v2.0.10: загрузка через ВМ-буфер (паттерн drhider)

- /api/upload_refs: pull файлов с ВМ (SSRF-guard, лимит 50МБ, ретраи, DELETE)
- uploadFile: PUT на WebDAV /contracts-upload/ → refs → pull
- nginx: location /contracts-upload/ (WebDAV + CORS для managed-фронта)

site/routes/upload_bp.py

@@ -1,5 +1,5 @@
 """Upload blueprint — загрузка, конвертация, распаковка."""
-import io, os, base64, hashlib, zipfile
+import io, os, time, base64, hashlib, zipfile
 import httpx
 from flask import Blueprint, request, jsonify, send_file
 from services.parse import parse_file
@@ -18,9 +18,76 @@ def _check_ext(filename: str) -> str | None:
     return None
 
 
+def _safe_name(name: str) -> str:
+    """Санитизация имени файла: только basename, защита от path traversal."""
+    name = (name or "").replace("\\", "/").rsplit("/", 1)[-1].strip()
+    if not name or name in (".", ".."):
+        return "file.bin"
+    return name[:255]
+
+
+def _pull_with_retries(url: str, timeout: int = 120) -> bytes:
+    """Скачать файл с ВМ-буфера с ретраями (egress, без лимита шлюза)."""
+    last: Exception | None = None
+    for attempt in range(1, config.PULL_RETRIES + 1):
+        try:
+            resp = httpx.get(url, timeout=timeout, follow_redirects=False)
+            if resp.status_code == 200:
+                return resp.content
+            last = Exception(f"HTTP {resp.status_code}")
+        except Exception as e:
+            last = e
+        if attempt < config.PULL_RETRIES:
+            time.sleep(config.PULL_RETRY_DELAY)
+    raise last or Exception("pull failed")
+
+
+def _delete_from_vm(url: str) -> None:
+    """Best-effort удаление файла с ВМ-буфера."""
+    try:
+        httpx.delete(url, timeout=30)
+    except Exception:
+        pass
+
+
+def _store_and_parse(filename: str, data: bytes, batch_id, contract_id, zip_source=None, mime_type="application/octet-stream"):
+    """Общая логика: дедуп → insert в БД → авто-парсинг. Возвращает dict-результат."""
+    content_hash = hashlib.sha256(data).hexdigest()[:16]
+
+    # Дедупликация по хешу
+    if batch_id:
+        existing = documents.get_by_hash(batch_id, content_hash)
+        if existing:
+            return {"ok": False, "error": "duplicate", "doc_id": existing["id"], "duplicate_of": True}
+
+    doc = documents.insert(
+        filename=filename,
+        mime_type=mime_type,
+        original_bytes=base64.b64encode(data).decode(),
+        batch_id=batch_id,
+        zip_source=zip_source,
+        content_hash=content_hash,
+    )
+
+    # Авто-парсинг
+    try:
+        result = parse_file(filename, data)
+        if result["status"] == "parsed":
+            documents.set_parsed(doc["id"], result["elements"])
+            parsed = {"status": "parsed", "element_count": result.get("element_count", 0)}
+        else:
+            documents.set_error(doc["id"], result.get("error", "parse failed"))
+            parsed = {"status": "error", "error": result.get("error", "parse failed")}
+    except Exception as e:
+        documents.set_error(doc["id"], str(e))
+        parsed = {"status": "error", "error": str(e)}
+
+    return {"ok": True, "doc_id": doc["id"], "contract_id": contract_id, "parsed": parsed}
+
+
 @upload_bp.route("/upload", methods=["POST"])
 def upload():
-    """Загрузка одного файла + авто-парсинг → БД."""
+    """Загрузка одного файла + авто-парсинг → БД (прямой multipart)."""
     f = request.files.get("files")
     if not f:
         return jsonify(ok=False, error="no file"), 400
@@ -30,43 +97,66 @@ def upload():
         return jsonify(ok=False, error=err), 400
 
