fix: 修复漏洞

Author: SilianZ

core/classes.py

@@ -46,8 +46,8 @@ async def getMissingFiles(files: FileList, pbar: tqdm) -> FileList:
 
     @abstractmethod
     async def express(
-        hash: str, request: web.Request, response: web.StreamResponse
-    ) -> Dict[str, Any]:
+        hash: str, counters: dict
+    ) -> web.Response:
         pass
 
     @abstractmethod

core/router.py

@@ -4,7 +4,6 @@
 from core.api import getStatus
 from core.storages import AListStorage
 from core.logger import logger
-from typing import Union
 from aiohttp import web
 import aiohttp
 import random
@@ -31,12 +30,10 @@ async def _(
             if not checkSign(file_hash, self.secret, request.query):
                 return web.Response(text="Invalid signature.", status=403)
 
-            response = None
-            data = await random.choice(self.storages).express(
-                file_hash, request, response
+            response = await random.choice(self.storages).express(
+                file_hash, self.counters
             )
-            self.counters["bytes"] += data["bytes"]
-            self.counters["hits"] += data["hits"]
+            
             self.connection -= 1
             logger.debug(response)
             return response

core/storages/alist.py

@@ -118,24 +118,24 @@ async def measure(self, size: int) -> str:
             logger.terror("storage.error.alist.measure", e=e)
             return ""
 
-    async def express(self, hash: str, request: web.Request, response) -> Dict[str, Any]:
+    async def express(self, hash: str, counter: dict) -> web.Response:
         path = f"{self.path}/{hash[:2]}/{hash}"
         async with aiohttp.ClientSession(self.url, headers=self.headers) as session:
             res = await session.post("/api/fs/get", json={"path": path, "password": self.password})
             data = await res.json()
             if data["code"] != 200:
                 response = web.HTTPNotFound()
-                return {"bytes": 0, "hits": 0}
+                return response
             try:
                 response = web.HTTPFound(data["data"]["raw_url"])
                 response.headers["x-bmclapi-hash"] = hash
-                logger.debug(data)
-                logger.debug(response)
-                return {"bytes": data["data"]["size"], "hits": 1}
+                counter["bytes"] += data["data"]["size"]
+                counter["hits"] += 1
+                return response
             except Exception as e:
                 response = web.HTTPError(text=e)
                 logger.debug(e)
-                return {"bytes": 0, "hits": 0}
+                return response
 
     async def writeFile(self, file: FileInfo, content: io.BytesIO, delay: int, retry: int) -> bool:
         file_path = f"{self.path}/{file.hash[:2]}/{file.hash}"

core/storages/local.py

@@ -84,22 +84,22 @@ async def checkFile(file: FileInfo, pbar: tqdm) -> bool:
         return FileList(files=missing_files)
 
     async def express(
-        self, hash: str, request: web.Request, response
-    ) -> Dict[str, Any]:
+        self, hash: str, counter: dict
+    ) -> web.Response:
         path = os.path.join(self.path, hash[:2], hash)
         if not os.path.exists(path):
             response = web.HTTPNotFound()
-            await response.prepare(request)
-            return {"bytes": 0, "hits": 0}
+            response
         try:
             file_size = os.path.getsize(path)
             response = web.FileResponse(path, status=200)
             response.headers["x-bmclapi-hash"] = hash
-            await response.prepare(request)
-            return {"bytes": file_size, "hits": 1}
+            counter["bytes"] += file_size
+            counter["hits"] += 1
+            return response
         except Exception as e:
             logger.debug(e)
-            return {"bytes": 0, "hits": 0}
+            return
 
     async def recycleFiles(self, files: FileList) -> None:
         delete_files = []