override via env ROOT_DIR
+// ROOT_DIR default: os.tmpdir() (bisa override via env ROOT_DIR)
 const ROOT_DIR = path.resolve(process.env.ROOT_DIR || os.tmpdir());
 fsExtra.ensureDirSync(ROOT_DIR);
 
@@ -27,19 +27,30 @@ const uploadTmpDir = path.join(os.tmpdir(), "filemgr_uploads");
 fsExtra.ensureDirSync(uploadTmpDir);
 const upload = multer({ dest: uploadTmpDir });
 
-// Utils
-const toPosix = (p) => p.replace(/\\/g, "/");
-const badName = (name) => !name || name.includes("..") || name.includes("/") || name.includes("\\");
+// ===== Utils (tanpa regex untuk normalisasi path) =====
+const toPosix = (p) => String(p).split("\\").join("/");
+
+function stripLeadingSlashes(s) {
+  if (!s) return "";
+  let i = 0;
+  while (i < s.length && (s[i] === "/" || s[i] === "\\")) i++;
+  return s.slice(i);
+}
+const badName = (name) =>
+  !name || String(name).includes("..") || String(name).includes("/") || String(name).includes("\\");
+
 function safeResolve(rel = "") {
-  const relNorm = String(rel).replace(/^[/\```+/, "");
+  const relNorm = stripLeadingSlashes(String(rel));
   const full = path.resolve(ROOT_DIR, relNorm);
-  if (!full.startsWith(ROOT_DIR)) {
+  const relToRoot = path.relative(ROOT_DIR, full);
+  if (relToRoot.startsWith("..") || path.isAbsolute(relToRoot)) {
     const err = new Error("Path outside ROOT_DIR");
     err.status = 400;
     throw err;
   }
   return full;
 }
+
 function buildBreadcrumb(rel = "") {
   const parts = toPosix(rel).split("/").filter(Boolean);
   let acc = "";
@@ -50,11 +61,13 @@ function buildBreadcrumb(rel = "") {
   }
   return crumbs;
 }
+
+// Deteksi format arsip (tanpa regex)
 function detectExtFull(name) {
-  const lower = name.toLowerCase();
+  const lower = String(name).toLowerCase();
   if (lower.endsWith(".tar.gz")) return "tar.gz";
   if (lower.endsWith(".tgz")) return "tgz";
-  return path.extname(lower).slice(1);
+  return path.extname(lower).slice(1); // zip/tar dll
 }
 function archiveFormatFromName(name) {
   const e = detectExtFull(name);
@@ -64,14 +77,51 @@ function archiveFormatFromName(name) {
   return null;
 }
 function stripArchiveExt(baseName) {
-  return baseName
-    .replace(/\.tar\.gz$/i, "")
-    .replace(/\.tgz$/i, "")
-    .replace(/\.zip$/i, "")
-    .replace(/\.tar$/i, "");
+  let b = String(baseName);
+  const lower = b.toLowerCase();
+  if (lower.endsWith(".tar.gz")) return b.slice(0, -7);
+  if (lower.endsWith(".tgz")) return b.slice(0, -4);
+  if (lower.endsWith(".zip")) return b.slice(0, -4);
+  if (lower.endsWith(".tar")) return b.slice(0, -4);
+  return b;
+}
+function guessArchiveFormat(name, contentType = "") {
+  const byName = archiveFormatFromName(name);
+  if (byName) return byName;
+  const ct = String(contentType).toLowerCase();
+  if (ct.includes("zip")) return "zip";
+  if (ct.includes("x-tar") || ct === "application/tar") return "tar";
+  if (ct.includes("gzip")) return "tgz";
+  return null;
+}
+function parseContentDispositionFilename(cd) {
+  if (!cd) return null;
+  // Contoh: attachment; filename="file.zip"; filename*=UTF-8''file.zip
+  const parts = cd.split(";").map((s) => s.trim());
+  let fname = null;
+  for (const p of parts) {
+    if (p.toLowerCase().startsWith("filename*=")) {
+      let v = p.substring(9).trim(); // setelah 'filename*='
+      if ((v.startsWith('"') && v.endsWith('"')) || (v.startsWith("'") && v.endsWith("'"))) {
+        v = v.slice(1, -1);
+      }
+      const idx = v.indexOf("''");
+      if (idx !== -1) v = v.slice(idx + 2);
+      try { fname = decodeURIComponent(v); } catch { fname = v; }
+      break;
+    } else if (p.toLowerCase().startsWith("filename=")) {
+      let v = p.substring(9).trim();
+      if ((v.startsWith('"') && v.endsWith('"')) || (v.startsWith("'") && v.endsWith("'"))) {
+        v = v.slice(1, -1);
+      }
+      try { fname = decodeURIComponent(v); } catch { fname = v; }
+      // Jangan break dulu, utamakan filename* kalau ada (RFC)
+    }
+  }
+  return fname;
 }
 
