文件与富文本处理

// multipart/form-data 前端const form = new FormData()form.append('file', fileInput.files[0])await fetch('/api/upload', { method: 'POST', body: form })

// Base64 方式（仅适合 < 200KB 的小图）const reader = new FileReader()reader.onload = () => {  const base64 = reader.result.split(',')[1]  fetch('/api/avatar', {    method: 'POST',    headers: { 'Content-Type': 'application/json' },    body: JSON.stringify({ data: base64 }),  })}reader.readAsDataURL(file)

const multer = require('@koa/multer')const upload = multer({  storage: multer.memoryStorage(),          // 或 diskStorage 直接落盘  limits: {    fileSize: 10 * 1024 * 1024,             // 单文件 10MB    files: 5,                                // 最多 5 个文件  },})router.post('/upload', upload.single('file'), async (ctx) => {  if (!ctx.file) ctx.throw(400, '未选择文件')  // ... 校验与存储})

// 1. 扩展名白名单const ALLOWED_EXT = new Set(['.jpg', '.jpeg', '.png', '.gif', '.webp', '.pdf'])const ext = path.extname(file.originalname).toLowerCase()if (!ALLOWED_EXT.has(ext)) throw new Error('不支持的文件类型')// 2. MIME 类型if (!['image/jpeg', 'image/png', 'application/pdf'].includes(file.mimetype)) {  throw new Error('类型不匹配')}// 3. 文件头魔数（最关键，扩展名与 MIME 都可伪造）const MAGIC = [  { sig: Buffer.from([0xff, 0xd8, 0xff]), ext: '.jpg' },  { sig: Buffer.from([0x89, 0x50, 0x4e, 0x47]), ext: '.png' },  { sig: Buffer.from([0x47, 0x49, 0x46]), ext: '.gif' },  { sig: Buffer.from([0x25, 0x50, 0x44, 0x46]), ext: '.pdf' },   // %PDF]const header = file.buffer.subarray(0, 8)if (!MAGIC.some((m) => header.subarray(0, m.sig.length).equals(m.sig))) {  throw new Error('文件内容与类型不符')}// 4. 大小限制（multer limits 已限制，服务层再校验一次兜底）if (file.size > 10 * 1024 * 1024) throw new Error('文件过大')

// ✅ 重命名：不用用户原始文件名（防路径穿越、防覆盖）const filename = `${Date.now()}_${crypto.randomUUID()}${ext}`// ✅ 按日期分目录，避免单目录文件过多const dir = `/data/uploads/${year}/${month}/${day}/`// ✅ 保存原始文件名到数据库（用于下载时还原）await fileRepo.save({ path: `${dir}${filename}`, originalName: file.originalname })

// 前端直传：服务端只负责签发凭证router.get('/upload/token', async (ctx) => {  const policy = {    expiration: new Date(Date.now() + 10 * 60 * 1000).toISOString(),    conditions: [      ['content-length-range', 0, 20 * 1024 * 1024],   // 限制大小      ['starts-with', '$key', 'uploads/'],             // 限制路径    ],  }  ctx.body = {    code: 0,    data: {      host: process.env.OSS_HOST,      policy: base64(JSON.stringify(policy)),      signature: sign(policy, process.env.OSS_SECRET),      accessKeyId: process.env.OSS_ACCESS_KEY,      dir: 'uploads/',    },  }})

// 私有文件：生成带有效期的访问地址function signedUrl(key, expiresInSec = 3600) {  const expires = Math.floor(Date.now() / 1000) + expiresInSec  const signature = hmac(`${method}\n${expires}\n/${bucket}/${key}`, secret)  return `https://${host}/${key}?expires=${expires}&signature=${signature}`}

router.get('/files/:id/download', auth, async (ctx) => {  const file = await fileRepo.findById(ctx.params.id)  // 1. 权限校验：不是所有登录用户都能下所有文件  if (file.ownerId !== ctx.state.user.id && !ctx.state.user.isAdmin) {    ctx.throw(404)                                    // 用 404 不泄露存在性  }  // 2. 中文文件名要做编码  const encoded = encodeURIComponent(file.originalName)  ctx.set('Content-Disposition', `attachment; filename*=UTF-8''${encoded}`)  ctx.set('Content-Type', 'application/octet-stream')  // 3. 用流返回，避免大文件进内存  ctx.body = fs.createReadStream(file.path)})

const { size } = fs.statSync(filePath)const range = ctx.headers.rangeif (range) {  const [startStr, endStr] = range.replace('bytes=', '').split('-')  const start = parseInt(startStr, 10)  const end = endStr ? parseInt(endStr, 10) : size - 1  ctx.status = 206  ctx.set('Content-Range', `bytes ${start}-${end}/${size}`)  ctx.set('Accept-Ranges', 'bytes')  ctx.set('Content-Length', String(end - start + 1))  ctx.body = fs.createReadStream(filePath, { start, end })} else {  ctx.set('Accept-Ranges', 'bytes')  ctx.set('Content-Length', String(size))  ctx.body = fs.createReadStream(filePath)}

const puppeteer = require('puppeteer')async function htmlToPdf(html) {  const browser = await puppeteer.launch({ args: ['--no-sandbox'] })  const page = await browser.newPage()  await page.setContent(html, { waitUntil: 'networkidle0' })  const pdf = await page.pdf({    format: 'A4',    printBackground: true,    margin: { top: '20mm', bottom: '20mm', left: '15mm', right: '15mm' },  })  await browser.close()  return pdf}

// 1. 服务端入库前净化（信任边界在服务端）const DOMPurify = require('isomorphic-dompurify')const clean = DOMPurify.sanitize(rawHtml, {  ALLOWED_TAGS: ['p', 'br', 'strong', 'em', 'u', 's', 'h1', 'h2', 'h3',                 'ul', 'ol', 'li', 'blockquote', 'code', 'pre',                 'a', 'img', 'table', 'thead', 'tbody', 'tr', 'th', 'td'],  ALLOWED_ATTR: ['href', 'src', 'alt', 'title', 'class'],  ALLOWED_URI_REGEXP: /^(?:https?|mailto):/i,     // 禁止 javascript: 协议})

// 2. 前端渲染前再净化一次（纵深防御）el.innerHTML = DOMPurify.sanitize(content)