Reset picker status between selections and harden upload guards

site/routes/api_bp.py

@@ -63,6 +63,12 @@ def upload():
         if not name:
             had_unnamed = True
             continue
+        # Ранняя проверка размера по Content-Length позволяет не читать в память
+        # тело файла, заведомо превышающего лимит. Проверка выполняется до f.read().
+        if f.content_length is not None and f.content_length > MAX_FILE_BYTES:
+            log.warning("upload: file exceeds %dMB, skipped sid=%s file=%r size=%d",
+                        MAX_FILE_BYTES // (1024 * 1024), sid, name, f.content_length)
+            continue
         data = f.read()
         log.info("upload: sid=%s file=%r size=%d", sid, name, len(data))
         if len(data) > MAX_FILE_BYTES:

site/static/dist/file-picker.esm.js

@@ -1,4 +1,4 @@
-// node_modules/fflate/esm/browser.js
+// .agent-tmp/node_modules/fflate/esm/browser.js
 var u8 = Uint8Array;
 var u16 = Uint16Array;
 var i32 = Int32Array;
@@ -717,6 +717,7 @@ function onFilesChange(state, cfg, elements) {
   return async () => {
     if (state.busy) return;
     state.busy = true;
+    if (elements.statusEl) elements.statusEl.textContent = "";
     try {
       await addFiles(state, cfg, elements.fileInputEl.files, elements);
     } finally {
@@ -731,6 +732,7 @@ function onFolderChange(state, cfg, elements) {
   return async () => {
     if (state.busy) return;
     state.busy = true;
+    if (elements.statusEl) elements.statusEl.textContent = "";
     try {
       const roots = /* @__PURE__ */ new Map();
       for (const file of Array.from(elements.folderInputEl.files)) {
@@ -1153,6 +1155,7 @@ function initFilePicker(config) {
   if (root.querySelector("#fp-clear-btn")) listen(root.querySelector("#fp-clear-btn"), "click", () => {
     state.nodes = [];
     state.fileKeys.clear();
+    if (elements.statusEl) elements.statusEl.textContent = "";
     redraw();
     notify(cfg, state);
   });
@@ -1174,6 +1177,7 @@ function initFilePicker(config) {
     clear: () => {
       state.nodes = [];
       state.fileKeys.clear();
+      if (elements.statusEl) elements.statusEl.textContent = "";
       redraw();
       notify(cfg, state);
     },

site/static/dist/file-picker.iife.js

@@ -26,7 +26,7 @@ var FilePicker = (() => {
     uploadViaVM: () => uploadViaVM
   });
 
-  // node_modules/fflate/esm/browser.js
+  // .agent-tmp/node_modules/fflate/esm/browser.js
   var u8 = Uint8Array;
   var u16 = Uint16Array;
   var i32 = Int32Array;
@@ -745,6 +745,7 @@ var FilePicker = (() => {
     return async () => {
       if (state.busy) return;
       state.busy = true;
+      if (elements.statusEl) elements.statusEl.textContent = "";
       try {
         await addFiles(state, cfg, elements.fileInputEl.files, elements);
       } finally {
@@ -759,6 +760,7 @@ var FilePicker = (() => {
     return async () => {
       if (state.busy) return;
       state.busy = true;
+      if (elements.statusEl) elements.statusEl.textContent = "";
       try {
         const roots = /* @__PURE__ */ new Map();
         for (const file of Array.from(elements.folderInputEl.files)) {
@@ -1181,6 +1183,7 @@ var FilePicker = (() => {
     if (root.querySelector("#fp-clear-btn")) listen(root.querySelector("#fp-clear-btn"), "click", () => {
       state.nodes = [];
       state.fileKeys.clear();
+      if (elements.statusEl) elements.statusEl.textContent = "";
       redraw();
       notify(cfg, state);
     });
@@ -1202,6 +1205,7 @@ var FilePicker = (() => {
       clear: () => {
         state.nodes = [];
         state.fileKeys.clear();
+        if (elements.statusEl) elements.statusEl.textContent = "";
         redraw();
         notify(cfg, state);
       },

site/templates/index.html

@@ -877,13 +877,23 @@
       if (!sessionDone) ub.disabled = false;
     }
 
+    function parseFilename(disp) {
+      if (!disp) return 'obfuscator.zip';
+      // RFC 5987: filename*=UTF-8''... имеет приоритет над обычным filename=.
+      const utf8 = disp.match(/filename\*=UTF-8''([^;]+)/i);
+      if (utf8) {
+        try { return decodeURIComponent(utf8[1]); } catch (e) { /* повреждённый percent-encoding */ }
+      }
+      const plain = disp.match(/filename="?([^";]+)"?/i);
+      return plain ? plain[1] : 'obfuscator.zip';
+    }
+
     function downloadZip() {
       if (!currentSid) return;
       fetch('/api/download/' + currentSid)
         .then(r => {
           const disp = r.headers.get('Content-Disposition');
-          const m = disp && disp.match(/filename="?(.+?)"?$/);
-          return Promise.all([r.blob(), m ? m[1] : 'obfuscator.zip']);
+          return Promise.all([r.blob(), parseFilename(disp)]);
         })
         .then(([blob, fname]) => {
           const a = document.createElement('a');