-// Routes
+// ===== Routes =====
 app.get("/api/list", async (req, res, next) => {
   try {
     const rel = req.query.path ? String(req.query.path) : "";
@@ -113,6 +163,7 @@ app.get("/api/list", async (req, res, next) => {
   }
 });
 
+// Create folder
 app.post("/api/folder", async (req, res, next) => {
   try {
     const { parent = "", name } = req.body;
@@ -125,6 +176,7 @@ app.post("/api/folder", async (req, res, next) => {
   }
 });
 
+// Create file
 app.post("/api/file", async (req, res, next) => {
   try {
     const { parent = "", name, content = "" } = req.body;
@@ -139,6 +191,7 @@ app.post("/api/file", async (req, res, next) => {
   }
 });
 
+// Update text file
 app.put("/api/file", async (req, res, next) => {
   try {
     const { path: rel, content = "" } = req.body;
@@ -153,6 +206,7 @@ app.put("/api/file", async (req, res, next) => {
   }
 });
 
+// Read small text file
 app.get("/api/file", async (req, res, next) => {
   try {
     const rel = String(req.query.path || "");
@@ -167,6 +221,7 @@ app.get("/api/file", async (req, res, next) => {
   }
 });
 
+// Rename
 app.post("/api/rename", async (req, res, next) => {
   try {
     const { path: rel, newName } = req.body;
@@ -181,6 +236,7 @@ app.post("/api/rename", async (req, res, next) => {
   }
 });
 
+// Move
 app.post("/api/move", async (req, res, next) => {
   try {
     const { from, toDir } = req.body;
@@ -196,6 +252,7 @@ app.post("/api/move", async (req, res, next) => {
   }
 });
 
+// Delete
 app.delete("/api/entry", async (req, res, next) => {
   try {
     const rel = String(req.query.path || "");
@@ -207,6 +264,7 @@ app.delete("/api/entry", async (req, res, next) => {
   }
 });
 
+// Upload
 app.post("/api/upload", upload.array("files"), async (req, res, next) => {
   try {
     const rel = String(req.query.path || "");
@@ -224,39 +282,75 @@ app.post("/api/upload", upload.array("files"), async (req, res, next) => {
   }
 });
 
+// Download dari URL + auto-extract (ZIP/TAR/TGZ)
 app.post("/api/fetch-url", async (req, res, next) => {
   try {
-    const { url, destDir = "", filename } = req.body;
+    const { url, destDir = "", filename, autoExtract = true, removeArchive = false, extractTo } = req.body;
     if (!url) return res.status(400).json({ error: "Missing url" });
     const destDirFull = safeResolve(destDir);
     await fsExtra.ensureDir(destDirFull);
 
