From a6da3c369abf68bfc79e90001e494dbddda37f3b Mon Sep 17 00:00:00 2001
From: Allan Carr <allan.carr@thinkimex.com>
Date: Wed, 28 Aug 2024 09:34:56 -0700
Subject: [PATCH] Correct Build and file name sanitization

---
 Dockerfile                                  | 33 +++++++++++++--------
 ecosystem.config.js => ecosystem.config.cjs |  0
 util/generateUniqueFilename.ts              |  6 +++-
 util/heicConverter.ts                       | 29 ++++++++++--------
 4 files changed, 42 insertions(+), 26 deletions(-)
 rename ecosystem.config.js => ecosystem.config.cjs (100%)

diff --git a/Dockerfile b/Dockerfile
index 79b0d42..8aae3ec 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -15,8 +15,8 @@ RUN npm install
 # Bundle app source
 COPY . .
 
-RUN apt-get -y update
-RUN apt install wget
+RUN apt -y update
+RUN apt install -y wget
 
 # PNG ,JPG ,Tiff & WebP support
 # Consider adding more support with testing https://gist.github.com/hurricup/e14ae5bc47705fca6b1680e7a1fb6580
@@ -26,21 +26,32 @@ RUN apt install -y libtiff-dev
 RUN apt install -y libwebp-dev
 
 # Install HEIF support (libheic-dev Package does not exist on 16.04)
-RUN apt-get -y install libde265-dev
-RUN apt-get -y install pkg-config m4 libtool automake autoconf
+RUN apt -y install libde265-dev
+RUN apt -y install pkg-config m4 libtool automake autoconf cmake
+
+RUN wget https://github.com/strukturag/libde265/archive/v1.0.15.tar.gz
+RUN tar -xvf v1.0.15.tar.gz
+WORKDIR /usr/src/app/libde265-1.0.15/
+RUN cmake .
+RUN make
+RUN make install
+RUN ./autogen.sh
+RUN ./configure
+
+WORKDIR /usr/src/app
+
 RUN wget https://github.com/strukturag/libheif/archive/v1.18.2.tar.gz
 RUN tar -xvf v1.18.2.tar.gz 
 WORKDIR /usr/src/app/libheif-1.18.2/
-RUN ./autogen.sh 
-RUN ./configure 
+RUN cmake --preset=release .
 RUN make
 RUN make install
 
 WORKDIR /usr/src/app
 
 # Install ruby 2.3.0 for ImageMagick
-RUN apt-get -y install build-essential zlib1g-dev libssl-dev libreadline6-dev libyaml-dev
-RUN apt-get -y install wget && apt-get install -y ruby-full && ruby -v
+RUN apt -y install -y build-essential zlib1g-dev libssl-dev libreadline6-dev libyaml-dev
+RUN apt -y install -y ruby-full && ruby -v
 
 # Install ImageMagick
 # RUN apt-get install imagemagick -y
@@ -56,9 +67,7 @@ RUN ldconfig /usr/local/lib
 RUN identify --version
 
 
-RUN apt-get update && apt-get install -y \
-    ghostscript \
-    graphicsmagick \
+RUN apt update && apt install -y ghostscript graphicsmagick \
     && rm -rf /var/lib/apt/lists/*
 
 WORKDIR /usr/src/app
@@ -67,4 +76,4 @@ RUN npm run build
 RUN npm install pm2 -g
 
 EXPOSE 8000
-CMD [ "pm2-runtime", "ecosystem.config.js" ]
\ No newline at end of file
+CMD [ "pm2-runtime", "ecosystem.config.cjs" ]
\ No newline at end of file
diff --git a/ecosystem.config.js b/ecosystem.config.cjs
similarity index 100%
rename from ecosystem.config.js
rename to ecosystem.config.cjs
diff --git a/util/generateUniqueFilename.ts b/util/generateUniqueFilename.ts
index 3b62f72..4978a47 100644
--- a/util/generateUniqueFilename.ts
+++ b/util/generateUniqueFilename.ts
@@ -8,7 +8,11 @@ export function generateUniqueBillFilename(file: Express.Multer.File, invoice_nu
   return `${sanitizeFileName(invoice_number)}-${Math.floor(Date.now() / 1000)}${path.extname(file.originalname)}`;
 }
 
+export function generateUniqueHeicFilename(file: Express.Multer.File) {
+  return `${path.parse(sanitizeFileName(path.basename(file.originalname))).name}-${Math.floor(Date.now() / 1000)}.jpeg`;
+}
+
 function sanitizeFileName(fileName: string): string {
-  const restrictedChars = /[<>:"/\\|?*\x00-\x1F]/g;
+  const restrictedChars = /[<>:"/\\|?*#\x00-\x1F]/g;
   return fileName.replace(restrictedChars, "");
 }
diff --git a/util/heicConverter.ts b/util/heicConverter.ts
index f4ae44b..e5c223d 100644
--- a/util/heicConverter.ts
+++ b/util/heicConverter.ts
@@ -5,6 +5,7 @@ import fs from "fs-extra";
 import gm from "gm";
 import path from "path";
 import { logger } from "../server.js";
+import { generateUniqueHeicFilename } from "./generateUniqueFilename.js";
 import { FolderPaths } from "./serverInit.js";
 
 dotenv.config({
@@ -15,19 +16,21 @@ const imageMagick = gm.subClass({ imageMagick: true });
 
 export async function ConvertHeicFiles(files: Express.Multer.File[]) {
   const validFiles = await filterValidHeicFiles(files);
-  await Promise.all(validFiles.map(async (file) => {
-    const convertedFileName = `${path.parse(path.basename(file.originalname)).name}-${Math.floor(Date.now() / 1000)}.jpeg`;
-    try {
-      await ConvertToJpeg(file.path, `${file.destination}/${convertedFileName}`);
-      logger.log("debug", `Converted ${file.filename} image to JPEG from HEIC.`);
-      await handleOriginalFile(file, convertedFileName);
-      file.filename = convertedFileName;
-      file.mimetype = "image/jpeg";
-      file.path = `${file.destination}/${convertedFileName}`;
-    } catch (error) {
-      logger.log("error", `Error converting ${file.filename} image to JPEG from HEIC. ${JSON.stringify(error)}`);
-    }
-  }));
+  await Promise.all(
+    validFiles.map(async (file) => {
+      const convertedFileName = generateUniqueHeicFilename(file);
+      try {
+        await ConvertToJpeg(file.path, `${file.destination}/${convertedFileName}`);
+        logger.log("debug", `Converted ${file.filename} image to JPEG from HEIC.`);
+        await handleOriginalFile(file, convertedFileName);
+        file.filename = convertedFileName;
+        file.mimetype = "image/jpeg";
+        file.path = `${file.destination}/${convertedFileName}`;
+      } catch (error) {
+        logger.log("error", `Error converting ${file.filename} image to JPEG from HEIC. ${JSON.stringify(error)}`);
+      }
+    })
+  );
 }
 
 async function filterValidHeicFiles(files: Express.Multer.File[]) {