fix: t-005 a t-0029 correctif

server/api/download-latest.get.ts

@@ -3,11 +3,10 @@ import {
   shellQuote,
   resolveFolderRemoteDir,
   REMOTE_HOST,
+  isSafeFolder
 } from "../utils/ssh.ts"
 import { spawn } from "node:child_process"
 
-const isSafeFolder = (value: string) => /^[a-zA-Z0-9._-]+$/.test(value)
-
 async function getLatestRemoteFile(remoteDir: string): Promise<string | null> {
   const output = await runSsh(`cd ${shellQuote(remoteDir)} && ls -1A | sort -r | head -n 1`)
   const fileName = output.trim()
@@ -45,6 +44,9 @@ export default defineEventHandler(async (event) => {
     }
 
     const fileName = await getLatestRemoteFile(remoteDir)
+    if (!fileName || !isSafeFolder(fileName)) {
+        continue
+    }
     if (!fileName) {
       continue
     }
@@ -93,6 +95,6 @@ export default defineEventHandler(async (event) => {
       console.error(`Erreur archive SSH (${code}): ${stderr}`)
     }
   })
-
+  event.node.res.on("close", () => child.kill())
   return sendStream(event, child.stdout)
 })