     data = f.read()
-    content_hash = hashlib.sha256(data).hexdigest()[:16]
     batch_id = request.form.get("batch_id")
     zip_source = request.form.get("zip_source")
-
-    # Дедупликация по хешу
-    if batch_id:
-        existing = documents.get_by_hash(batch_id, content_hash)
-        if existing:
-            return jsonify(ok=False, error="duplicate", doc_id=existing["id"])
-
-    doc = documents.insert(
-        filename=f.filename,
-        mime_type=f.content_type or "application/octet-stream",
-        original_bytes=base64.b64encode(data).decode(),
-        batch_id=batch_id,
-        zip_source=zip_source,
-        content_hash=content_hash,
-    )
-
-    # Авто-парсинг
-    try:
-        result = parse_file(f.filename, data)
-        if result["status"] == "parsed":
-            documents.set_parsed(doc["id"], result["elements"])
-        else:
-            documents.set_error(doc["id"], result.get("error", "parse failed"))
-    except Exception as e:
-        documents.set_error(doc["id"], str(e))
-        result = {"status": "error", "error": str(e)}
-
     contract_id = request.form.get("contract_id")
-    return jsonify(
-        ok=True,
-        doc_id=doc["id"],
-        contract_id=contract_id,
-        parsed={"status": result["status"], "element_count": result.get("element_count", 0)},
-    )
+
+    result = _store_and_parse(f.filename, data, batch_id, contract_id, zip_source, f.content_type or "application/octet-stream")
+    if not result["ok"]:
+        return jsonify(ok=result["ok"], error=result.get("error"), doc_id=result.get("doc_id")), 200
+    return jsonify(ok=True, doc_id=result["doc_id"], contract_id=result["contract_id"], parsed=result["parsed"])
+
+
+@upload_bp.route("/api/upload_refs", methods=["POST"])
+def upload_refs():
+    """Загрузка через ВМ-буфер (паттерн drhider): бэк тянет файлы с ВМ.
+
+    Тело (маленькое, <64КБ): {batch_id, contract_id, zip_source, files:[{name,size,url}]}.
+    Для каждой ссылки: SSRF-проверка → лимит → pull с ретраями → store+parse → DELETE с ВМ.
+    """
+    data = request.get_json(silent=True) or {}
+    files = data.get("files") or []
+    batch_id = data.get("batch_id")
+    contract_id = data.get("contract_id")
+    zip_source = data.get("zip_source")
+
+    if not files:
+        return jsonify(ok=False, error="no files"), 400
+
+    results = []
+    for ref in files:
+        name = _safe_name(str(ref.get("name", "") or ""))
+        size = int(ref.get("size") or 0)
+        url = str(ref.get("url", "") or "")
+
+        # SSRF-защита: тянуть можно ТОЛЬКО с доверенного ВМ-буфера
+        if not url.startswith(config.VM_UPLOAD_PREFIX):
+            results.append({"name": name, "ok": False, "error": "invalid url (SSRF guard)"})
+            continue
+
+        # Лимит по заявленному размеру
+        if size > config.VM_UPLOAD_MAX_BYTES:
+            _delete_from_vm(url)
+            results.append({"name": name, "ok": False, "error": f"file too large: {size} bytes (max {config.VM_UPLOAD_MAX_BYTES})", "skipped": True})
+            continue
+
+        try:
+            content = _pull_with_retries(url)
+        except Exception as e:
+            results.append({"name": name, "ok": False, "error": f"pull failed: {e}"})
+            continue
+
+        # Реальная проверка размера после pull
+        if len(content) > config.VM_UPLOAD_MAX_BYTES:
+            _delete_from_vm(url)
+            results.append({"name": name, "ok": False, "error": "file too large after pull", "skipped": True})
+            continue
+
+        _delete_from_vm(url)
+        stored = _store_and_parse(name, content, batch_id, contract_id, zip_source)
+        results.append({"name": name, **stored})
+
+    return jsonify(ok=True, results=results)
 
 
 @upload_bp.route("/convert-doc", methods=["POST"])