Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
📝 Walkthroughウォークスルー
変更内容Base64デコード対応
推定コードレビュー工数🎯 2 (Simple) | ⏱️ ~5 minutes 🚥 Pre-merge checks | ✅ 3 | ❌ 2❌ Failed checks (1 warning, 1 inconclusive)
✅ Passed checks (3 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@pages/api/unzip/filenow_up.ts`:
- Line 15: The CORS setup in the unzip upload API is too permissive because it
allows any origin with Content-Type access; update the header handling in the
upload proxy route so only the intended frontend Origin(s) are accepted via an
allowlist, and reject or omit CORS headers for all others. Adjust the existing
res.setHeader calls in the API handler to use a restricted origin check rather
than a wildcard, while keeping the necessary header allowance limited to the
expected client.
- Around line 20-23: In the API route handling `req.body` and `FilePayload`,
replace `Uint8Array.fromBase64` with a Node-compatible
`Buffer.from(body.fileContent, 'base64')` flow, and add a guard that returns 400
when `req.body` or `body.fileContent` is missing. Also validate the Base64 input
before decoding, since `Buffer.from` accepts invalid characters; reject
malformed payloads explicitly before creating the `Blob`.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro Plus
Run ID: b5b04486-a2ed-4bea-a5d8-c3f99aaf86e0
📒 Files selected for processing (1)
pages/api/unzip/filenow_up.ts
| ) { | ||
| res.setHeader('Access-Control-Allow-Origin', '*'); | ||
| res.setHeader('Access-Control-Allow-Methods', 'POST,OPTIONS'); | ||
| res.setHeader('Access-Control-Allow-Headers', 'Content-Type'); |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
CORS の許可範囲を限定してください。
Access-Control-Allow-Origin: * と Access-Control-Allow-Headers: Content-Type の組み合わせにより、任意サイトからブラウザ経由でこのアップロードプロキシへ JSON POST できます。想定フロントエンドだけを許可する Origin allowlist にしてください。
修正例
- res.setHeader('Access-Control-Allow-Origin', '*');
+ const allowedOrigins = new Set([
+ process.env.NEXT_PUBLIC_APP_ORIGIN,
+ ]);
+ const origin = req.headers.origin;
+ if (origin && allowedOrigins.has(origin)) {
+ res.setHeader('Access-Control-Allow-Origin', origin);
+ }
+ res.setHeader('Vary', 'Origin');🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@pages/api/unzip/filenow_up.ts` at line 15, The CORS setup in the unzip upload
API is too permissive because it allows any origin with Content-Type access;
update the header handling in the upload proxy route so only the intended
frontend Origin(s) are accepted via an allowlist, and reject or omit CORS
headers for all others. Adjust the existing res.setHeader calls in the API
handler to use a restricted origin check rather than a wildcard, while keeping
the necessary header allowance limited to the expected client.
| const body = req.body as FilePayload; | ||
| const decodedb64 = Uint8Array.fromBase64(body.fileContent); | ||
|
|
||
| const csvBlob = new Blob([body.fileContent], { type: 'application/octet-stream' }); | ||
| const csvBlob = new Blob([decodedb64], { type: 'application/octet-stream' }); |
There was a problem hiding this comment.
🩺 Stability & Availability | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Node/Next の宣言ランタイムと fromBase64 利用箇所を確認する
fd -i '^(package.json|\.node-version|\.nvmrc|Dockerfile|next\.config\.(js|mjs|ts)|tsconfig\.json)$' \
--exec sh -c 'echo "--- $1"; sed -n "1,180p" "$1"' sh {}
rg -n --glob '*.ts' --glob '*.tsx' '\bUint8Array\.fromBase64\b'Repository: sakitibi/AsakuraWiki
Length of output: 3199
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo '--- pages/api/unzip/filenow_up.ts'
sed -n '1,220p' pages/api/unzip/filenow_up.ts
echo '--- runtime declarations / api route markers'
rg -n --glob 'pages/api/**/*.ts' --glob 'app/**/route.ts' 'runtime\s*=|export const runtime|fromBase64|Buffer\.from|atob\(|btoa\('
echo '--- node compatibility hints'
fd -i '^(package-lock\.json|pnpm-lock\.yaml|yarn\.lock|bun\.lockb|README\.md|docs?)$' --exec sh -c 'echo "--- $1"; sed -n "1,120p" "$1"' sh {}Repository: sakitibi/AsakuraWiki
Length of output: 2019
🌐 Web query:
Node.js Uint8Array.fromBase64 availability version documentation
💡 Result:
The Uint8Array.fromBase64 method is available in Node.js starting from version 25.0.0 [1][2][3]. While some earlier reports or community discussions may have incorrectly cited Node.js 22 as the introduction point for this feature, it was formally stabilized and made available beginning with Node.js 25 [1][4][2]. Because this method is implemented at the V8 engine level [1], its availability is tied to the V8 version included with the specific Node.js release [1]. Documentation for this feature can be found in the MDN Web Docs [2][3], as it is part of the standard JavaScript language specification for TypedArrays (TC39 proposal) [1][5]. In environments older than Node.js 25, attempting to call Uint8Array.fromBase64 will result in a TypeError, as the method will be undefined [4][6]. For backward compatibility in projects targeting older Node.js versions, developers commonly continue to use the established Buffer.from(string, 'base64') pattern [4][7].
