bravo68web/shx

Shx Menorepo

🚀 Project SHX

📝 Description

Shx is a platform ment to store and share files, images, text and URLs with ease. This server is built using Node.js and Express.js and stores the uploaded content on Cloudflare R2 and PostgreSQL DB. It is compatible with ShareX and other clients that support the same protocol.

🛠️ Technologies Used

• Node.js
• Express.js
• TypeScript
• Redis
• Cloudflare R2
• Hasura Graphql (with PostgreSQL)
• Commander.js
• Next.js
• Tailwind CSS
• Storybook

🚀 Features

• File upload
• Image upload
• Text upload
• URL shortener
• CLI Support
• Web Dashboard

Docs

Read here

📝 License

This project is licensed under the ISC License.

For more information, please see the LICENSE file.

📧 Contact

If you have any questions or would like to contribute to the project, please contact [email protected].

shx's Issues

Download Config Section

Fix code scanning alert - Missing rate limiting

Tracking issue for:

• https://github.com/BRAVO68WEB/shx/security/code-scanning/4

Create an api sdk to be used in the frontend

Sys Info API Rework

Instance Info Section

API Routes MetaData for Pagination

Encapsulate API Key to avoid showing entire key after generation

shx/packages/api/controllers/apikey.controller.ts

Lines 20 to 25 in 971aeb8

	// TODO: Enpacsulate API Key to avoid showing entire key after generation
	return res.status(200).json(makeResponse(apikeys));
	} catch (error) {
	next(error);
	}
	};

---

This issue was generated by todo-issue based on a TODO comment in 971aeb8.

Upload Section

• Upload Dialog

🐛 [BUG] Error Fetching All Gists

Description

I experienced two issues at:-

• GET /gist -> Get All Gists Routes
• POST /gist -> Create a new gist

Can you check it and fix it?

Reproduction URL

https://github.com/bravo68web/shx

Reproduction steps

Postman Request to /gist API

Logs

{
    "message": "OFFSET must not be negative: {\"response\":{\"errors\":[{\"message\":\"OFFSET must not be negative\",\"extensions\":{\"path\":\"$\",\"code\":\"data-exception\"}}],\"status\":200,\"headers\":{}},\"request\":{\"query\":\"\\n\\t\\t\\tquery listGists($searchString: String!, $pageNo: Int!, $pageSize: Int!) {\\n\\t\\t\\t\\tgists(\\n\\t\\t\\t\\t\\twhere: {\\n\\t\\t\\t\\t\\t\\t_or: [\\n\\t\\t\\t\\t\\t\\t\\t{ content: { _iregex: $searchString } }\\n\\t\\t\\t\\t\\t\\t\\t{ gist_url_key: { _iregex: $searchString } }\\n\\t\\t\\t\\t\\t\\t]\\n\\t\\t\\t\\t\\t}\\n\\t\\t\\t\\t\\tlimit: $pageSize\\n\\t\\t\\t\\t\\toffset: $pageNo\\n\\t\\t\\t\\t) {\\n\\t\\t\\t\\t\\tgistID\\n\\t\\t\\t\\t\\tcontent\\n\\t\\t\\t\\t\\tgist_url_key\\n\\t\\t\\t\\t\\tcreated_on\\n\\t\\t\\t\\t\\tisPrivate\\n\\t\\t\\t\\t\\tisOneTimeOnly\\n\\t\\t\\t\\t\\tviews\\n\\t\\t\\t\\t}\\n\\t\\t\\t}\\n\\t\\t\",\"variables\":{\"searchString\":\"\",\"pageNo\":-10,\"pageSize\":10}}}",
    "error": true,
    "data": null,
    "error_stack": "Error: OFFSET must not be negative: {\"response\":{\"errors\":[{\"message\":\"OFFSET must not be negative\",\"extensions\":{\"path\":\"$\",\"code\":\"data-exception\"}}],\"status\":200,\"headers\":{}},\"request\":{\"query\":\"\\n\\t\\t\\tquery listGists($searchString: String!, $pageNo: Int!, $pageSize: Int!) {\\n\\t\\t\\t\\tgists(\\n\\t\\t\\t\\t\\twhere: {\\n\\t\\t\\t\\t\\t\\t_or: [\\n\\t\\t\\t\\t\\t\\t\\t{ content: { _iregex: $searchString } }\\n\\t\\t\\t\\t\\t\\t\\t{ gist_url_key: { _iregex: $searchString } }\\n\\t\\t\\t\\t\\t\\t]\\n\\t\\t\\t\\t\\t}\\n\\t\\t\\t\\t\\tlimit: $pageSize\\n\\t\\t\\t\\t\\toffset: $pageNo\\n\\t\\t\\t\\t) {\\n\\t\\t\\t\\t\\tgistID\\n\\t\\t\\t\\t\\tcontent\\n\\t\\t\\t\\t\\tgist_url_key\\n\\t\\t\\t\\t\\tcreated_on\\n\\t\\t\\t\\t\\tisPrivate\\n\\t\\t\\t\\t\\tisOneTimeOnly\\n\\t\\t\\t\\t\\tviews\\n\\t\\t\\t\\t}\\n\\t\\t\\t}\\n\\t\\t\",\"variables\":{\"searchString\":\"\",\"pageNo\":-10,\"pageSize\":10}}}\n    at makeRequest (file:///home/chirag/Projects/shx/node_modules/graphql-request/src/index.ts:426:11)\n    at processTicksAndRejections (node:internal/process/task_queues:95:5)\n    at async GistController.listGistsS (file:///home/chirag/Projects/shx/packages/api/services/gist.service.ts:160:7)\n    at async file:///home/chirag/Projects/shx/packages/api/controllers/gists.controller.ts:129:18"
}