+    const resp = await axios.get(url, {
+      responseType: "stream",
+      validateStatus: (s) => s >= 200 && s < 400
+    });
+
     let name = filename;
-    const resp = await axios.get(url, { responseType: "stream", validateStatus: (s) => s >= 200 && s < 400 });
     if (!name) {
       const cd = resp.headers["content-disposition"];
-      if (cd) {
-        const m = /filename\*?=(?:UTF-8'')?["']?([^"';]+)["']?/i.exec(cd);
-        if (m) name = decodeURIComponent(m[1]);
-      }
+      name = parseContentDispositionFilename(cd);
       if (!name) {
         try {
           const u = new URL(url);
           const base = path.basename(u.pathname);
           name = base || "downloaded.file";
-        } catch {}
+        } catch {
+          name = "downloaded.file";
+        }
       }
     }
     if (badName(name)) name = `downloaded-${Date.now()}`;
-    const destFull = path.join(destDirFull, name);
-    const ws = fs.createWriteStream(destFull);
+    const savedRel = toPosix(path.join(destDir, name));
+    const savedFull = path.join(destDirFull, name);
+
+    // Simpan file
+    const ws = fs.createWriteStream(savedFull);
     await pipeline(resp.data, ws);
-    res.json({ ok: true, savedAs: toPosix(path.join(destDir, name)) });
+
+    let extractedTo = null;
+    if (autoExtract) {
+      const format = guessArchiveFormat(name, resp.headers["content-type"]);
+      if (format) {
+        let destRel = extractTo;
+        if (!destRel) {
+          const base = stripArchiveExt(path.basename(name));
+          destRel = toPosix(path.join(destDir, base));
+        }
+        const destFull = safeResolve(destRel);
+        await fsExtra.ensureDir(destFull);
+
+        if (format === "zip") {
+          await extract(savedFull, { dir: destFull });
+        } else if (format === "tar") {
+          await tar.x({ file: savedFull, cwd: destFull, gzip: false });
+        } else if (format === "tgz") {
+          await tar.x({ file: savedFull, cwd: destFull, gzip: true });
+        }
+        extractedTo = destRel;
+
+        if (removeArchive) {
+          await fsExtra.remove(savedFull);
+        }
+      }
+    }
+
+    res.json({ ok: true, savedAs: savedRel, extractedTo });
   } catch (err) {
     next(err);
   }
 });
 
+// Archive (zip/tar/tgz)
 app.post("/api/archive", async (req, res, next) => {
   try {
     const { path: rel = "", entries = [], name, format = "zip" } = req.body;
@@ -285,7 +379,7 @@ app.post("/api/archive", async (req, res, next) => {
 
     let outName = name;
     if (!outName) {
-      const ts = new Date().toISOString().replace(/[:.]/g, "-");
+      const ts = new Date().toISOString().replaceAll(":", "-").replaceAll(".", "-");
       outName = `archive-${ts}.${extName}`;
     } else {
       const lower = outName.toLowerCase();
@@ -307,13 +401,13 @@ app.post("/api/archive", async (req, res, next) => {
       archive.on("error", reject);
       archive.pipe(output);
 
-      for (const name of entries) {
-        if (badName(path.basename(name))) {
+      for (const nm of entries) {
+        if (badName(path.basename(nm))) {
           archive.destroy(new Error("Invalid entry name"));
           return;
         }
-        const full = path.join(dirFull, name);
-        const nameInArchive = path.basename(name);
+        const full = path.join(dirFull, nm);
+        const nameInArchive = path.basename(nm);
         if (fs.existsSync(full)) {
           const stat = fs.lstatSync(full);
           if (stat.isDirectory()) archive.directory(full, nameInArchive);
@@ -329,6 +423,7 @@ app.post("/api/archive", async (req, res, next) => {
   }
 });
 
+// Unarchive (zip/tar/tgz)
 app.post("/api/unarchive", async (req, res, next) => {
   try {
     const { zipPath, destDir } = req.body;
@@ -359,6 +454,7 @@ app.post("/api/unarchive", async (req, res, next) => {
   }
 });
 
+// Download file ke client
 app.get("/api/download", async (req, res, next) => {
   try {
     const rel = String(req.query.path || "");
@@ -371,7 +467,7 @@ app.get("/api/download", async (req, res, next) => {
   }
 });
 
-// UI
+// Serve UI
 app.use("/", express.static(path.join(__dirname, "public")));
 
 app.use((err, req, res, next) => {