Citations:
- 1: add Uint8Array to/from base64 and hex nodejs/node#59285
- 2: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Uint8Array/fromBase64
- 3: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Uint8Array
- 4: de-otio/crypto-envelope@c3b92d8
- 5: https://tc39.es/proposal-arraybuffer-base64/
- 6: https://runebook.dev/en/docs/javascript/global_objects/uint8array/frombase64
- 7: buffer: add
Buffer.fromHex()andBuffer.fromBase64()nodejs/node#61157
🌐 Web query:
Node.js Buffer.from base64 invalid input behavior documentation
💡 Result:
In Node.js, the Buffer.from(string, 'base64') method does not throw an error when encountering invalid Base64 input [1][2]. Instead, it follows a "forgiving" approach where it silently ignores or skips characters that are not part of the valid Base64 alphabet [1][2]. Key behaviors regarding Base64 input include: 1. Silent Handling of Invalid Characters: Any characters in the input string that do not conform to the Base64 alphabet (A-Z, a-z, 0-9, +, /) are ignored during the decoding process rather than causing the operation to fail [1][2]. 2. Whitespace Handling: The base64 encoding implementation explicitly ignores standard whitespace characters, including spaces, tabs, and new lines, contained within the encoded string [3][4]. 3. Assumed Validity: Official Node.js documentation notes that Buffer.from assumes valid input for base64, base64url, and hex encodings [5][4]. Because it does not perform strict validation, developers requiring strict adherence to protocol standards must manually validate strings (e.g., using regular expressions or third-party validation libraries) before passing them to Buffer.from [1][2]. Because of this behavior, developers cannot rely on Buffer.from to detect malformed Base64 data [2]. If input integrity is required, pre-validation is necessary [2].
Citations:
- 1: Buffer.from(str, encoding) silently ignores decoding errors nodejs/node#8569
- 2: https://stackoverflow.com/questions/60628066/nodejs-buffer-from-returns-invalid-value
- 3: https://nodejs.org/docs/latest/api/buffer.html
- 4: https://github.com/nodejs/node/blob/main/doc/api/buffer.md
- 5: https://nodejs.org/api/buffer.html
🏁 Script executed:
#!/bin/bash
set -euo pipefail
node - <<'JS'
console.log('node', process.version);
console.log('Uint8Array.fromBase64 type:', typeof Uint8Array.fromBase64);
const samples = [
'Zm9v',
'!!!',
'Zg==',
'Zg=',
'not-base64',
];
for (const s of samples) {
try {
const buf = Buffer.from(s, 'base64');
console.log(JSON.stringify({ kind: 'Buffer.from', input: s, length: buf.length, hex: buf.toString('hex') }));
} catch (e) {
console.log(JSON.stringify({ kind: 'Buffer.from', input: s, error: e && e.name, message: e && e.message }));
}
try {
if (typeof Uint8Array.fromBase64 === 'function') {
const arr = Uint8Array.fromBase64(s);
console.log(JSON.stringify({ kind: 'Uint8Array.fromBase64', input: s, length: arr.length, hex: Buffer.from(arr).toString('hex') }));
} else {
console.log(JSON.stringify({ kind: 'Uint8Array.fromBase64', input: s, unavailable: true }));
}
} catch (e) {
console.log(JSON.stringify({ kind: 'Uint8Array.fromBase64', input: s, error: e && e.name, message: e && e.message }));
}
}
JSRepository: sakitibi/AsakuraWiki
Length of output: 867
Uint8Array.fromBase64 は使わないでください。
Node 24 では未対応で、この API ルートは実行時に失敗します。req.body の存在確認を入れたうえで Buffer.from(body.fileContent, 'base64') に置き換え、不正 Base64 は事前検証して 400 を返してください。Buffer.from は不正文字をそのまま受けるため、置き換えだけでは拒否できません。
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@pages/api/unzip/filenow_up.ts` around lines 20 - 23, In the API route
handling `req.body` and `FilePayload`, replace `Uint8Array.fromBase64` with a
Node-compatible `Buffer.from(body.fileContent, 'base64')` flow, and add a guard
that returns 400 when `req.body` or `body.fileContent` is missing. Also validate
the Base64 input before decoding, since `Buffer.from` accepts invalid
characters; reject malformed payloads explicitly before creating the `Blob`.
1 participant
Summary by CodeRabbit