@c9up/ream 0.1.14 → 0.1.15
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/bodyparser/BodyParserMiddleware.d.ts.map +1 -1
- package/dist/bodyparser/BodyParserMiddleware.js +4 -0
- package/dist/bodyparser/BodyParserMiddleware.js.map +1 -1
- package/dist/bodyparser/MultipartFile.d.ts +24 -3
- package/dist/bodyparser/MultipartFile.d.ts.map +1 -1
- package/dist/bodyparser/MultipartFile.js +40 -4
- package/dist/bodyparser/MultipartFile.js.map +1 -1
- package/dist/rpc/RpcRouter.d.ts.map +1 -1
- package/dist/rpc/RpcRouter.js +18 -1
- package/dist/rpc/RpcRouter.js.map +1 -1
- package/events.win32-x64-msvc.node +0 -0
- package/index.win32-x64-msvc.node +0 -0
- package/package.json +3 -2
- package/scheduler.win32-x64-msvc.node +0 -0
- package/src/bodyparser/BodyParserMiddleware.ts +4 -0
- package/src/bodyparser/MultipartFile.ts +44 -5
- package/src/rpc/RpcRouter.ts +18 -1
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"BodyParserMiddleware.d.ts","sourceRoot":"","sources":["../../src/bodyparser/BodyParserMiddleware.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAA;AAIzD,MAAM,WAAW,gBAAgB;IAC/B,IAAI,CAAC,EAAE;QACL,OAAO,CAAC,EAAE,OAAO,CAAA;QACjB,KAAK,CAAC,EAAE,MAAM,CAAA;QACd,KAAK,CAAC,EAAE,MAAM,EAAE,CAAA;KACjB,CAAA;IACD,IAAI,CAAC,EAAE;QACL,OAAO,CAAC,EAAE,OAAO,CAAA;QACjB,KAAK,CAAC,EAAE,MAAM,CAAA;QACd,KAAK,CAAC,EAAE,MAAM,EAAE,CAAA;KACjB,CAAA;IACD,GAAG,CAAC,EAAE;QACJ,OAAO,CAAC,EAAE,OAAO,CAAA;QACjB,KAAK,CAAC,EAAE,MAAM,CAAA;QACd,KAAK,CAAC,EAAE,MAAM,EAAE,CAAA;KACjB,CAAA;IACD,SAAS,CAAC,EAAE;QACV,OAAO,CAAC,EAAE,OAAO,CAAA;QACjB,8EAA8E;QAC9E,KAAK,CAAC,EAAE,MAAM,CAAA;QACd,wDAAwD;QACxD,QAAQ,CAAC,EAAE,MAAM,CAAA;QACjB,SAAS,CAAC,EAAE,MAAM,CAAA;QAClB,MAAM,CAAC,EAAE,MAAM,CAAA;QACf,KAAK,CAAC,EAAE,MAAM,EAAE,CAAA;KACjB,CAAA;CACF;AAmCD,MAAM,CAAC,OAAO,OAAO,oBAAoB;;gBAG3B,MAAM,CAAC,EAAE,gBAAgB;IAS/B,MAAM,CAAC,GAAG,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC;
|
|
1
|
+
{"version":3,"file":"BodyParserMiddleware.d.ts","sourceRoot":"","sources":["../../src/bodyparser/BodyParserMiddleware.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAA;AAIzD,MAAM,WAAW,gBAAgB;IAC/B,IAAI,CAAC,EAAE;QACL,OAAO,CAAC,EAAE,OAAO,CAAA;QACjB,KAAK,CAAC,EAAE,MAAM,CAAA;QACd,KAAK,CAAC,EAAE,MAAM,EAAE,CAAA;KACjB,CAAA;IACD,IAAI,CAAC,EAAE;QACL,OAAO,CAAC,EAAE,OAAO,CAAA;QACjB,KAAK,CAAC,EAAE,MAAM,CAAA;QACd,KAAK,CAAC,EAAE,MAAM,EAAE,CAAA;KACjB,CAAA;IACD,GAAG,CAAC,EAAE;QACJ,OAAO,CAAC,EAAE,OAAO,CAAA;QACjB,KAAK,CAAC,EAAE,MAAM,CAAA;QACd,KAAK,CAAC,EAAE,MAAM,EAAE,CAAA;KACjB,CAAA;IACD,SAAS,CAAC,EAAE;QACV,OAAO,CAAC,EAAE,OAAO,CAAA;QACjB,8EAA8E;QAC9E,KAAK,CAAC,EAAE,MAAM,CAAA;QACd,wDAAwD;QACxD,QAAQ,CAAC,EAAE,MAAM,CAAA;QACjB,SAAS,CAAC,EAAE,MAAM,CAAA;QAClB,MAAM,CAAC,EAAE,MAAM,CAAA;QACf,KAAK,CAAC,EAAE,MAAM,EAAE,CAAA;KACjB,CAAA;CACF;AAmCD,MAAM,CAAC,OAAO,OAAO,oBAAoB;;gBAG3B,MAAM,CAAC,EAAE,gBAAgB;IAS/B,MAAM,CAAC,GAAG,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC;CA4FzD"}
