fix: Opus review — C1 path traversal, H1 MAX_BODY, H2 dedup, M1 passport, M3+L1 versions+imports

deploy/convert_server.py

@@ -113,8 +113,6 @@ class Handler(BaseHTTPRequestHandler):
             self._handle_api_prompts_delete()
         elif self.path == "/api/sync":
             self._handle_api_sync()
-        elif self.path == "/api/drhider":
-            self._handle_drhider()
         else:
             self.send_error(404)
 
@@ -241,78 +239,6 @@ class Handler(BaseHTTPRequestHandler):
 
     # ── POST /api/drhider ────────────────────────────────────────────────
 
-    def _handle_drhider(self):
-        """Обфускация: multipart files → ZIP."""
-        from services.drhider import obfuscate_files
-        import cgi, io as io_mod
-
-        length = int(self.headers.get("Content-Length", 0))
-        raw = self.rfile.read(length)
-        ctype = self.headers.get("Content-Type", "")
-
-        # Простой multipart приём
-        import cgi, re, io as io_mod
-        _, params = cgi.parse_header(ctype)
-        boundary = params.get("boundary", "")
-        if not boundary:
-            self._json({"ok": False, "error": "No boundary"}, 400)
-            return
-        # Ручной разбор multipart (надёжнее чем cgi.FieldStorage)
-        parts = raw.split(b"--" + boundary.encode())
-        files = []
-        for part in parts:
-            if b"Content-Disposition" not in part:
-                continue
-            try:
-                hdr_end = part.index(b"\r\n\r\n")
-            except ValueError:
-                continue
-            hdrs = part[:hdr_end].decode("latin-1", errors="replace")
-            body = part[hdr_end + 4:]
-            if body.endswith(b"\r\n"):
-                body = body[:-2]
-            m = re.search(r'filename="([^"]*)"', hdrs)
-            if not m:
-                continue
-            name = os.path.basename(m.group(1))
-            if not name or ".." in name or "/" in name or "\\" in name:
-                continue
-            files.append((name, body, ""))
-
-        if not files:
-            self._json({"ok": False, "error": "Нет файлов"}, 400)
-            return
-
-        class _VMLLM:
-            def complete(self, prompt):
-                import httpx
-                key = os.environ.get("LLM_KEY") or os.environ.get("LLM_API_KEY", "")
-                r = httpx.post(
-                    os.environ.get("LLM_URL", "https://api.aillm.ru/v1/chat/completions"),
-                    json={"model": os.environ.get("LLM_MODEL", "gpt-oss-120b"),
-                          "messages": [{"role": "user", "content": prompt}],
-                          "max_tokens": 8000, "temperature": 0.1},
-                    headers={"Authorization": f"Bearer {key}",
-                             "Content-Type": "application/json"},
-                    timeout=120
-                )
-                r.raise_for_status()
-                return r.json()["choices"][0]["message"]["content"]
-
-        try:
-            zip_data, _csv = obfuscate_files(files, llm_client=_VMLLM())
-            self.send_response(200)
-            self.send_header("Content-Type", "application/zip")
-            self.send_header("Content-Disposition", 'attachment; filename="drhider_output.zip"')
-            self.send_header("Content-Length", str(len(zip_data)))
-            self.send_header("Access-Control-Allow-Origin", "*")
-            self.end_headers()
-            self.wfile.write(zip_data)
-        except Exception as e:
-            import traceback
-            traceback.print_exc()
-            self._json({"ok": False, "error": str(e)}, 500)
-
     # ── /api/groups ?batch=X ─────────────────────────────────────────────
 
     def _handle_api_groups(self, parsed):
@@ -497,8 +423,19 @@ class Handler(BaseHTTPRequestHandler):
 
     def _handle_app_js(self):
         try:
-            fname = urlparse(self.path).path.lstrip("/").replace("static/", "")
-            with open(os.path.join(os.path.dirname(__file__), fname), "rb") as f:
+            base = os.path.realpath(os.path.dirname(__file__))
+            rel = urlparse(self.path).path.lstrip("/")
+            if rel.startswith("static/"):
+                rel = rel[len("static/"):]
+            # only .js and .svg
+            if not (rel.endswith(".js") or rel.endswith(".svg")):
+                self.send_error(404)
+                return
+            target = os.path.realpath(os.path.join(base, rel))
+            if not target.startswith(base + os.sep):
+                self.send_error(403)
+                return
+            with open(target, "rb") as f:
                 js = f.read()
             self.send_response(200)
             self.send_header("Content-Type", "application/javascript; charset=utf-8")