Comprehensive bugfix release v1.6.45

Fix ~70 issues across the entire codebase including security fixes, error handling improvements, test stabilization, and code quality. - Fix TLS race condition with reference-counted acquire/release - Bind debug server to 127.0.0.1 instead of 0.0.0.0 - Add overall timeout to MegaWebFallback - Stream update installer to disk instead of RAM buffering - Add path traversal protection in JVM extractor - Cache DdownloadClient with credential-based invalidation - Add .catch() to all fire-and-forget IPC calls - Wrap app startup, clipboard, session-log in try/catch - Add timeouts to container.ts fetch calls - Fix variable shadowing, tsconfig path, line endings - Stabilize tests with proper cleanup and timing tolerance - Fix installer privileges, scripts, and afterPack null checks - Delete obsolete _upload_release.mjs Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-03-05 03:53:28 +01:00
parent a3c2680fec
commit a1c8f42435
29 changed files with 381 additions and 272 deletions
@@ -285,7 +285,7 @@ export class AppController {

  public exportBackup(): string {
    const settings = { ...this.settings };
-    const SENSITIVE_KEYS: (keyof AppSettings)[] = ["token", "megaPassword", "bestToken", "allDebridToken", "ddownloadPassword"];
+    const SENSITIVE_KEYS: (keyof AppSettings)[] = ["token", "megaLogin", "megaPassword", "bestToken", "allDebridToken", "ddownloadLogin", "ddownloadPassword"];
    for (const key of SENSITIVE_KEYS) {
      const val = settings[key];
      if (typeof val === "string" && val.length > 0) {
@@ -307,7 +307,7 @@ export class AppController {
      return { restored: false, message: "Kein gültiges Backup (settings/session fehlen)" };
    }
    const importedSettings = parsed.settings as AppSettings;
-    const SENSITIVE_KEYS: (keyof AppSettings)[] = ["token", "megaPassword", "bestToken", "allDebridToken", "ddownloadPassword"];
+    const SENSITIVE_KEYS: (keyof AppSettings)[] = ["token", "megaLogin", "megaPassword", "bestToken", "allDebridToken", "ddownloadLogin", "ddownloadPassword"];
    for (const key of SENSITIVE_KEYS) {
      const val = (importedSettings as Record<string, unknown>)[key];
      if (typeof val === "string" && val.startsWith("***")) {
@@ -164,7 +164,7 @@ async function decryptDlcLocal(filePath: string): Promise<ParsedPackageInput[]>
  const dlcData = content.slice(0, -88);

  const rcUrl = DLC_SERVICE_URL.replace("{KEY}", encodeURIComponent(dlcKey));
-  const rcResponse = await fetch(rcUrl, { method: "GET" });
+  const rcResponse = await fetch(rcUrl, { method: "GET", signal: AbortSignal.timeout(30000) });
  if (!rcResponse.ok) {
    return [];
  }
@@ -217,7 +217,8 @@ async function tryDcryptUpload(fileContent: Buffer, fileName: string): Promise<s

  const response = await fetch(DCRYPT_UPLOAD_URL, {
    method: "POST",
-    body: form
+    body: form,
+    signal: AbortSignal.timeout(30000)
  });
  if (response.status === 413) {
    return null;
@@ -235,7 +236,8 @@ async function tryDcryptPaste(fileContent: Buffer): Promise<string[] | null> {

  const response = await fetch(DCRYPT_PASTE_URL, {
    method: "POST",
-    body: form
+    body: form,
+    signal: AbortSignal.timeout(30000)
  });
  if (response.status === 413) {
    return null;
@@ -1154,6 +1154,9 @@ export class DebridService {

  private options: DebridServiceOptions;

+  private cachedDdownloadClient: DdownloadClient | null = null;
+  private cachedDdownloadKey = "";
+
  public constructor(settings: AppSettings, options: DebridServiceOptions = {}) {
    this.settings = cloneSettings(settings);
    this.options = options;
@@ -1163,6 +1166,16 @@ export class DebridService {
    this.settings = cloneSettings(next);
  }