|
|
@@ -75,6 +75,10 @@ export default class BodyParserMiddleware {
|
|
|
75
75
|
if (this.#rejectMultipart(ctx, payload.files, payload.fields))
|
|
76
76
|
return;
|
|
77
77
|
const { fields, files } = hydrateMultipartPayload(payload);
|
|
78
|
+
// Fingerprint each file's real type from its magic bytes BEFORE handlers
|
|
79
|
+
// run, so `request.file(field, { extnames })` validates against the
|
|
80
|
+
// detected type (not the attacker-controlled filename/header).
|
|
81
|
+
await Promise.all(files.map((file) => file.detectType()));
|
|
78
82
|
ctx.request.setParsedBody(fields);
|
|
79
83
|
ctx.request.setFiles(files);
|
|
80
84
|
}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"BodyParserMiddleware.js","sourceRoot":"","sources":["../../src/bodyparser/BodyParserMiddleware.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAGH,OAAO,EAAE,uBAAuB,EAAE,MAAM,oBAAoB,CAAA;AAC5D,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAqC1C,MAAM,cAAc,GAA6B;IAC/C,IAAI,EAAE;QACJ,OAAO,EAAE,IAAI;QACb,KAAK,EAAE,KAAK;QACZ,KAAK,EAAE,CAAC,kBAAkB,EAAE,0BAA0B,CAAC;KACxD;IACD,IAAI,EAAE;QACJ,OAAO,EAAE,IAAI;QACb,KAAK,EAAE,KAAK;QACZ,KAAK,EAAE,CAAC,mCAAmC,CAAC;KAC7C;IACD,GAAG,EAAE;QACH,OAAO,EAAE,KAAK;QACd,KAAK,EAAE,KAAK;QACZ,KAAK,EAAE,CAAC,YAAY,CAAC;KACtB;IACD,SAAS,EAAE;QACT,OAAO,EAAE,IAAI;QACb,KAAK,EAAE,MAAM;QACb,QAAQ,EAAE,EAAE;QACZ,SAAS,EAAE,GAAG;QACd,MAAM,EAAE,MAAM;QACd,KAAK,EAAE,CAAC,qBAAqB,CAAC;KAC/B;CACF,CAAA;AAED,MAAM,CAAC,OAAO,OAAO,oBAAoB;IACvC,OAAO,CAA0B;IAEjC,YAAY,MAAyB;QACnC,IAAI,CAAC,OAAO,GAAG;YACb,IAAI,EAAE,EAAE,GAAG,cAAc,CAAC,IAAI,EAAE,GAAG,MAAM,EAAE,IAAI,EAAE;YACjD,IAAI,EAAE,EAAE,GAAG,cAAc,CAAC,IAAI,EAAE,GAAG,MAAM,EAAE,IAAI,EAAE;YACjD,GAAG,EAAE,EAAE,GAAG,cAAc,CAAC,GAAG,EAAE,GAAG,MAAM,EAAE,GAAG,EAAE;YAC9C,SAAS,EAAE,EAAE,GAAG,cAAc,CAAC,SAAS,EAAE,GAAG,MAAM,EAAE,SAAS,EAAE;SACjE,CAAA;IACH,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,GAAgB,EAAE,IAAyB;QACtD,MAAM,WAAW,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,CAAA;QAC5D,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,EAAE,CAAA;QAEjC,aAAa;QACb,IAAI,MAAM,CAAC,UAAU,CAAC,OAAO,EAAE,MAAM,CAAC,GAAG,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC,EAAE,CAAC;YAChF,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBAC5B,KAAK,EAAE,EAAE,IAAI,EAAE,4BAA4B,EAAE,OAAO,EAAE,iCAAiC,EAAE;aAC1F,CAAC,CAAA;YACF,OAAM;QACR,CAAC;QAED,OAAO;QACP,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,IAAI,WAAW,CAAC