Update server.js

server.js

@@ -281,7 +281,7 @@ fileRouter.get('/deleteFile', async (req, res) => {
     }
 
     const absoluteRequestedPath = path.normalize(path.join(TELEGRAM_DATA_DIR, relativePath));
-    if (!absoluteRequestedPath.startsWith(path.resolve(TELEGRAM_DATA_DIR))) {
+    if (!path.resolve(absoluteRequestedPath).startsWith(path.resolve(TELEGRAM_DATA_DIR))) {
         return res.status(403).json({ error: 'Forbidden: Path traversal attempt detected.' });
     }
 
@@ -318,19 +318,20 @@ fileRouter.get('/:botToken/deleteById', async (req, res) => {
             return res.status(404).json({ error: 'File not found or path not available via Telegram API (getFile).', details: fileInfo });
         }
 
-        const relativePathFromTg = fileInfo.result.file_path;
-        const absoluteRequestedPath = path.normalize(path.join(TELEGRAM_DATA_DIR, relativePathFromTg));
+        const filePathOnDisk = fileInfo.result.file_path; 
+        const resolvedDataDir = path.resolve(TELEGRAM_DATA_DIR);
+        const resolvedFilePathOnDisk = path.resolve(filePathOnDisk);
 
-        if (!absoluteRequestedPath.startsWith(path.resolve(TELEGRAM_DATA_DIR))) {
-            console.warn(`[DeleteById] Potential path traversal attempt blocked. Path: ${relativePathFromTg}`);
-            return res.status(403).json({ error: 'Forbidden: Invalid file path resolved.' });
+        if (!resolvedFilePathOnDisk.startsWith(resolvedDataDir)) {
+            console.error(`[Security] Attempt to delete file outside TELEGRAM_DATA_DIR. Requested: ${filePathOnDisk}, Allowed base: ${resolvedDataDir}`);
+            return res.status(403).json({ error: 'Forbidden: File path is outside allowed directory.' });
         }
 
-        if (fssync.existsSync(absoluteRequestedPath) && fssync.statSync(absoluteRequestedPath).isFile()) {
-            await fs.unlink(absoluteRequestedPath);
-            res.json({ success: true, message: `File deleted successfully. Path: ${relativePathFromTg}`, file_id: file_id });
+        if (fssync.existsSync(resolvedFilePathOnDisk) && fssync.statSync(resolvedFilePathOnDisk).isFile()) {
+            await fs.unlink(resolvedFilePathOnDisk);
+            res.json({ success: true, message: `File deleted successfully. Path: ${filePathOnDisk}`, file_id: file_id });
         } else {
-            res.status(404).json({ error: 'File not found on disk for the given file_id.', path_attempted: relativePathFromTg });
+            res.status(404).json({ error: 'File not found on disk for the given file_id.', path_attempted: filePathOnDisk });
         }
     } catch (error) {
         console.error(`Error in /:botToken/deleteById for file_id ${file_id}:`, error);
@@ -361,9 +362,17 @@ fileRouter.get('/downloadEncrypted', async (req, res) => {
             return res.status(404).json({ error: 'File not found or path not available via Telegram API.', details: fileInfo });
         }
 