{
    "statusCode": 400,
    "data": {
        "_original": {
            "content": "Raw Data from nothing",
            "isOneTimeOnly": false,
            "isPrivate": false
        },
        "details": [
            {
                "message": "\"isPrivate\" is not allowed",
                "path": [
                    "isPrivate"
                ],
                "type": "object.unknown",
                "context": {
                    "child": "isPrivate",
                    "label": "isPrivate",
                    "value": false,
                    "key": "isPrivate"
                }
            }
        ]
    }
}

Browsers

Firefox, Chrome, Safari, Microsoft Edge, Opera

OS

Windows, Linux, Mac

Fix code scanning alert - Server-side request forgery

Tracking issue for:

• https://github.com/BRAVO68WEB/shx/security/code-scanning/1
• https://github.com/BRAVO68WEB/shx/security/code-scanning/2

URL Shortener

• URL Shortener Dashboard section

API Keys Section

API Creation + API Key Dashboard Section

Use Joi efficiently

shx/packages/api/libs/middleware.ts

Lines 7 to 12 in 971aeb8

	// TODO: Use Joi efficiently
	export const errorHandler = async (
	err: any,
	_req: Request,
	res: Response,

---

This issue was generated by todo-issue based on a TODO comment in 971aeb8.

🐛 [BUG] - Private notes api returning content when wrong passkey is passed or even when no passkey is passed

Description

Private notes can be fetched without a passkey

Reproduction URL

https://github.com/bravo68web/shx

Reproduction steps

Make an api request to get note by id for a private note but without passing a passkey

Screenshots

No response

Logs

No response

Browsers

Firefox, Chrome, Safari, Microsoft Edge, Opera

OS

Windows, Linux, Mac

Move All this logic to a separate service and fetch from database

shx/packages/api/services/upload.service.ts

Lines 156 to 161 in 030663e

	// TODO: Move All this logic to a separate service and fetch from database
	private downloadImage = async (url: string) => {
	let filename = nanoid() + url.split('/').pop()!;
	filename = sanitize(filename);
	const whitelistedExtensions = ['png', 'jpg', 'jpeg', 'gif', 'svg', 'ico'];

---

This issue was generated by todo-issue based on a TODO comment in 030663e. It's been assigned to @BRAVO68WEB because they committed the code.

Requested Rework + Wiki Docs

Add Interface for Known Function responses

shx/packages/api/interfaces/apikey.interface.d.ts

Lines 4 to 9 in 971aeb8

	// TODO: Add Interface for Known Function responses
	export interface IAPIKeyController {
	list(req: ModRequest, res: Response, next: NextFunction): Promise<void>;
	generate(req: ModRequest, res: Response, next: NextFunction): Promise<void>;
	revoke(req: ModRequest, res: Response, next: NextFunction): Promise<void>;

---

This issue was generated by todo-issue based on a TODO comment in 971aeb8.

🐛 [BUG] - Revoke api key endpoint not working

Description

When making a request to the api to delete an api key the server is return 500 error and is crashing

Reproduction URL

https://github.com/bravo68web/shx

Reproduction steps

Make a request to the revoke api key endpoint

Screenshots

No response

Logs

No response

Browsers

Firefox, Chrome, Safari, Microsoft Edge, Opera

OS

Windows, Linux, Mac

Settings Section

Integrade Upload API

Fix code scanning alert - Uncontrolled data used in path expression

Tracking issue for:

• https://github.com/BRAVO68WEB/shx/security/code-scanning/3

API Integration

Add file based logging using winston

shx/packages/api/index.ts

Lines 45 to 50 in 971aeb8

	// TODO: Add file based logging using winston
	app.use('/health', (req, res) => {
	return res.status(200).json({
	app: pkg.name,
	request_ip: req.ip,

---

This issue was generated by todo-issue based on a TODO comment in 971aeb8.

Use zod to validate the config

shx/packages/api/configs/index.ts

Lines 9 to 12 in 7b1b881

	// TODO: Use zod to validate the config
	export default class ConfigStoreFactory implements IConfigClass {
	public configStoreType: IConfigStore;

---

This issue was generated by todo-issue based on a TODO comment in 7b1b881. It's been assigned to @BRAVO68WEB because they committed the code.

Show API Key last used in API

Gists Section

• Gist Creation
• Gist Edit
• Gist Deletion

Filename sanitization

shx/packages/api/helpers/upload.factory.ts

Lines 14 to 19 in 971aeb8

	// TODO: Filename sanitization
	const fileName =
	file.originalname.split('.')[
	file.originalname.split('.').length - 2
	] +
	'-' +

---

This issue was generated by todo-issue based on a TODO comment in 971aeb8.