,WAAW,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YACnF,mDAAmD;QACrD,CAAC;QAED,mBAAmB;QACnB,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,IAAI,WAAW,CAAC,WAAW,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YACnF,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC,mBAAmB,CAAC,OAAO,CAAC,CAAC,CAAA;QACzD,CAAC;QAED,kEAAkE;QAClE,uEAAuE;QACvE,2EAA2E;QAC3E,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,IAAI,WAAW,CAAC,WAAW,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;YACjF,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAA;QAC/C,CAAC;QAED,oEAAoE;QACpE,0EAA0E;QAC1E,sEAAsE;QACtE,IAAI,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,OAAO,IAAI,WAAW,CAAC,WAAW,EAAE,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC;YAC7F,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC,SAAS,EAAE,CAAA;YACvC,IAAI,OAAO,EAAE,CAAC;gBACZ,IAAI,IAAI,CAAC,gBAAgB,CAAC,GAAG,EAAE,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,MAAM,CAAC;oBAAE,OAAM;gBACrE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,uBAAuB,CAAC,OAAO,CAAC,CAAA;gBAC1D,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,CAAA;gBACjC,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAA;YAC7B,CAAC;QACH,CAAC;QAED,MAAM,IAAI,EAAE,CAAA;IACd,CAAC;IAED,SAAS,CAAC,WAAmB;QAC3B,IAAI,WAAW,CAAC,WAAW,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAA;QACrF,IAAI,WAAW,CAAC,WAAW,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAA;QACrF,IAAI,WAAW,CAAC,WAAW,EAAE,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,KAAK,CAAA;QAC/F,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAA;IAC/B,CAAC;IAED,gGAAgG;IAChG,gBAAgB,CACd,GAAgB,EAChB,KAA8B,EAC9B,MAAsB;QAEtB,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAA;QAClC,MAAM,QAAQ,GAAG,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;QAErC,IAAI,MAAM,CAAC,MAAM,GAAG,GAAG,CAAC,SAAS,EAAE,CAAC;YAClC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBAC5B,KAAK,EAAE;oBACL,IAAI,EAAE,mBAAmB;oBACzB,OAAO,EAAE,6BAA6B,GAAG,CAAC,SAAS,GAAG;iBACvD;aACF,CAAC,CAAA;YACF,OAAO,IAAI,CAAA;QACb,CAAC;QAED,IAAI,KAAK,CAAC,MAAM,GAAG,GAAG,CAAC,QAAQ,EAAE,CAAC;YAChC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBAC5B,KAAK,EAAE,EAAE,IAAI,EAAE,kBAAkB,EAAE,OAAO,EAAE,4BAA4B,GAAG,CAAC,QAAQ,GAAG,EAAE;aAC1F,CAAC,CAAA;YACF,OAAO,IAAI,CAAA;QACb,CAAC;QAED,MAAM,UAAU,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAA;QAC5D,IAAI,UAAU,GAAG,QAAQ,EAAE,CAAC;YAC1B,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBAC5B,KAAK,EAAE,EAAE,IAAI,EAAE,4BAA4B,EAAE,OAAO,EAAE,2BAA2B,EAAE;aACpF,CAAC,CAAA;YACF,OAAO,IAAI,CAAA;QACb,CAAC;QAED,OAAO,KAAK,CAAA;IACd,CAAC;CACF;AAED,SAAS,WAAW,CAAC,WAAmB,