fixes

src/index.ts

@@ -20,6 +20,10 @@ const existValueOrNoExistKey = (obj: Record<string, any>): Record<string, string
 
 const serverHostnameCache = new Map<string, string>();
 
+const validateHostname = (serverName: string) => {
+  assert(/^[^/?#]+$/.test(serverName), `invalid hostname: ${JSON.stringify(serverName)}`);
+};
+
 const getServerHostname = async (serverName: string) => {
   const cached = serverHostnameCache.get(serverName);
   if (cached) return cached;
@@ -30,6 +34,7 @@ const getServerHostname = async (serverName: string) => {
   if (jsonRes.status === 200) {
     let res = (await jsonRes.json())['m.server'];
     if (typeof res === 'string') {
+      validateHostname(res);
       if (!res.includes(':')) {
         res += ':8448'; // default port per spec
       }
@@ -43,6 +48,7 @@ const getServerHostname = async (serverName: string) => {
     dnsRes.sort((a, b) => a.priority - b.priority);
     console.log(dnsRes);
     const res = `${dnsRes[0].name}:${dnsRes[0].port}`;
+    validateHostname(res);
     serverHostnameCache.set(serverName, res);
     return res;
   }
@@ -62,7 +68,7 @@ media.get(
   async (ctx) => {
     const { serverName, mediaId, filename } = ctx.params;
 
-    function sendFile(f: Response) {
+    async function sendFile(f: Response) {
       ctx.res.statusCode = 200;
       (
         ['content-type', filename ? 'content-disposition' : null].filter(
@@ -77,7 +83,7 @@ media.get(
       if (filename) {
         ctx.res.setHeader('content-disposition', `attachment; filename="${filename}"`);
       }
-      ctx.res.write(f.body);
+      ctx.res.write(Buffer.from(await f.arrayBuffer()));
       ctx.res.end();
     }
 
@@ -92,7 +98,7 @@ media.get(
         },
       });
       if (file && file.status === 200) {
-        sendFile(file);
+        await sendFile(file);
         return;
       }
     }
@@ -107,7 +113,7 @@ media.get(
       headers: defaultHeaders,
     });
     if (file && file.status === 200) {
-      sendFile(file);
+      await sendFile(file);
       return;
     }
   },