Disable url upload feature by default

src/helpers/env.ts

@@ -6,6 +6,8 @@ export const HTTP_ALLOWED = process.env.HTTP_ALLOWED?.toLowerCase() === "true" |
 export const ALLOW_UNAUTHENTICATED =
   process.env.ALLOW_UNAUTHENTICATED?.toLowerCase() === "true" || false;
 
+export const ALLOW_URL_UPLOAD = process.env.ALLOW_URL_UPLOAD?.toLowerCase() === "true" || false;
+
 export const AUTO_DELETE_EVERY_N_HOURS = process.env.AUTO_DELETE_EVERY_N_HOURS
   ? Number(process.env.AUTO_DELETE_EVERY_N_HOURS)
   : 24;

src/helpers/getFilename.ts

@@ -0,0 +1,51 @@
+import mime from "mime";
+import sanitize from "sanitize-filename";
+import { randomUUID } from "node:crypto";
+
+export const getFilename = (urlStr: string, headers: Headers): string => {
+  const contentType = headers.get("content-type")?.split(";")[0]?.trim();
+  const extension = contentType ? mime.getExtension(contentType) : null;
+
+  let candidate = "";
+  const contentDisposition = headers.get("Content-Disposition");
+  if (contentDisposition) {
+    const utf8Match = /filename\*=UTF-8''([^;\s]+)/i.exec(contentDisposition);
+    if (utf8Match && utf8Match[1]) {
+      try {
+        candidate = decodeURIComponent(utf8Match[1]);
+      } catch {
+        // ignore malformed URI
+      }
+    }
+    if (!candidate) {
+      const match = /filename=(?:"([^"]+)"|([^;\s]+))/i.exec(contentDisposition);
+      if (match) {
+        candidate = match[1] || match[2] || "";
+      }
+    }
+  }
+
+  if (!candidate) {
+    try {
+      const path = new URL(urlStr).pathname;
+      const lastPart = path.split("/").filter(Boolean).at(-1);
+      if (lastPart) {
+        candidate = decodeURIComponent(lastPart);
+      }
+    } catch {
+      // ignore invalid URL path
+    }
+  }
+
+  const sanitized = sanitize(candidate).trim().replace(/^\.+/, "");
+
+  if (!sanitized) {
+    return extension ? `${randomUUID()}.${extension}` : randomUUID();
+  }
+
+  if (!sanitized.includes(".") && extension) {
+    return `${sanitized}.${extension}`;
+  }
+
+  return sanitized;
+};

src/helpers/validateUrl.ts

@@ -0,0 +1,14 @@
+export function validateSafeUrl(urlString: string): URL {
+  let parsed: URL;
+  try {
+    parsed = new URL(urlString);
+  } catch {
+    throw new Error("Invalid URL format");
+  }
+
+  if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
+    throw new Error("Only HTTP and HTTPS URLs are supported");
+  }
+
+  return parsed;
+}