EAAE,KAAe;IACvD,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAA;AACnD,CAAC;AAED,SAAS,mBAAmB,CAAC,IAAY;IACvC,MAAM,MAAM,GAA4B,EAAE,CAAA;IAC1C,IAAI,CAAC,IAAI;QAAE,OAAO,MAAM,CAAA;IACxB,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACnC,IAAI,CAAC,IAAI;YAAE,SAAQ;QACnB,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;QAC/B,IAAI,KAAK,KAAK,CAAC,CAAC,EAAE,CAAC;YACjB,MAAM,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,CAAA;QACxC,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,GAAG,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAA;QAChG,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAA;AACf,CAAC;AAED,gFAAgF;AAChF,4EAA4E;AAC5E,+EAA+E;AAC/E,EAAE;AACF,mEAAmE;AACnE,gFAAgF;AAChF,6EAA6E;AAC7E,aAAa;AACb,SAAS,mBAAmB,CAAC,KAAa;IACxC,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAA;IACxC,IAAI,CAAC;QACH,OAAO,kBAAkB,CAAC,MAAM,CAAC,CAAA;IACnC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,MAAM,CAAA;IACf,CAAC;AACH,CAAC"}
|
|
1
|
+
{"version":3,"file":"BodyParserMiddleware.js","sourceRoot":"","sources":["../../src/bodyparser/BodyParserMiddleware.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAGH,OAAO,EAAE,uBAAuB,EAAE,MAAM,oBAAoB,CAAA;AAC5D,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAqC1C,MAAM,cAAc,GAA6B;IAC/C,IAAI,EAAE;QACJ,OAAO,EAAE,IAAI;QACb,KAAK,EAAE,KAAK;QACZ,KAAK,EAAE,CAAC,kBAAkB,EAAE,0BAA0B,CAAC;KACxD;IACD,IAAI,EAAE;QACJ,OAAO,EAAE,IAAI;QACb,KAAK,EAAE,KAAK;QACZ,KAAK,EAAE,CAAC,mCAAmC,CAAC;KAC7C;IACD,GAAG,EAAE;QACH,OAAO,EAAE,KAAK;QACd,KAAK,EAAE,KAAK;QACZ,KAAK,EAAE,CAAC,YAAY,CAAC;KACtB;IACD,SAAS,EAAE;QACT,OAAO,EAAE,IAAI;QACb,KAAK,EAAE,MAAM;QACb,QAAQ,EAAE,EAAE;QACZ,SAAS,EAAE,GAAG;QACd,MAAM,EAAE,MAAM;QACd,KAAK,EAAE,CAAC,qBAAqB,CAAC;KAC/B;CACF,CAAA;AAED,MAAM,CAAC,OAAO,OAAO,oBAAoB;IACvC,OAAO,CAA0B;IAEjC,YAAY,MAAyB;QACnC,IAAI,CAAC,OAAO,GAAG;YACb,IAAI,EAAE,EAAE,GAAG,cAAc,CAAC,IAAI,EAAE,GAAG,MAAM,EAAE,IAAI,EAAE;YACjD,IAAI,EAAE,EAAE,GAAG,cAAc,CAAC,IAAI,EAAE,GAAG,MAAM,EAAE,IAAI,EAAE;YACjD,GAAG,EAAE,EAAE,GAAG,cAAc,CAAC,GAAG,EAAE,GAAG,MAAM,EAAE,GAAG,EAAE;YAC9C,SAAS,EAAE,EAAE,GAAG,cAAc,CAAC,SAAS,EAAE,GAAG,MAAM,EAAE,SAAS,EAAE;SACjE,CAAA;IACH,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,GAAgB,EAAE,IAAyB;QACtD,MAAM,WAAW,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,CAAA;QAC5D,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,EAAE,CAAA;QAEjC,aAAa;QACb,IAAI,MAAM,CAAC,UAAU,CAAC,OAAO,EAAE,MAAM,CAAC,GAAG,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC,EAAE,CAAC;YAChF,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBAC5B,KAAK,EAAE,EAAE,IAAI,EAAE,4BAA4B,EAAE,OAAO,EAAE,iCAAiC,EAAE;aAC1F,CAAC,CAAA;YACF,OAAM;QACR,CAAC;QAED,OAAO;QACP,