From d09348b6b9848d7423d6c31649c211db651d7b87 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=E2=80=9CNaeel=E2=80=9D?= <tazet@narod.ru>
Date: Mon, 4 May 2026 10:57:32 +0400
Subject: [PATCH] v1.3.55: validate zip magic bytes on upload (UI + backend)

---
 console/deploy/console.yaml      | 2 +-
 console/internal/api/handlers.go | 6 ++++++
 console/ui/index.html            | 4 ++--
 console/ui/js/fn-archive.js      | 1 +
 4 files changed, 10 insertions(+), 3 deletions(-)

diff --git a/console/deploy/console.yaml b/console/deploy/console.yaml
index b60330e..8fb20f4 100644
--- a/console/deploy/console.yaml
+++ b/console/deploy/console.yaml
@@ -52,7 +52,7 @@ spec:
       serviceAccountName: fission-console
       containers:
         - name: console
-          image: naeel/fission-console:v1.3.54
+          image: naeel/fission-console:v1.3.55
           imagePullPolicy: Always
           ports:
             - containerPort: 8090
diff --git a/console/internal/api/handlers.go b/console/internal/api/handlers.go
index 8138234..98ea042 100644
--- a/console/internal/api/handlers.go
+++ b/console/internal/api/handlers.go
@@ -1333,6 +1333,12 @@ func (s *Server) handleCreateFunctionFromArchive(w http.ResponseWriter, r *http.
 		archiveFilenameCreate = fhCreate.Filename
 	}
 
+	// Проверяем magic bytes: zip должен начинаться с PK (0x50 0x4B)
+	if len(archiveBytes) < 4 || archiveBytes[0] != 0x50 || archiveBytes[1] != 0x4B {
+		writeJSONError(w, http.StatusBadRequest, "загруженный файл не является zip-архивом (ожидается .zip)")
+		return
+	}
+
 	nsCtx, nsCancel := context.WithTimeout(r.Context(), 60*time.Second)
 	defer nsCancel()
 	if err := s.nsManager.EnsureUserNS(nsCtx, ns); err != nil {
diff --git a/console/ui/index.html b/console/ui/index.html
index 4adb451..32a3452 100644
--- a/console/ui/index.html
+++ b/console/ui/index.html
@@ -102,7 +102,7 @@
       <div class="nubes">NUBES</div>
       <div class="product">FISSION CONSOLE</div>
     </div>
-    <div style="font-size:0.65rem; color:var(--text-secondary); margin-left:10px; align-self:center; opacity:0.7;">v1.3.54</div>
+    <div style="font-size:0.65rem; color:var(--text-secondary); margin-left:10px; align-self:center; opacity:0.7;">v1.3.55</div>
   </div>
   <div class="row" style="margin:0;">
     <button class="btn ghost" onclick="reloadAll()">Refresh</button>
@@ -462,7 +462,7 @@
       </div>
 
       <div class="actions" style="justify-content:space-between; align-items:center;">
-        <span style="font-size:0.75rem; color:var(--text-secondary);">v1.3.54</span>
+        <span style="font-size:0.75rem; color:var(--text-secondary);">v1.3.55</span>
         <button class="btn ghost" onclick="closeHelp()">Закрыть</button>
       </div>
     </div>
diff --git a/console/ui/js/fn-archive.js b/console/ui/js/fn-archive.js
index f671810..07118a8 100644
--- a/console/ui/js/fn-archive.js
+++ b/console/ui/js/fn-archive.js
@@ -42,6 +42,7 @@ async function submitCreateArchive() {
     if (!lang) throw new Error('language is required');
     const archiveFile = document.getElementById('ca-archive-file').files[0];
     if (!archiveFile) throw new Error('выберите .zip архив');
+    if (!archiveFile.name.toLowerCase().endsWith('.zip')) throw new Error('файл должен быть .zip архивом, не .' + archiveFile.name.split('.').pop());
 
     var fd = new FormData();
     fd.append('name', name);