diff --git a/LANCommander.Server.Services/ArchiveService.cs b/LANCommander.Server.Services/ArchiveService.cs index 6fa32c84..700d07af 100644 --- a/LANCommander.Server.Services/ArchiveService.cs +++ b/LANCommander.Server.Services/ArchiveService.cs @@ -13,6 +13,7 @@ using Microsoft.AspNetCore.Http; using Microsoft.Extensions.Logging; using Microsoft.EntityFrameworkCore; using PascalCaseNamingConvention = YamlDotNet.Serialization.NamingConventions.PascalCaseNamingConvention; +using LANCommander.SDK; namespace LANCommander.Server.Services { @@ -51,7 +52,9 @@ namespace LANCommander.Server.Services storageLocationPath = storageLocation.Path; } - return Path.Combine(storageLocationPath, archive.ObjectKey); + return Path.IsPathRooted(storageLocationPath) ? + Path.Combine(storageLocationPath, archive.ObjectKey) : + Path.Combine(AppPaths.GetConfigDirectory(), storageLocationPath, archive.ObjectKey); } public async Task GetArchiveFileLocationAsync(string objectKey) diff --git a/LANCommander.Server.Services/GameSaveService.cs b/LANCommander.Server.Services/GameSaveService.cs index 684ddc7a..d558f550 100644 --- a/LANCommander.Server.Services/GameSaveService.cs +++ b/LANCommander.Server.Services/GameSaveService.cs @@ -7,6 +7,7 @@ using Microsoft.AspNetCore.Http; using Microsoft.EntityFrameworkCore; using Microsoft.Extensions.Logging; using ZiggyCreatures.Caching.Fusion; +using LANCommander.SDK; namespace LANCommander.Server.Services { @@ -46,7 +47,7 @@ namespace LANCommander.Server.Services await base.DeleteAsync(entity); } - public async Task GetSavePathAsync(Guid gameId, Guid userId) + public async Task GetSavePathAsync(Guid gameId, Guid userId) { var save = await SortBy(gs => gs.CreatedOn, Data.Enums.SortDirection.Descending).FirstOrDefaultAsync(gs => gs.GameId == gameId && gs.UserId == userId); @@ -56,7 +57,7 @@ namespace LANCommander.Server.Services return GetSavePath(save); } - public async Task GetSavePathAsync(Guid id) + public async Task GetSavePathAsync(Guid id) { // Use get with predicate to avoid async var save = await FirstOrDefaultAsync(gs => gs.Id == id); @@ -69,7 +70,10 @@ namespace LANCommander.Server.Services public string GetSavePath(GameSave save) { - return Path.Combine(save.StorageLocation.Path, save.UserId.ToString(), save.GameId.ToString(), $"{save.Id}"); + var gameId = save.GameId ?? throw new InvalidOperationException($"No game ID is available for save {save.Id}"); + return Path.IsPathRooted(save.StorageLocation.Path) ? + Path.Combine(save.StorageLocation.Path, save.UserId.ToString(), gameId.ToString(), $"{save.Id}") : + Path.Combine(AppPaths.GetConfigDirectory(), save.StorageLocation.Path, save.UserId.ToString(), gameId.ToString(), $"{save.Id}"); } public async Task GetDefaultStorageLocationAsync() diff --git a/LANCommander.Server.Services/Helpers/FileHelpers.cs b/LANCommander.Server.Services/Helpers/FileHelpers.cs index 367c259e..9fc98555 100644 --- a/LANCommander.Server.Services/Helpers/FileHelpers.cs +++ b/LANCommander.Server.Services/Helpers/FileHelpers.cs @@ -2,7 +2,7 @@ { public static class FileHelpers { - public static void DeleteIfExists(string path) + public static void DeleteIfExists(string? path) { if (File.Exists(path)) File.Delete(path); diff --git a/LANCommander.Server.Services/UpdateService.cs b/LANCommander.Server.Services/UpdateService.cs index b0841421..2f25618c 100644 --- a/LANCommander.Server.Services/UpdateService.cs +++ b/LANCommander.Server.Services/UpdateService.cs @@ -5,16 +5,12 @@ using Semver; using System.Diagnostics; using System.IO.Compression; using