+  private getDdownloadClient(login: string, password: string): DdownloadClient {
+    const key = `${login}\0${password}`;
+    if (this.cachedDdownloadClient && this.cachedDdownloadKey === key) {
+      return this.cachedDdownloadClient;
+    }
+    this.cachedDdownloadClient = new DdownloadClient(login, password);
+    this.cachedDdownloadKey = key;
+    return this.cachedDdownloadClient;
+  }
+
  public async resolveFilenames(
    links: string[],
    onResolved?: (link: string, fileName: string) => void,
@@ -1338,7 +1351,7 @@ export class DebridService {
      return new AllDebridClient(settings.allDebridToken).unrestrictLink(link, signal);
    }
    if (provider === "ddownload") {
-      return new DdownloadClient(settings.ddownloadLogin, settings.ddownloadPassword).unrestrictLink(link, signal);
+      return this.getDdownloadClient(settings.ddownloadLogin, settings.ddownloadPassword).unrestrictLink(link, signal);
    }
    return new BestDebridClient(settings.bestToken).unrestrictLink(link, signal);
  }
@@ -261,7 +261,7 @@ export function startDebugServer(mgr: DownloadManager, baseDir: string): void {
  const port = getPort(baseDir);

  server = http.createServer(handleRequest);
-  server.listen(port, "0.0.0.0", () => {
+  server.listen(port, "127.0.0.1", () => {
    logger.info(`Debug-Server gestartet auf Port ${port}`);
  });
  server.on("error", (err) => {
@@ -20,6 +20,23 @@ import {
  UiSnapshot
 } from "../shared/types";
 import { REQUEST_RETRIES, SAMPLE_VIDEO_EXTENSIONS, SPEED_WINDOW_SECONDS, WRITE_BUFFER_SIZE, WRITE_FLUSH_TIMEOUT_MS, ALLOCATION_UNIT_SIZE, STREAM_HIGH_WATER_MARK, DISK_BUSY_THRESHOLD_MS } from "./constants";
+
+// Reference counter for NODE_TLS_REJECT_UNAUTHORIZED to avoid race conditions
+// when multiple parallel downloads need TLS verification disabled (e.g. DDownload).
+let tlsSkipRefCount = 0;
+function acquireTlsSkip(): void {
+  tlsSkipRefCount += 1;
+  if (tlsSkipRefCount === 1) {
+    process.env.NODE_TLS_REJECT_UNAUTHORIZED = "0";
+  }
+}
+function releaseTlsSkip(): void {
+  tlsSkipRefCount -= 1;
+  if (tlsSkipRefCount <= 0) {
+    tlsSkipRefCount = 0;
+    delete process.env.NODE_TLS_REJECT_UNAUTHORIZED;
+  }
+}
 import { cleanupCancelledPackageArtifactsAsync } from "./cleanup";
 import { DebridService, MegaWebUnrestrictor, checkRapidgatorOnline } from "./debrid";
 import { clearExtractResumeState, collectArchiveCleanupTargets, extractPackageArchives, findArchiveCandidates } from "./extractor";
@@ -3212,11 +3229,11 @@ export class DownloadManager extends EventEmitter {

    for (const item of Object.values(this.session.items)) {
      if (item.status !== "completed") continue;
-      const fs = item.fullStatus || "";
+      const fullSt = item.fullStatus || "";
      // Only relabel items with active extraction status (e.g. "Entpacken 45%", "Passwort prüfen")
      // Skip items that were merely waiting ("Entpacken - Ausstehend", "Entpacken - Warten auf Parts")
      // as they were never actively extracting and "abgebrochen" would be misleading.
-      if (/^Entpacken\b/i.test(fs) && !/Ausstehend/i.test(fs) && !/Warten/i.test(fs) && !isExtractedLabel(fs)) {
+      if (/^Entpacken\b/i.test(fullSt) && !/Ausstehend/i.test(fullSt) && !/Warten/i.test(fullSt) && !isExtractedLabel(fullSt)) {
        item.fullStatus = "Entpacken abgebrochen (wird fortgesetzt)";
        item.updatedAt = nowMs();
        const pkg = this.session.packages[item.packageId];
@@ -3305,7 +3322,7 @@ export class DownloadManager extends EventEmitter {
    this.session.reconnectReason = "";

