🗺 feat: Stripe EXIF GPS data from files during upload

package.json

@@ -45,6 +45,7 @@
     "@tycrek/isprod": "^2.0.2",
     "@tycrek/log": "^0.6.0-7",
     "@tycrek/papito": "^0.3.4",
+    "@xoi/gps-metadata-remover": "^1.1.1",
     "any-shell-escape": "^0.1.1",
     "autoprefixer": "^10.4.4",
     "aws-sdk": "^2.1115.0",

src/nightmare.ts

@@ -0,0 +1,26 @@
+/**
+ * This strips GPS EXIF data from files
+ */
+
+import { removeLocation } from '@xoi/gps-metadata-remover';
+import fs from 'fs-extra';
+
+/**
+ * This strips GPS EXIF data from files using the @xoi/gps-metadata-remover package
+ * @returns A Promise that resolves to `true` if GPS data was removed, `false` if not
+ */
+export const removeGPS = (file: string): Promise<boolean> => {
+	return new Promise((resolve, reject) =>
+		fs.open(file, 'r+')
+			.then((fd) => removeLocation(file,
+				// Read function
+				(size: number, offset: number): Promise<Buffer> =>
+					fs.read(fd, Buffer.alloc(size), 0, size, offset)
+						.then(({ buffer }) => Promise.resolve(buffer)),
+				// Write function
+				(val: string, offset: number, enc: BufferEncoding): Promise<void> =>
+					fs.write(fd, Buffer.alloc(val.length, val, enc), 0, val.length, offset)
+						.then(() => Promise.resolve())))
+			.then(resolve)
+			.catch(reject));
+}

src/storage.ts

@@ -11,6 +11,7 @@ import Hash from './hash';
 import { path, generateId, log } from './utils';
 import { SkynetUpload } from './skynet';
 import { Request, Response } from 'express';
+import { removeGPS } from './nightmare';
 const { s3enabled, s3endpoint, s3bucket, s3usePathStyle, s3accessKey, s3secretKey, diskFilePath, saveAsOriginal, saveWithDate, mediaStrict, maxUploadSize, useSia }: Config = fs.readJsonSync(path('config.json'));
 const { CODE_UNSUPPORTED_MEDIA_TYPE }: MagicNumbers = fs.readJsonSync(path('MagicNumbers.json'));
 
@@ -108,6 +109,11 @@ export function processUploaded(req: Request, res: Response, next: Function) { /
 		// Check if file size is too big
 		.then(() => { if (req.file.size / Math.pow(1024, 2) > maxUploadSize) throw new Error('LIMIT_FILE_SIZE'); })
 
+		// Strip EXIF data
+		.then(() => removeGPS(req.file.path))
+		.then((result) => log.debug('EXIF GPS data', result ? 'removed' : 'not removed'))
+		.catch((err) => log.debug('!! EXIF GPS data could not be removed', err))
+
 		// Save file
 		.then(() => log.debug('Saving file', req.file.originalname, s3enabled ? 'in S3' : useSia ? 'on Sia blockchain' : 'on disk'))
 		.then(() =>

src/types/gps-metadata-remover.d.ts

@@ -0,0 +1,9 @@
+type ReadFunction = (size: number, offset: number) => Promise<Buffer>
+type WriteFunction = (val: string, offset: number, enc: any) => Promise<void>
+type Options = {
+	skipXMPRemoval?: boolean
+}
+
+declare module '@xoi/gps-metadata-remover' {
+	export async function removeLocation(path: string, read: ReadFunction, write: WriteFunction, options: Options = {}): Promise<boolean>
+}