System.Net; -using System.Reflection; using System.Runtime.InteropServices; -using AutoMapper; using LANCommander.Server.Services.Abstractions; -using LANCommander.Server.Services.Enums; using LANCommander.Server.Services.Exceptions; -using LANCommander.Server.Services.Models; using LANCommander.Server.Settings.Enums; using Microsoft.Extensions.DependencyInjection; -using ZiggyCreatures.Caching.Fusion; +using LANCommander.SDK; namespace LANCommander.Server.Services { @@ -269,15 +265,13 @@ namespace LANCommander.Server.Services applicationLifetime.StopApplication(); } - public string GetLauncherFileLocation(LauncherArtifact artifact) - { - return GetLauncherFileLocation(artifact.Name); - } + public string GetLauncherFileLocation(LauncherArtifact artifact) => + GetLauncherFileLocation(artifact.Name); - public string GetLauncherFileLocation(string objectKey) - { - return Path.Combine(_settingsProvider.CurrentValue.Server.Launcher.StoragePath, objectKey); - } + public string GetLauncherFileLocation(string objectKey) => + Path.IsPathRooted(_settingsProvider.CurrentValue.Server.Launcher.StoragePath) ? + Path.Combine(_settingsProvider.CurrentValue.Server.Launcher.StoragePath, objectKey) : + Path.Combine(AppPaths.GetConfigDirectory(), _settingsProvider.CurrentValue.Server.Launcher.StoragePath, objectKey); public LauncherArtifact GetLauncherArtifact(string objectKey) { diff --git a/LANCommander.Server/Endpoints/DownloadEndpoints.cs b/LANCommander.Server/Endpoints/DownloadEndpoints.cs index 5858539c..e3ca0158 100644 --- a/LANCommander.Server/Endpoints/DownloadEndpoints.cs +++ b/LANCommander.Server/Endpoints/DownloadEndpoints.cs @@ -1,8 +1,8 @@ using System.Net.Mime; using System.Security.Claims; -using LANCommander.SDK.Services; using LANCommander.Server.Services; using LANCommander.Server.Services.Extensions; +using Microsoft.AspNetCore.Http.HttpResults; using Microsoft.AspNetCore.Mvc; namespace LANCommander.Server.Endpoints; @@ -18,76 +18,125 @@ public static class DownloadEndpoints group.MapGet("/Launcher/{objectKey}", DownloadLauncherAsync); } - internal static async Task DownloadArchiveAsync( + internal static async Task> DownloadArchiveAsync( Guid id, - [FromServices] ArchiveService archiveService) + [FromServices] ArchiveService archiveService, + [FromServices] ILoggerFactory loggerFactory) { + var logger = loggerFactory.CreateLogger(nameof(DownloadEndpoints)); + + logger.LogInformation("Attempting to download archive with ID: {ArchiveId}", id); + var archive = await archiveService - .Include(a => a.Game) - .Include(a => a.Redistributable) + .Include(a => a.Game!) + .Include(a => a.Redistributable!) .GetAsync(id); if (archive == null) + { + logger.LogWarning("Archive with ID {ArchiveId} not found", id); return TypedResults.NotFound(); - - var fileName = await archiveService.GetArchiveFileLocationAsync(archive); - + } + + var fileName = await archiveService.GetArchiveFileLocationAsync(archive); + if (!File.Exists(fileName)) + { + logger.LogWarning("Archive file not found at path: {FilePath} for archive ID {ArchiveId}", fileName, id); return TypedResults.NotFound(); + } string name = ""; if (archive.Game != null) + { name = $"{archive.Game.Title.SanitizeFilename()}.zip"; + logger.LogInformation("Serving game archive {GameTitle} (ID: {ArchiveId})", archive.Game.Title, id); + } else if (archive.Redistributable != null) + { name = $"{archive.Redistributable.Name.SanitizeFilename()}.zip"; - + logger.LogInformation("Serving redistributable archive {RedistName} (ID: {ArchiveId})", archive.Redistributable.Name, id); + } + return TypedResults.File(new FileStream(fileName, FileMode.Open, FileAccess.Read, FileShare.Read), fileDownloadName: name, contentType: MediaTypeNames.Application.Octet); } - internal static async Task DownloadSaveAsync( + internal static async Task> DownloadSaveAsync( Guid id, ClaimsPrincipal user, - [FromServices] GameSaveService gameSaveService) + [FromServices] GameSaveService gameSaveService, + [FromServices] ILoggerFactory loggerFactory) { + var logger = loggerFactory.CreateLogger(nameof(DownloadEndpoints)); + + logger.LogInformation("Attempting to download save with ID: {SaveId}", id); + var save = await gameSaveService - .Include(s => s.Game) - .Include(s => s.User) - .GetAsync(id); - + .Include(s => s.Game!) + .Include(s => s.User!) + .GetAsync(id); + if (user == null || user.Identity?.Name != save.User?.UserName && !user.IsInRole(RoleService.AdministratorRoleName)) + { + logger.LogWarning("Unauthorized access attempt for save {SaveId} by user {UserName}", id, user?.Identity?.Name); return TypedResults.Unauthorized(); - + } + if (save == null) + { + logger.LogWarning("Save with ID {SaveId} not found", id); return TypedResults.NotFound(); + } - var fileName = gameSaveService.GetSavePath(save); - + var fileName = gameSaveService.GetSavePath(save); + if (!File.Exists(fileName)) + { + logger.LogWarning("Save file not found at path: {FilePath}", fileName); return TypedResults.NotFound(); + } var name = - $"{save.User?.UserName} - {(save.Game != null ? "Unknown" : save.Game?.Title)} - {save.CreatedOn.ToString("MM-dd-yyyy.hh-mm")}.zip"; - + $"{save.User?.UserName} - {(save.Game != null ? "Unknown" : save.Game?.Title)} - {save.CreatedOn:MM-dd-yyyy.hh-mm}.zip"; + + logger.LogInformation("Successfully serving save file {FileName} for user {UserName}", name, save.User?.UserName); + return TypedResults.File(new FileStream(fileName, FileMode.Open, FileAccess.Read, FileShare.Read), fileDownloadName: name, contentType: MediaTypeNames.Application.Zip); } - internal static IResult DownloadLauncherAsync( + internal static Results, FileStreamHttpResult> DownloadLauncherAsync( string objectKey, ClaimsPrincipal user, - [FromServices] UpdateService updateService) + [FromServices] UpdateService updateService, + [FromServices] ILoggerFactory loggerFactory) { + var logger = loggerFactory.CreateLogger(nameof(DownloadEndpoints)); + + logger.LogInformation("Attempting to download launcher file with object key: {ObjectKey}", objectKey); + if (string.IsNullOrEmpty(objectKey)) + { + logger.LogWarning("Empty object key provided for launcher download"); return TypedResults.NotFound(); + } if (objectKey.Contains("..") || objectKey.Contains(Path.AltDirectorySeparatorChar) || objectKey.Contains(Path.DirectorySeparatorChar)) + { + logger.LogWarning("Invalid object key provided (potential path traversal attempt): {ObjectKey}", objectKey); return TypedResults.BadRequest("Bad object key provided."); + } var fileName = updateService.GetLauncherFileLocation(objectKey); var file = new FileInfo(fileName); if (!file.Exists) + { + logger.LogWarning("Launcher file not found at path: {FilePath} for object key: {ObjectKey}", fileName, objectKey); return TypedResults.NotFound(); + } + + logger.LogInformation("Successfully serving launcher file {FileName} for object key {ObjectKey}", file.Name, objectKey); return TypedResults.File(new FileStream(fileName, FileMode.Open, FileAccess.Read, FileShare.Read), fileDownloadName: file.Name, contentType: MediaTypeNames.Application.Octet); }