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,IAAI,WAAW,CAAC,WAAW,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YACnF,mDAAmD;QACrD,CAAC;QAED,mBAAmB;QACnB,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,IAAI,WAAW,CAAC,WAAW,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YACnF,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC,mBAAmB,CAAC,OAAO,CAAC,CAAC,CAAA;QACzD,CAAC;QAED,kEAAkE;QAClE,uEAAuE;QACvE,2EAA2E;QAC3E,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,IAAI,WAAW,CAAC,WAAW,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;YACjF,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAA;QAC/C,CAAC;QAED,oEAAoE;QACpE,0EAA0E;QAC1E,sEAAsE;QACtE,IAAI,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,OAAO,IAAI,WAAW,CAAC,WAAW,EAAE,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC;YAC7F,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC,SAAS,EAAE,CAAA;YACvC,IAAI,OAAO,EAAE,CAAC;gBACZ,IAAI,IAAI,CAAC,gBAAgB,CAAC,GAAG,EAAE,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,MAAM,CAAC;oBAAE,OAAM;gBACrE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,uBAAuB,CAAC,OAAO,CAAC,CAAA;gBAC1D,yEAAyE;gBACzE,oEAAoE;gBACpE,+DAA+D;gBAC/D,MAAM,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,CAAA;gBACzD,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,CAAA;gBACjC,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAA;YAC7B,CAAC;QACH,CAAC;QAED,MAAM,IAAI,EAAE,CAAA;IACd,CAAC;IAED,SAAS,CAAC,WAAmB;QAC3B,IAAI,WAAW,CAAC,WAAW,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAA;QACrF,IAAI,WAAW,CAAC,WAAW,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAA;QACrF,IAAI,WAAW,CAAC,WAAW,EAAE,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,KAAK,CAAA;QAC/F,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAA;IAC/B,CAAC;IAED,gGAAgG;IAChG,gBAAgB,CACd,GAAgB,EAChB,KAA8B,EAC9B,MAAsB;QAEtB,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAA;QAClC,MAAM,QAAQ,GAAG,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;QAErC,IAAI,MAAM,CAAC,MAAM,GAAG,GAAG,CAAC,SAAS,EAAE,CAAC;YAClC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBAC5B,KAAK,EAAE;oBACL,IAAI,EAAE,mBAAmB;oBACzB,OAAO,EAAE,6BAA6B,GAAG,CAAC,SAAS,GAAG;iBACvD;aACF,CAAC,CAAA;YACF,OAAO,IAAI,CAAA;QACb,CAAC;QAED,IAAI,KAAK,CAAC,MAAM,GAAG,GAAG,CAAC,QAAQ,EAAE,CAAC;YAChC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBAC5B,KAAK,EAAE,EAAE,IAAI,EAAE,kBAAkB,EAAE,OAAO,EAAE,4BAA4B,GAAG,CAAC,QAAQ,GAAG,EAAE;aAC1F,CAAC,CAAA;YACF,OAAO,IAAI,CAAA;QACb,CAAC;QAED,MAAM,UAAU,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAA;QAC5D,IAAI,UAAU,GAAG,QAAQ,EAAE,CAAC;YAC1B,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBAC5B,KAAK,EAAE,EAAE,IAAI,EAAE,4BAA4B,EAAE,OAAO,EAAE,2BAA2B,EAAE;aACpF,CAAC,CAAA;YACF,OAAO,IAAI,CAAA;QACb,CAAC;QAED,OAAO,KAAK,CAAA;IACd,CAAC;CACF;AAED,SAAS,WAAW,CAAC,WAAmB,EAAE,KAAe;IACvD,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAA;AACnD,CAAC;AAED,SAAS,mBAAmB,CAAC,IAAY;IACvC,MAAM,MAAM,GAA4B,EAAE,CAAA;IAC1C,IAAI,CAAC,IAAI;QAAE,OAAO,MAAM,CAAA;IACxB,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACnC,IAAI,CAAC,IAAI;YAAE,SAAQ;QACnB,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;QAC/B,IAAI,KAAK,KAAK,CAAC,CAAC,EAAE,CAAC;YACjB,MAAM,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,CAAA;QACxC,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,GAAG,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAA;QAChG,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAA;AACf,CAAC;AAED,gFAAgF;AAChF,4EAA4E;AAC5E,+EAA+E;AAC/E,EAAE;AACF,mEAAmE;AACnE,gFAAgF;AAChF,6EAA6E;AAC7E,aAAa;AACb,SAAS,mBAAmB,CAAC,KAAa;IACxC,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAA;IACxC,IAAI,CAAC;QACH,OAAO,kBAAkB,CAAC,MAAM,CAAC,CAAA;IACnC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,MAAM,CAAA;IACf,CAAC;AACH,CAAC"}
|
|
@@ -14,9 +14,11 @@ export declare class MultipartFile {
|
|
|
14
14
|
#private;
|
|
15
15
|
/** Original filename from the client. */
|
|
16
16
|
readonly clientName: string;
|
|
17
|
-
/**
|
|
18
|
-
|
|
19
|
-
|
|
17
|
+
/**
|
|
18
|
+
* MIME type from the Content-Type header. ATTACKER-CONTROLLED — never trust it
|
|
19
|
+
* for security decisions or as a response Content-Type. Prefer
|
|
20
|
+
* {@link detectedType}, which is fingerprinted from the file's magic bytes.
|
|
21
|
+
*/
|
|
20
22
|
readonly type: string;
|
|
21
23
|
/** File size in bytes. */
|
|
22
24
|
readonly size: number;
|
|
@@ -32,6 +34,25 @@ export declare class MultipartFile {
|
|
|
32
34
|
type: string;
|
|
33
35
|
content: Buffer;
|
|
34
36
|
});
|
|
37
|
+
/**
|
|
38
|
+
* Fingerprint the real file type from its magic bytes (via `file-type`), so
|
|
39
|
+
* validation + storage don't trust the attacker-controlled filename/header.
|
|
40
|
+
* Mirrors AdonisJS, which detects binary types this way. Call once after
|
|
41
|
+
* construction (the BodyParser middleware does this for every uploaded file).
|
|
42
|
+
* Content `file-type` can't fingerprint (text formats) leaves the client
|
|
43
|
+
* extension in force — same fallback AdonisJS uses.
|
|
44
|
+
*/
|
|
45
|
+
detectType(): Promise<void>;
|
|
46
|
+
/**
|
|
47
|
+
* Magic-byte-detected MIME type — TRUSTWORTHY (content-derived). `undefined`
|
|
48
|
+
* for text formats `file-type` can't fingerprint. Use this, not {@link type}.
