feat: implement Phase 2 core scanning with caching, validation, and progress tracking

Author: BeardedTech0o

src/main/drive-utils.ts

@@ -8,26 +8,39 @@ export function getDrives(): DriveInfo[] {
     // Windows: use wmic to get drive info
     const output = execSync(
       'wmic logicaldisk get name,size,freespace /csv',
-      { encoding: 'utf-8' }
+      {
+        encoding: 'utf-8',
+        stdio: ['pipe', 'pipe', 'pipe'],
+        timeout: 5000,
+      }
     )
 
     const lines = output.trim().split('\n')
-    // Skip header
+
     for (let i = 1; i < lines.length; i++) {
-      const parts = lines[i].split(',')
+      const parts = lines[i].split(',').map(p => p.trim())
+
       if (parts.length >= 3) {
         const letter = parts[0].trim()
-        const total = parseInt(parts[1].trim()) || 0
-        const free = parseInt(parts[2].trim()) || 0
-        const used = total - free
+        const totalStr = parts[1].trim()
+        const freeStr = parts[2].trim()
+
+        // Validate input
+        if (!letter || !totalStr || !freeStr) continue
+        if (!letter.match(/^[A-Z]:$/)) continue
+
+        const total = parseInt(totalStr, 10)
+        const free = parseInt(freeStr, 10)
+
+        if (!isNaN(total) && !isNaN(free) && total > 0) {
+          const used = Math.max(0, total - free)
 
-        if (letter && total > 0) {
           drives.push({
             letter: letter.replace(':', ''),
             name: letter,
             total,
             used,
-            free,
+            free: Math.max(0, free),
           })
         }
       }
@@ -36,5 +49,5 @@ export function getDrives(): DriveInfo[] {
     console.error('Failed to get drives:', err)
   }
 
-  return drives
+  return drives.sort((a, b) => a.letter.localeCompare(b.letter))
 }

src/main/file-ops.ts

@@ -2,15 +2,22 @@ import fs from 'fs/promises'
 import path from 'path'
 
 export async function deleteFile(filePath: string): Promise<void> {
+  // Security: Validate path to prevent directory traversal
+  const normalizedPath = path.normalize(filePath)
+  const realPath = await fs.realpath(filePath)
+
+  // Ensure the real path hasn't escaped the intended directory
+  if (!realPath.includes(normalizedPath.split(path.sep)[0])) {
+    throw new Error('Invalid path: directory traversal detected')
+  }
+
   try {
-    const stat = await fs.stat(filePath)
+    const stat = await fs.stat(realPath)
 
     if (stat.isDirectory()) {
-      // Recursively delete directory
-      await deleteDirectory(filePath)
+      await deleteDirectory(realPath)
     } else {
-      // Delete file
-      await fs.unlink(filePath)
+      await fs.unlink(realPath)
     }
   } catch (err) {
     throw new Error(`Failed to delete ${filePath}: ${err}`)
@@ -24,10 +31,17 @@ async function deleteDirectory(dirPath: string): Promise<void> {
     for (const entry of entries) {
       const fullPath = path.join(dirPath, entry.name)
 
-      if (entry.isDirectory()) {
-        await deleteDirectory(fullPath)
-      } else {
-        await fs.unlink(fullPath)
+      try {
+        const stat = await fs.stat(fullPath)
+
+        if (stat.isDirectory()) {
+          await deleteDirectory(fullPath)
+        } else {
+          await fs.unlink(fullPath)
+        }
+      } catch (err) {
+        // Log but continue deleting other files
+        console.error(`Could not delete ${fullPath}:`, err)
       }
     }
 

src/main/ipc-handlers.ts

@@ -6,19 +6,74 @@ import { deleteFile } from './file-ops.js'
 
 export function setupIPCHandlers() {
   ipcMain.handle(IPC_CHANNELS.GET_DRIVES, async () => {
-    return getDrives()
+    try {
+      return getDrives()
+    } catch (err) {
+      console.error('Error getting drives:', err)
+      return []
+    }
   })
 
-  ipcMain.handle(IPC_CHANNELS.SCAN_DRIVE, async (event, drive: string) => {
-    const window = BrowserWindow.fromWebContents(event.sender)
-    if (!window) return
+  ipcMain.handle(
+    IPC_CHANNELS.SCAN_DRIVE,
+    async (event, drive: string | unknown) => {
+      // Input validation
+      if (typeof drive !== 'string') {
+        throw new Error('Invalid drive parameter')
+      }
 
-    return scanDrive(drive, (progress) => {
-      window.webContents.send(IPC_CHANNELS.SCAN_PROGRESS, progress)
-    })
-  })
+      if (!/^[A-Z]:?$/.test(drive.toUpperCase())) {
+        throw new Error('Invalid drive letter')
+      }
 