    for (const item of Object.values(this.session.items)) {
-      if (item.provider !== "realdebrid" && item.provider !== "megadebrid" && item.provider !== "bestdebrid" && item.provider !== "alldebrid") {
+      if (item.provider !== "realdebrid" && item.provider !== "megadebrid" && item.provider !== "bestdebrid" && item.provider !== "alldebrid" && item.provider !== "ddownload") {
        item.provider = null;
      }
      if (item.status === "cancelled" && item.fullStatus === "Gestoppt") {
@@ -5152,16 +5169,13 @@ export class DownloadManager extends EventEmitter {
      const connectTimeoutMs = getDownloadConnectTimeoutMs();
      let connectTimer: NodeJS.Timeout | null = null;
      const connectAbortController = new AbortController();
-      const prevTlsReject = process.env.NODE_TLS_REJECT_UNAUTHORIZED;
+      if (skipTlsVerify) acquireTlsSkip();
      try {
        if (connectTimeoutMs > 0) {
          connectTimer = setTimeout(() => {
            connectAbortController.abort("connect_timeout");
          }, connectTimeoutMs);
        }
-        if (skipTlsVerify) {
-          process.env.NODE_TLS_REJECT_UNAUTHORIZED = "0";
-        }
        response = await fetch(directUrl, {
          method: "GET",
          headers,
@@ -5181,10 +5195,7 @@ export class DownloadManager extends EventEmitter {
        }
        throw error;
      } finally {
-        if (skipTlsVerify) {
-          if (prevTlsReject === undefined) delete process.env.NODE_TLS_REJECT_UNAUTHORIZED;
-          else process.env.NODE_TLS_REJECT_UNAUTHORIZED = prevTlsReject;
-        }
+        if (skipTlsVerify) releaseTlsSkip();
        if (connectTimer) {
          clearTimeout(connectTimer);
        }
@@ -62,6 +62,26 @@ function removeSubstMapping(mapping: SubstMapping): void {
  logger.info(`subst ${mapping.drive}: entfernt`);
 }

+export function cleanupStaleSubstDrives(): void {
+  if (process.platform !== "win32") return;
+  try {
+    const result = spawnSync("subst", [], { stdio: "pipe", timeout: 5000 });
+    const output = String(result.stdout || "");
+    for (const line of output.split("\n")) {
+      const match = line.match(/^([A-Z]):\\: => (.+)/i);
+      if (!match) continue;
+      const drive = match[1].toUpperCase();
+      const target = match[2].trim();
+      if (/\\rd-extract-|\\Real-Debrid-Downloader/i.test(target)) {
+        spawnSync("subst", [`${drive}:`, "/d"], { stdio: "pipe", timeout: 5000 });
+        logger.info(`Stale subst ${drive}: entfernt (${target})`);
+      }
+    }
+  } catch {
+    // ignore — subst cleanup is best-effort
+  }
+}
+
 let resolvedExtractorCommand: string | null = null;
 let resolveFailureReason = "";
 let resolveFailureAt = 0;
@@ -7,6 +7,7 @@ import { IPC_CHANNELS } from "../shared/ipc";
 import { getLogFilePath, logger } from "./logger";
 import { APP_NAME } from "./constants";
 import { extractHttpLinksFromText } from "./utils";
+import { cleanupStaleSubstDrives } from "./extractor";

 /* ── IPC validation helpers ────────────────────────────────────── */
 function validateString(value: unknown, name: string): string {
@@ -81,7 +82,7 @@ function createWindow(): BrowserWindow {
        responseHeaders: {
          ...details.responseHeaders,
          "Content-Security-Policy": [
-            "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; connect-src 'self' https://api.real-debrid.com https://codeberg.org https://bestdebrid.com https://api.alldebrid.com https://www.mega-debrid.eu"
+            "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; connect-src 'self' https://api.real-debrid.com https://codeberg.org https://bestdebrid.com https://api.alldebrid.com https://www.mega-debrid.eu https://git.24-music.de https://ddownload.com https://ddl.to"
          ]
        }
      });
@@ -188,7 +189,12 @@ function startClipboardWatcher(): void {
  }
  lastClipboardText = normalizeClipboardText(clipboard.readText());
  clipboardTimer = setInterval(() => {
-    const text = normalizeClipboardText(clipboard.readText());
+    let text: string;
+    try {
+      text = normalizeClipboardText(clipboard.readText());
+    } catch {
+      return;
+    }
    if (text === lastClipboardText || !text.trim()) {
      return;
    }
@@ -481,6 +487,7 @@ app.on("second-instance", () => {
 });

 app.whenReady().then(() => {
+  cleanupStaleSubstDrives();
  registerIpcHandlers();
  mainWindow = createWindow();
  bindMainWindowLifecycle(mainWindow);
@@ -493,6 +500,9 @@ app.whenReady().then(() => {
      bindMainWindowLifecycle(mainWindow);
    }
  });
+}).catch((error) => {
+  console.error("App startup failed:", error);
+  app.quit();
 });

 app.on("window-all-closed", () => {
@@ -228,22 +228,23 @@ export class MegaWebFallback {
  }

  public async unrestrict(link: string, signal?: AbortSignal): Promise<UnrestrictedLink | null> {
+    const overallSignal = withTimeoutSignal(signal, 180000);
    return this.runExclusive(async () => {
-      throwIfAborted(signal);
+      throwIfAborted(overallSignal);
      const creds = this.getCredentials();
      if (!creds.login.trim() || !creds.password.trim()) {
        return null;
      }

      if (!this.cookie || Date.now() - this.cookieSetAt > 20 * 60 * 1000) {
-        await this.login(creds.login, creds.password, signal);
+        await this.login(creds.login, creds.password, overallSignal);
      }