|
|
49
|
+
*/
|
|
50
|
+
get detectedType(): string | undefined;
|
|
51
|
+
/**
|
|
52
|
+
* File extension without the dot — the magic-byte-detected one when available
|
|
53
|
+
* (defeats a renamed binary), else the client filename's extension.
|
|
54
|
+
*/
|
|
55
|
+
get extname(): string;
|
|
35
56
|
/** Validate file against size and extension rules. */
|
|
36
57
|
validate(options: FileValidationOptions): boolean;
|
|
37
58
|
get isValid(): boolean;
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"MultipartFile.d.ts","sourceRoot":"","sources":["../../src/bodyparser/MultipartFile.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAGH,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAA;AAEtC,MAAM,WAAW,qBAAqB;IACpC,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAA;CACpB;AAED,qBAAa,aAAa;;IACxB,yCAAyC;IACzC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAE3B
|
|
1
|
+
{"version":3,"file":"MultipartFile.d.ts","sourceRoot":"","sources":["../../src/bodyparser/MultipartFile.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAGH,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAA;AAEtC,MAAM,WAAW,qBAAqB;IACpC,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAA;CACpB;AAED,qBAAa,aAAa;;IACxB,yCAAyC;IACzC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAE3B;;;;OAIG;IACH,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IAErB,0BAA0B;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IAErB,kCAAkC;IAClC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IAExB,8BAA8B;IAC9B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAE1B,yBAAyB;IACzB,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,CAAK;gBAWlB,OAAO,EAAE;QACnB,SAAS,EAAE,MAAM,CAAA;QACjB,UAAU,EAAE,MAAM,CAAA;QAClB,IAAI,EAAE,MAAM,CAAA;QACZ,OAAO,EAAE,MAAM,CAAA;KAChB;IAUD;;;;;;;OAOG;IACG,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IAMjC;;;OAGG;IACH,IAAI,YAAY,IAAI,MAAM,GAAG,SAAS,CAErC;IAED;;;OAGG;IACH,IAAI,OAAO,IAAI,MAAM,CAEpB;IAED,sDAAsD;IACtD,QAAQ,CAAC,OAAO,EAAE,qBAAqB,GAAG,OAAO;IAmBjD,IAAI,OAAO,IAAI,OAAO,CAErB;IAED;;;;;;OAMG;IACG,UAAU,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IA2BnE,IAAI,OAAO,IAAI,OAAO,CAErB;IAED;;;;;OAKG;IACH,MAAM,IAAI,QAAQ;CAGnB;AAyBD;;;;;GAKG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,EAAE;IAC/C,MAAM,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IAC9C,KAAK,EAAE,KAAK,CAAC;QACX,SAAS,EAAE,MAAM,CAAA;QACjB,UAAU,EAAE,MAAM,CAAA;QAClB,WAAW,EAAE,MAAM,CAAA;QACnB,IAAI,EAAE,MAAM,CAAA;QACZ,UAAU,EAAE,MAAM,CAAA;KACnB,CAAC,CAAA;CACH,GAAG;IAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAAC,KAAK,EAAE,aAAa,EAAE,CAAA;CAAE,CAe7D"}
|
|
@@ -10,9 +10,11 @@ import { Readable } from 'node:stream';
|
|
|
10
10
|
export class MultipartFile {
|
|
11
11
|
/** Original filename from the client. */
|
|
12
12
|
clientName;
|
|
13
|
-
/**
|
|
14
|
-
|
|
15
|
-
|
|
13
|
+
/**
|
|
14
|
+
* MIME type from the Content-Type header. ATTACKER-CONTROLLED — never trust it
|
|
15
|
+
* for security decisions or as a response Content-Type. Prefer
|
|
16
|
+
* {@link detectedType}, which is fingerprinted from the file's magic bytes.
