fix: 修复文件预览重定向与扩展名解析

server/db/mysql/adapter.go

@@ -72,6 +72,27 @@ func quoteIdent(name string) string {
 	return "`" + strings.ReplaceAll(name, "`", "``") + "`"
 }
 
+func parseFileUID(fid string) t.Uid {
+	name := strings.TrimSpace(fid)
+	id := t.ParseUid(name)
+	if !id.IsZero() {
+		return id
+	}
+	if dot := strings.LastIndexByte(name, '.'); dot > 0 {
+		ext := name[dot+1:]
+		if len(ext) == 0 || len(ext) > 16 {
+			return t.ZeroUid
+		}
+		for _, r := range ext {
+			if (r < 'A' || r > 'Z') && (r < 'a' || r > 'z') && (r < '0' || r > '9') {
+				return t.ZeroUid
+			}
+		}
+		return t.ParseUid(name[:dot])
+	}
+	return t.ZeroUid
+}
+
 type configType struct {
 	// DB connection settings.
 	// See https://pkg.go.dev/github.com/go-sql-driver/mysql#Config
@@ -4994,7 +5015,7 @@ func (a *adapter) FileFinishUpload(fd *t.FileDef, success bool, size int64) (*t.
 
 // FileGet fetches a record of a specific file
 func (a *adapter) FileGet(fid string) (*t.FileDef, error) {
-	id := t.ParseUid(fid)
+	id := parseFileUID(fid)
 	if id.IsZero() {
 		return nil, t.ErrMalformed
 	}
@@ -5188,7 +5209,7 @@ func (a *adapter) FileUserHasAccess(fid string, uid t.Uid) (bool, error) {
 	if uid.IsZero() {
 		return false, t.ErrMalformed
 	}
-	fileID := t.ParseUid(fid)
+	fileID := parseFileUID(fid)
 	if fileID.IsZero() {
 		return false, t.ErrMalformed
 	}

server/db/mysql/adapter_fileid_test.go

@@ -0,0 +1,26 @@
+//go:build mysql
+// +build mysql
+
+package mysql
+
+import (
+	"testing"
+
+	"github.com/tinode/chat/server/store/types"
+)
+
+func TestParseFileUIDStripsPublicExtension(t *testing.T) {
+	uid := types.ParseUid("scH0N8guCHk")
+	if uid.IsZero() {
+		t.Fatal("test UID failed to parse")
+	}
+	if got := parseFileUID("scH0N8guCHk.bin"); got != uid {
+		t.Fatalf("parseFileUID()=%q, want %q", got.String(), uid.String())
+	}
+	if got := parseFileUID("scH0N8guCHk.jpg"); got != uid {
+		t.Fatalf("parseFileUID()=%q, want %q", got.String(), uid.String())
+	}
+	if got := parseFileUID("scH0N8guCHk"); got != uid {
+		t.Fatalf("parseFileUID()=%q, want %q", got.String(), uid.String())
+	}
+}

server/db/mysql/tenant_adapter.go

@@ -7678,7 +7678,7 @@ func (a *adapter) TenantFileGet(id t.TenantID, fid string) (*t.FileDef, error) {
 		file, err := a.FileGet(fid)
 		return stampTenantFile(id, file), err
 	}
-	fileID := t.ParseUid(fid)
+	fileID := parseFileUID(fid)
 	if fileID.IsZero() {
 		return nil, t.ErrMalformed
 	}
@@ -7859,7 +7859,7 @@ func (a *adapter) TenantFileUserHasAccess(id t.TenantID, fid string, uid t.Uid)
 	if a.tenantScopedDB {
 		return a.FileUserHasAccess(fid, uid)
 	}
-	fileID := t.ParseUid(fid)
+	fileID := parseFileUID(fid)
 	if fileID.IsZero() {
 		return false, t.ErrMalformed
 	}