perf: mediainfo router should use async/await to get file info

package.json

@@ -101,7 +101,7 @@
     "@types/jsonwebtoken": "^9.0.2",
     "@types/lodash": "^4.14.195",
     "@types/morgan": "^1.9.4",
-    "@types/node": "^12.20.55",
+    "@types/node": "^18.17.1",
     "@types/parse-torrent": "^5.8.4",
     "@types/passport": "^1.0.12",
     "@types/passport-jwt": "^3.0.8",

server/routes/api/torrents.ts

@@ -7,6 +7,7 @@ import path from 'path';
 import rateLimit from 'express-rate-limit';
 import sanitize from 'sanitize-filename';
 import tar, {Pack} from 'tar-fs';
+import * as fsp from 'node:fs/promises';
 
 import type {
   AddTorrentByFileOptions,
@@ -35,9 +36,17 @@ import {
   reannounceTorrentsSchema,
   setTorrentsTagsSchema,
 } from '../../../shared/schema/api/torrents';
-import {accessDeniedError, fileNotFoundError, isAllowedPath, sanitizePath} from '../../util/fileUtil';
+import {
+  accessDeniedError,
+  existAsync,
+  fileNotFoundError,
+  isAllowedPath,
+  isAllowedPathAsync,
+  sanitizePath,
+} from '../../util/fileUtil';
 import {getTempPath} from '../../models/TemporaryStorage';
 import {getToken} from '../../util/authUtil';
+import {asyncFilter} from '../../util/async';
 
 const getDestination = async (
   services: Express.Request['services'],
@@ -891,13 +900,13 @@ router.get<{hash: string}>(
         sanitizePath(path.join(torrentDirectory, content.path)),
       );
 
-      torrentContentPaths = torrentContentPaths.filter((contentPath) => isAllowedPath(contentPath));
+      torrentContentPaths = await asyncFilter(torrentContentPaths, (contentPath) => isAllowedPathAsync(contentPath));
       if (torrentContentPaths.length < 1) {
         const {code, message} = accessDeniedError();
         return res.status(403).json({code, message});
       }
 
-      torrentContentPaths = torrentContentPaths.filter((contentPath) => fs.existsSync(contentPath));
+      torrentContentPaths = await asyncFilter(torrentContentPaths, (contentPath) => existAsync(contentPath));
       if (torrentContentPaths.length < 1) {
         const {code, message} = fileNotFoundError();
         return res.status(404).json({code, message});

server/util/async.ts

@@ -0,0 +1,8 @@
+export async function asyncFilter<T>(
+  arr: Array<T>,
+  predicate: (item: T, index: number) => Promise<boolean>,
+): Promise<Array<T>> {
+  const results = await Promise.all(arr.map(predicate));
+
+  return arr.filter((_v, index) => results[index]);
+}

server/util/fileUtil.ts

@@ -1,6 +1,7 @@
 import fs from 'fs';
 import {homedir} from 'os';
 import path from 'path';
+import * as fsp from 'node:fs/promises';
 
 import config from '../../config';
 
@@ -43,6 +44,46 @@ export const isAllowedPath = (resolvedPath: string) => {
   });
 };
 
+export async function isAllowedPathAsync(resolvedPath: string) {
+  if (config.allowedPaths == null) {
+    return true;
+  }
+
+  let realPath: string | null = null;
+  let parentPath: string = resolvedPath;
+  while (realPath == null) {
+    try {
+      realPath = await fsp.realpath(parentPath);
+    } catch (e) {
+      if ((e as NodeJS.ErrnoException).code === 'ENOENT') {
+        parentPath = path.resolve(parentPath, '..');
+      } else {
+        return false;
+      }
+    }
+  }
+
+  return config.allowedPaths.some((allowedPath) => {
+    if (realPath?.startsWith(allowedPath)) {
+      return true;
+    }
+    return false;
+  });
+}
+
+export async function existAsync(path: string): Promise<boolean> {
+  try {
+    await fsp.stat(path);
+  } catch (err: unknown) {
+    if ((err as {code?: string}).code === 'ENOENT') {
+      return false;
+    }
+    throw err;
+  }
+
+  return true;
+}
+
 export const sanitizePath = (input?: string): string => {
   if (typeof input !== 'string') {
     throw accessDeniedError();