Administrator/Multi-Hoster-Upload
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 260 Wiki Activity
Desktop-Anwendung zum gleichzeitigen Hochladen auf mehrere File-Hoster
527 Commits 2 Branches 268 Tags 14 MiB
JavaScript 91.9%
CSS 3.6%
HTML 2.9%
Python 1.6%
0809c75d50
Go to file
Administrator 0809c75d50 fix(remote-server): cap WS maxPayload (256 KiB) + guard sendToClient — close a pre-auth parse freeze-sink and a send-throw crash 
Two isolated hardenings of the opt-in remote/diagnostics WS server, surfaced by
the session-wide diagnostics audit:

1. WebSocketServer was created with no maxPayload, so ws defaults to 100 MiB per
   message. The connection handler runs JSON.parse(raw) on the FIRST message
   (the auth frame) before authentication, so any peer past the IP allowlist
   could send a huge payload and force a synchronous multi-MB JSON.parse on the
   main-process event loop — an unbounded freeze/DoS sink. Diag, auth and WebRTC
   signaling messages are all small; cap maxPayload at 256 KiB to close it.

2. sendToClient did ws.send(JSON.stringify(data)) with no readyState/try guard
   (unlike broadcast, which checks ws.readyState === 1). A send on a closing
   socket, or a stringify throw, escaped the diag-response callback as an
   uncaughtException — a potential crash. Mirror broadcast: send only when
   readyState === 1, wrapped in try/catch.

Both are isolated to the transport layer with zero redaction surface. The audit's
larger finding — server_health doing O(historySize) synchronous work per request
(6-7 full-config clones + unbounded history walks) — is a real freeze, but ONLY on
the cold opt-in diagnostics path with a large history (this user: 23 rows), and the
safe fix cuts into the credential-redaction collectors (which have leaked twice);
deferred and documented in tasks/todo.md rather than operated under risk.

397/397 tests pass, eslint clean.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
2026-06-21 03:06:08 +02:00
assets feat: custom app icon (arrows-up design) 2026-03-11 23:30:46 +01:00
docs feat(diagnostics): network bind + fail-closed IP allowlist + host-in-code (Tailscale, like rd-diagnostics-mcp) 2026-06-19 19:32:29 +02:00
gateway feat(diagnostics): network bind + fail-closed IP allowlist + host-in-code (Tailscale, like rd-diagnostics-mcp) 2026-06-19 19:32:29 +02:00
lib fix(remote-server): cap WS maxPayload (256 KiB) + guard sendToClient — close a pre-auth parse freeze-sink and a send-throw crash 2026-06-21 03:06:08 +02:00
renderer perf(renderer): keep recent-uploads panel append-only past the cap (kill ~80ms per-completion freeze) 2026-06-21 01:47:59 +02:00
scripts fix: rcedit import in afterPack - icon was not being embedded in exe 2026-03-12 01:22:56 +01:00
tasks docs(todo,lessons): session-wide lag audit — clean bill of health, doodstream gate shipped, config-store findings deferred 2026-06-21 02:29:59 +02:00
tests perf(config): cache parsed config + lean serialize + drop load() from log flush (long-run lag) 2026-06-21 00:49:55 +02:00
.gitignore chore(gitignore): exclude electron-config + logs from tracking 2026-06-07 04:27:43 +02:00
app.py chore: initial commit - Electron multi-hoster uploader 2026-03-10 02:32:06 +01:00
eslint.config.mjs perf(config): cache parsed config + lean serialize + drop load() from log flush (long-run lag) 2026-06-21 00:49:55 +02:00
hosters.py chore: initial commit - Electron multi-hoster uploader 2026-03-10 02:32:06 +01:00
main.js perf(doodstream): gate per-upload _debugLog behind logVerbose (default off) — drop ~8-15 sync fs syscalls/upload off the main loop 2026-06-21 02:29:59 +02:00
package-lock.json chore(deps): npm audit fix --force — closes 12 deferred vulnerabilities 2026-04-28 11:53:53 +02:00
package.json release: v3.3.88 2026-06-21 02:30:40 +02:00
preload-drop-target.js feat: floating drop target window and English column labels 2026-03-12 04:11:01 +01:00
preload.js feat(diagnostics): read-only remote diagnostics agent over the existing WS transport (app side) 2026-06-19 17:24:32 +02:00
README.md docs: update README for Electron version 2026-03-10 02:35:43 +01:00
requirements.txt chore: initial commit - Electron multi-hoster uploader 2026-03-10 02:32:06 +01:00

README.md

Multi-Hoster-Upload

Desktop-Anwendung zum gleichzeitigen Hochladen von Dateien auf mehrere File-Hosting-Dienste.

Unterstuetzte Hoster

  • doodstream.com - API-Key basiert
  • voe.sx - API-Key basiert
  • vidmoly.me - Login basiert (Username/Passwort)
  • byse.sx - API-Key basiert

Installation

Setup (empfohlen)

Lade die Multi-Hoster-Upload Setup X.X.X.exe aus den Releases herunter und installiere.

Portable

Lade die Multi-Hoster-Upload X.X.X.exe herunter. Keine Installation noetig.

Entwicklung

npm install
npm start

Build

npm run release:win

Erzeugt Setup + Portable EXE im release/ Ordner.

Release

GITEA_TOKEN=dein_token npm run release:gitea -- 1.0.1 "Release notes"

Features

  • Drag & Drop oder Dateiauswahl
  • Gleichzeitiger Upload zu mehreren Hostern
  • Echtzeit-Fortschrittsanzeige
  • Ergebnis-Tabelle mit Sortierung und Kopier-Funktion
  • Upload-Verlauf (letzte 100 Eintraege)
  • Health-Check fuer Hoster-Verbindungen
  • Auto-Updater (prueft git.24-music.de)
  • Log-Datei kompatibel mit File & Image Uploader Format