feat: 完成鸽达达后台安全与审计改造

server/internal/library/storager/upload_local.go

@@ -13,6 +13,7 @@ import (
 	"github.com/gogf/gf/v2/os/gfile"
 	"github.com/gogf/gf/v2/os/gtime"
 	"github.com/gogf/gf/v2/util/gconv"
+	"io"
 	"os"
 	"path/filepath"
 	"sort"
@@ -137,20 +138,53 @@ func (d *LocalDrive) UploadPart(ctx context.Context, in *UploadPartParams) (res
 
 // MergePartFile 合并分片文件
 func MergePartFile(srcPath, dstPath string) (err error) {
-	dir, err := os.ReadDir(srcPath)
+	entries, err := os.ReadDir(srcPath)
 	if err != nil {
 		return err
 	}
-	sort.Slice(dir, func(i, j int) bool {
-		fiIndex, _ := strconv.Atoi(dir[i].Name())
-		fjIndex, _ := strconv.Atoi(dir[j].Name())
-		return fiIndex < fjIndex
+	type filePart struct {
+		index int
+		path  string
+	}
+	parts := make([]filePart, 0, len(entries))
+	for _, entry := range entries {
+		if entry.IsDir() {
+			continue
+		}
+		index, parseErr := strconv.Atoi(entry.Name())
+		if parseErr != nil || index <= 0 {
+			return gerror.Newf("无效的分片文件名：%s", entry.Name())
+		}
+		parts = append(parts, filePart{index: index, path: filepath.Join(srcPath, entry.Name())})
+	}
+	if len(parts) == 0 {
+		return gerror.New("没有可合并的分片文件")
+	}
+	sort.Slice(parts, func(i, j int) bool {
+		return parts[i].index < parts[j].index
 	})
-	for _, file := range dir {
-		filePath := filepath.Join(srcPath, file.Name())
-		if err = gfile.PutBytesAppend(dstPath, gfile.GetBytes(filePath)); err != nil {
-			return err
+	if err = os.MkdirAll(filepath.Dir(dstPath), 0o755); err != nil {
+		return gerror.Wrap(err, "创建目标目录失败")
+	}
+	dstFile, err := os.OpenFile(dstPath, os.O_CREATE|os.O_WRONLY|os.O_TRUNC, 0o644)
+	if err != nil {
+		return gerror.Wrap(err, "创建合并文件失败")
+	}
+	defer dstFile.Close()
+
+	for _, part := range parts {
+		srcFile, openErr := os.Open(part.path)
+		if openErr != nil {
+			return gerror.Wrapf(openErr, "打开分片%d失败", part.index)
+		}
+		_, copyErr := io.Copy(dstFile, srcFile)
+		closeErr := srcFile.Close()
+		if copyErr != nil {
+			return gerror.Wrapf(copyErr, "合并分片%d失败", part.index)
+		}
+		if closeErr != nil {
+			return gerror.Wrapf(closeErr, "关闭分片%d失败", part.index)
 		}
 	}
-	return
+	return dstFile.Sync()
 }

server/internal/library/storager/upload_local_test.go

@@ -1,61 +1,52 @@
 package storager
 
 import (
-	"crypto/md5"
-	"errors"
-	"fmt"
-	"io"
+	"bytes"
 	"os"
+	"path/filepath"
 	"testing"
 )
 
 func TestMergePartFile(t *testing.T) {
-	srcFile, _ := os.Open("1.zip")
-	defer srcFile.Close()
-	fileInfo, err := srcFile.Stat()
-	if err != nil {
-		t.Error(err)
+	tempDir := t.TempDir()
+	partDir := filepath.Join(tempDir, "parts")
+	if err := os.MkdirAll(partDir, 0o755); err != nil {
+		t.Fatal(err)
 	}
-	hash := md5.New()
-	_, err = io.Copy(hash, srcFile)
-	sum := hash.Sum(nil)
-	fileHash := fmt.Sprintf("%x", sum)
 
-	var singleSize = int64(1024 * 1024 * 100)
-	chunks := int(fileInfo.Size() / singleSize)
-	if fileInfo.Size()%singleSize != 0 {
-		chunks += 1
+	parts := map[string][]byte{
+		"1":  []byte("first-"),
+		"2":  []byte("second-"),
+		"10": []byte("tenth"),
 	}
-	srcFile.Seek(0, io.SeekStart)
-	for j := 0; j < chunks; j++ {
-		partSize := singleSize
-		if j == chunks-1 {
-			partSize = fileInfo.Size() - int64(j)*singleSize
+	for name, content := range parts {
+		if err := os.WriteFile(filepath.Join(partDir, name), content, 0o644); err != nil {
+			t.Fatal(err)
 		}
-		partData := make([]byte, partSize)
-		_, err = io.ReadFull(srcFile, partData)
-		pf, _ := os.Create(fmt.Sprintf("tmp/%d", j+1))
-		_, err = pf.Write(partData)
-		if err != nil {
-			t.Error(err)
-			return
-		}
-		pf.Close()
 	}
 
-	err = MergePartFile("tmp/", "2.zip")
+	destination := filepath.Join(tempDir, "merged.bin")
+	if err := os.WriteFile(destination, []byte("stale-data"), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	if err := MergePartFile(partDir, destination); err != nil {
+		t.Fatalf("合并分片失败: %v", err)
+	}
+
+	actual, err := os.ReadFile(destination)
 	if err != nil {
-		t.Error(err)
-		return
+		t.Fatal(err)
 	}
+	expected := []byte("first-second-tenth")
+	if !bytes.Equal(actual, expected) {
+		t.Fatalf("合并内容不符 expected=%q actual=%q", expected, actual)
+	}
+}
 
-	f2, _ := os.Open("2.zip")
-	hash2 := md5.New()
-	_, err = io.Copy(hash2, f2)
-	sum2 := hash.Sum(nil)
-	fileHash2 := fmt.Sprintf("%x", sum2)
-	if fileHash != fileHash2 {
-		t.Error(errors.New("hash mismatch"))
+func TestMergePartFileRejectsEmptyDirectory(t *testing.T) {
+	partDir := t.TempDir()
+	err := MergePartFile(partDir, filepath.Join(t.TempDir(), "merged.bin"))
+	if err == nil {
+		t.Fatal("空分片目录应返回错误")
 	}
-
 }