-        const filePathOnDisk = path.join(TELEGRAM_DATA_DIR, fileInfo.result.file_path);
-        if (fssync.existsSync(filePathOnDisk) && fssync.statSync(filePathOnDisk).isFile()) {
-            res.sendFile(filePathOnDisk, { headers: { 'Content-Disposition': `attachment; filename="${path.basename(fileInfo.result.file_path)}"` } }, err => {
+        const filePathOnDisk = fileInfo.result.file_path;
+        const resolvedDataDir = path.resolve(TELEGRAM_DATA_DIR);
+        const resolvedFilePathOnDisk = path.resolve(filePathOnDisk);
+
+        if (!resolvedFilePathOnDisk.startsWith(resolvedDataDir)) {
+             console.error(`[Security] Attempt to access file outside TELEGRAM_DATA_DIR. Requested: ${filePathOnDisk}, Allowed base: ${resolvedDataDir}`);
+             return res.status(403).send('Forbidden: File path is outside allowed directory.');
+        }
+
+        if (fssync.existsSync(resolvedFilePathOnDisk) && fssync.statSync(resolvedFilePathOnDisk).isFile()) {
+            res.sendFile(resolvedFilePathOnDisk, { headers: { 'Content-Disposition': `attachment; filename="${path.basename(fileInfo.result.file_path)}"` } }, err => {
                 if (err && !res.headersSent) res.status(500).send('Error sending file.');
             });
         } else {
@@ -394,8 +403,27 @@ fileRouter.get('/:botToken/getFile', async (req, res) => {
         if (fileInfo.ok && fileInfo.result && fileInfo.result.file_path) {
             const spaceHost = process.env.SPACE_HOST;
             const publicSpaceUrl = spaceHost ? `https://${spaceHost}` : `http://localhost:${APP_PORT}`;
+            
+            const apiFilePath = fileInfo.result.file_path;
+            let relativePathForLink = "";
+
+            const resolvedNormalizedDataDir = path.resolve(TELEGRAM_DATA_DIR);
+            const resolvedApiFilePath = path.resolve(apiFilePath);
+
+            if (resolvedApiFilePath.startsWith(resolvedNormalizedDataDir)) {
+                relativePathForLink = path.relative(resolvedNormalizedDataDir, resolvedApiFilePath);
+            } else {
+                console.warn(`[Warning] file_path from API (${apiFilePath}) does not seem to be inside TELEGRAM_DATA_DIR (${TELEGRAM_DATA_DIR}). Using file_path as is for link, which might be incorrect.`);
+                relativePathForLink = apiFilePath; 
+            }
+            
+            if (relativePathForLink.startsWith('..')) {
+                 console.error(`[Security] Calculated relative path for link starts with '..': ${relativePathForLink}. Original API path: ${apiFilePath}`);
+                 fileInfo.result.direct_download_link_by_path = "Error: could not construct safe relative path.";
+            } else {
+                fileInfo.result.direct_download_link_by_path = `${publicSpaceUrl}/file/${relativePathForLink.split(path.sep).join('/')}`;
+            }
 
-            fileInfo.result.direct_download_link_by_path = `${publicSpaceUrl}/file/${fileInfo.result.file_path}`;
             fileInfo.result.direct_download_link_by_id = `${publicSpaceUrl}/file/${botToken}/downloadFile?file_id=${file_id}`;
             
             if (encryptionKeyBuffer) {
@@ -436,9 +464,17 @@ fileRouter.get('/:botToken/downloadFile', async (req, res) => {
             return res.status(404).json({ error: 'File not found or path not available via Telegram API.', details: fileInfo });
         }
 
-        const filePathOnDisk = path.join(TELEGRAM_DATA_DIR, fileInfo.result.file_path);
-        if (fssync.existsSync(filePathOnDisk) && fssync.statSync(filePathOnDisk).isFile()) {
-             res.sendFile(filePathOnDisk, { headers: { 'Content-Disposition': `attachment; filename="${path.basename(fileInfo.result.file_path)}"` } }, err => {
+        const filePathOnDisk = fileInfo.result.file_path;
+        const resolvedDataDir = path.resolve(TELEGRAM_DATA_DIR);
+        const resolvedFilePathOnDisk = path.resolve(filePathOnDisk);
+
+        if (!resolvedFilePathOnDisk.startsWith(resolvedDataDir)) {
+             console.error(`[Security] Attempt to access file outside TELEGRAM_DATA_DIR. Requested: ${filePathOnDisk}, Allowed base: ${resolvedDataDir}`);
+             return res.status(403).send('Forbidden: File path is outside allowed directory.');
+        }
+
+        if (fssync.existsSync(resolvedFilePathOnDisk) && fssync.statSync(resolvedFilePathOnDisk).isFile()) {
+             res.sendFile(resolvedFilePathOnDisk, { headers: { 'Content-Disposition': `attachment; filename="${path.basename(fileInfo.result.file_path)}"` } }, err => {
                 if (err && !res.headersSent) res.status(500).send('Error sending file.');
             });
         } else {
@@ -455,7 +491,9 @@ fileRouter.get('/:filepath(*)', (req, res) => {
   if (!relativePath || relativePath.includes('..')) return res.status(400).send('Invalid file path.');
   
   const absoluteRequestedPath = path.normalize(path.join(TELEGRAM_DATA_DIR, relativePath));
-  if (!absoluteRequestedPath.startsWith(path.resolve(TELEGRAM_DATA_DIR))) return res.status(403).send('Forbidden.');
+  if (!path.resolve(absoluteRequestedPath).startsWith(path.resolve(TELEGRAM_DATA_DIR))) {
+      return res.status(403).send('Forbidden: Path traversal attempt detected.');
+  }
   
   if (fssync.existsSync(absoluteRequestedPath) && fssync.statSync(absoluteRequestedPath).isFile()) {
     res.sendFile(absoluteRequestedPath, err => {