-      const generated = await this.generate(link, signal);
+      const generated = await this.generate(link, overallSignal);
      if (!generated) {
        this.cookie = "";
-        await this.login(creds.login, creds.password, signal);
-        const retry = await this.generate(link, signal);
+        await this.login(creds.login, creds.password, overallSignal);
+        const retry = await this.generate(link, overallSignal);
        if (!retry) {
          return null;
        }
@@ -261,7 +262,7 @@ export class MegaWebFallback {
        fileSize: null,
        retriesUsed: 0
      };
-    }, signal);
+    }, overallSignal);
  }

  public invalidateSession(): void {
@@ -76,7 +76,12 @@ async function cleanupOldSessionLogs(dir: string, maxAgeDays: number): Promise<v

 export function initSessionLog(baseDir: string): void {
  sessionLogsDir = path.join(baseDir, "session-logs");
-  fs.mkdirSync(sessionLogsDir, { recursive: true });
+  try {
+    fs.mkdirSync(sessionLogsDir, { recursive: true });
+  } catch {
+    sessionLogsDir = null;
+    return;
+  }

  const timestamp = formatTimestamp();
  sessionLogPath = path.join(sessionLogsDir, `session_${timestamp}.txt`);
@@ -113,7 +113,7 @@ export function normalizeSettings(settings: AppSettings): AppSettings {
    allDebridToken: asText(settings.allDebridToken),
    ddownloadLogin: asText(settings.ddownloadLogin),
    ddownloadPassword: asText(settings.ddownloadPassword),
-    archivePasswordList: String(settings.archivePasswordList ?? "").replace(/\r\n/g, "\n"),
+    archivePasswordList: String(settings.archivePasswordList ?? "").replace(/\r\n|\r/g, "\n"),
    rememberToken: Boolean(settings.rememberToken),
    providerPrimary: settings.providerPrimary,
    providerSecondary: settings.providerSecondary,
@@ -794,7 +794,8 @@ async function downloadFile(url: string, targetPath: string, onProgress?: Update
  };

  const reader = response.body.getReader();
-  const chunks: Buffer[] = [];
+  const tempPath = targetPath + ".tmp";
+  const writeStream = fs.createWriteStream(tempPath);

  try {
    resetIdleTimer();
@@ -808,27 +809,39 @@ async function downloadFile(url: string, targetPath: string, onProgress?: Update
        break;
      }
      const buf = Buffer.from(value.buffer, value.byteOffset, value.byteLength);
-      chunks.push(buf);
+      if (!writeStream.write(buf)) {
+        await new Promise<void>((resolve) => writeStream.once("drain", resolve));
+      }
      downloadedBytes += buf.byteLength;
      resetIdleTimer();
      emitDownloadProgress(false);
    }
+  } catch (error) {
+    writeStream.destroy();
+    await fs.promises.rm(tempPath, { force: true }).catch(() => {});
+    throw error;
  } finally {
    clearIdleTimer();
  }

+  await new Promise<void>((resolve, reject) => {
+    writeStream.end(() => resolve());
+    writeStream.on("error", reject);
+  });
+
  if (idleTimedOut) {
+    await fs.promises.rm(tempPath, { force: true }).catch(() => {});
    throw new Error(`Update Download Body Timeout nach ${Math.ceil(idleTimeoutMs / 1000)}s`);
  }

-  const fileBuffer = Buffer.concat(chunks);
-  if (totalBytes && fileBuffer.byteLength !== totalBytes) {
-    throw new Error(`Update Download unvollständig (${fileBuffer.byteLength} / ${totalBytes} Bytes)`);
+  if (totalBytes && downloadedBytes !== totalBytes) {
+    await fs.promises.rm(tempPath, { force: true }).catch(() => {});
+    throw new Error(`Update Download unvollständig (${downloadedBytes} / ${totalBytes} Bytes)`);
  }

-  await fs.promises.writeFile(targetPath, fileBuffer);
+  await fs.promises.rename(tempPath, targetPath);
  emitDownloadProgress(true);
-  logger.info(`Update-Download abgeschlossen: ${targetPath} (${fileBuffer.byteLength} Bytes)`);
+  logger.info(`Update-Download abgeschlossen: ${targetPath} (${downloadedBytes} Bytes)`);

  return { expectedBytes: totalBytes };
 }