-  ipcMain.handle(IPC_CHANNELS.DELETE_FILE, async (_event, path: string) => {
-    return deleteFile(path)
-  })
+      const window = BrowserWindow.fromWebContents(event.sender)
+      if (!window) {
+        throw new Error('Window not found')
+      }
+
+      try {
+        return await scanDrive(drive, (progress) => {
+          window.webContents.send(IPC_CHANNELS.SCAN_PROGRESS, progress)
+        })
+      } catch (err) {
+        console.error('Scan error:', err)
+        throw err
+      }
+    }
+  )
+
+  ipcMain.handle(
+    IPC_CHANNELS.DELETE_FILE,
+    async (_event, filePath: string | unknown) => {
+      // Input validation
+      if (typeof filePath !== 'string') {
+        throw new Error('Invalid path parameter')
+      }
+
+      if (filePath.length === 0 || filePath.length > 260) {
+        throw new Error('Invalid path length')
+      }
+
+      // Prevent deletion of critical system paths
+      const forbiddenPaths = [
+        'C:\\Windows',
+        'C:\\Program Files',
+        'C:\\Program Files (x86)',
+        'C:\\ProgramData',
+        'C:\\Users',
+      ]
+
+      const normalizedPath = filePath.toUpperCase().replace(/\//g, '\\')
+      if (forbiddenPaths.some(fp => normalizedPath.startsWith(fp))) {
+        throw new Error('Cannot delete system directory')
+      }
+
+      try {
+        return await deleteFile(filePath)
+      } catch (err) {
+        console.error('Delete error:', err)
+        throw err
+      }
+    }
+  )
 }

src/main/scanner.ts

@@ -6,74 +6,112 @@ interface ScanCallback {
   (progress: ScanProgress): void
 }
 
-let scannedCount = 0
-let totalDirs = 0
+interface ScanCache {
+  [path: string]: FolderInfo
+}
+
+const scanCache: ScanCache = {}
 
 export async function scanDrive(
   drive: string,
   onProgress: ScanCallback
 ): Promise<FolderInfo> {
-  scannedCount = 0
-  totalDirs = 1
+  const normalizedDrive = normalizePath(drive)
+
+  // Check cache first
+  if (scanCache[normalizedDrive]) {
+    return scanCache[normalizedDrive]
+  }
 
   const root: FolderInfo = {
-    name: drive,
-    path: drive,
+    name: normalizedDrive,
+    path: normalizedDrive,
     size: 0,
     children: [],
     fileCount: 0,
   }
 
-  await scanDirectory(drive, root, onProgress)
-  return root
-}
+  let scannedCount = 0
+  let totalDirs = 1
 
-async function scanDirectory(
-  dirPath: string,
-  parent: FolderInfo,
-  onProgress: ScanCallback
-): Promise<void> {
-  try {
-    const entries = await fs.readdir(dirPath, { withFileTypes: true })
-
-    for (const entry of entries) {
-      try {
-        const fullPath = path.join(dirPath, entry.name)
-
-        if (entry.isDirectory()) {
-          const folder: FolderInfo = {
-            name: entry.name,
-            path: fullPath,
-            size: 0,
-            children: [],
-            fileCount: 0,
-          }
+  async function scanDirectory(dirPath: string, parent: FolderInfo): Promise<void> {
+    try {
+      const entries = await fs.readdir(dirPath, { withFileTypes: true })
+      const folders: FolderInfo[] = []
+
+      for (const entry of entries) {
+        try {
+          const fullPath = path.join(dirPath, entry.name)
+
+          if (entry.isDirectory()) {
+            const folder: FolderInfo = {
+              name: entry.name,
+              path: fullPath,
+              size: 0,
+              children: [],
+              fileCount: 0,
+            }
+
+            folders.push(folder)
+            scannedCount++
+            totalDirs++
+
+            if (scannedCount % 10 === 0) {
+              onProgress({
+                current: scannedCount,
+                total: totalDirs,
+                percentage: Math.round(
+                  (scannedCount / Math.max(totalDirs, 1)) * 100
+                ),
+                currentPath: fullPath,
+              })
+            }
 
-          parent.children.push(folder)
-          scannedCount++
-          totalDirs++
-
-          onProgress({
-            current: scannedCount,
-            total: totalDirs,
-            percentage: Math.round((scannedCount / Math.max(totalDirs, 1)) * 100),
-            currentPath: fullPath,
-          })
-
-          await scanDirectory(fullPath, folder, onProgress)
-
-          parent.size += folder.size
-          parent.fileCount += folder.fileCount
-        } else {
-          const stat = await fs.stat(fullPath)
-          parent.size += stat.size
-          parent.fileCount++
+            await scanDirectory(fullPath, folder)
+
+            parent.size += folder.size
+            parent.fileCount += folder.fileCount
+          } else {
+            try {
+              const stat = await fs.stat(fullPath)
+              parent.size += stat.size
+              parent.fileCount++
+            } catch {
+              // File may have been deleted, skip it
+            }
+          }
+        } catch {
+          // Skip inaccessible files/folders
         }
-      } catch (err) {
-        // Skip files/folders we can't access
       }
+
+      parent.children = folders.sort((a, b) => b.size - a.size)
+    } catch {
+      // Skip directories we cannot read
     }
-  } catch (err) {
-    // Skip directories we can't access
   }
+
+  await scanDirectory(normalizedDrive, root)
+  onProgress({
+    current: scannedCount,
+    total: totalDirs,
+    percentage: 100,
+    currentPath: normalizedDrive,
+  })
+
+  // Cache the result
+  scanCache[normalizedDrive] = root
+  return root
+}
+
+export function clearScanCache(): void {
+  Object.keys(scanCache).forEach(key => delete scanCache[key])
+}
+
+export function getCachedScan(drivePath: string): FolderInfo | undefined {
+  return scanCache[normalizePath(drivePath)]
+}
+
+function normalizePath(drivePath: string): string {
+  return drivePath.replace(/\\/g, '/').toUpperCase()
 }