|
|
17
|
+
*/
|
|
16
18
|
type;
|
|
17
19
|
/** File size in bytes. */
|
|
18
20
|
size;
|
|
@@ -24,6 +26,10 @@ export class MultipartFile {
|
|
|
24
26
|
errors = [];
|
|
25
27
|
/** Whether the file has been moved. */
|
|
26
28
|
#moved = false;
|
|
29
|
+
/** Extension derived from the (attacker-controlled) client filename. */
|
|
30
|
+
#clientExtname;
|
|
31
|
+
/** Magic-byte fingerprint — set by {@link detectType}; absent for content `file-type` can't detect (text: txt/csv/svg/json). */
|
|
32
|
+
#detected;
|
|
27
33
|
constructor(options) {
|
|
28
34
|
this.fieldName = options.fieldName;
|
|
29
35
|
this.clientName = options.clientName;
|
|
@@ -31,7 +37,35 @@ export class MultipartFile {
|
|
|
31
37
|
this.content = options.content;
|
|
32
38
|
this.size = options.content.length;
|
|
33
39
|
const segments = options.clientName.split('.');
|
|
34
|
-
this
|
|
40
|
+
this.#clientExtname = segments.length > 1 ? (segments.at(-1) ?? '').toLowerCase() : '';
|
|
41
|
+
}
|
|
42
|
+
/**
|
|
43
|
+
* Fingerprint the real file type from its magic bytes (via `file-type`), so
|
|
44
|
+
* validation + storage don't trust the attacker-controlled filename/header.
|
|
45
|
+
* Mirrors AdonisJS, which detects binary types this way. Call once after
|
|
46
|
+
* construction (the BodyParser middleware does this for every uploaded file).
|
|
47
|
+
* Content `file-type` can't fingerprint (text formats) leaves the client
|
|
48
|
+
* extension in force — same fallback AdonisJS uses.
|
|
49
|
+
*/
|
|
50
|
+
async detectType() {
|
|
51
|
+
const { fileTypeFromBuffer } = await import('file-type');
|
|
52
|
+
const result = await fileTypeFromBuffer(this.content);
|
|
53
|
+
if (result)
|
|
54
|
+
this.#detected = { ext: result.ext, mime: result.mime };
|
|
55
|
+
}
|
|
56
|
+
/**
|
|
57
|
+
* Magic-byte-detected MIME type — TRUSTWORTHY (content-derived). `undefined`
|
|
58
|
+
* for text formats `file-type` can't fingerprint. Use this, not {@link type}.
|
|
59
|
+
*/
|
|
60
|
+
get detectedType() {
|
|
61
|
+
return this.#detected?.mime;
|
|
62
|
+
}
|
|
63
|
+
/**
|
|
64
|
+
* File extension without the dot — the magic-byte-detected one when available
|
|
65
|
+
* (defeats a renamed binary), else the client filename's extension.
|
|
66
|
+
*/
|
|
67
|
+
get extname() {
|
|
68
|
+
return this.#detected?.ext ?? this.#clientExtname;
|
|
35
69
|
}
|
|
36
70
|
/** Validate file against size and extension rules. */
|
|
37
71
|
validate(options) {
|
|
@@ -42,6 +76,8 @@ export class MultipartFile {
|
|
|
42
76
|
}
|
|
43
77
|
}
|
|
44
78
|
if (options.extnames && options.extnames.length > 0) {
|
|
79
|
+
// `this.extname` is the magic-byte-detected extension when available, so a
|
|
80
|
+
// binary renamed `evil.png` is validated by its real type, not its name.
|
|
45
81
|
if (!options.extnames.includes(this.extname)) {
|
|
46
82
|
this.errors.push(`Extension '${this.extname}' not allowed. Allowed: ${options.extnames.join(', ')}`);
|
|
47
83
|
}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"MultipartFile.js","sourceRoot":"","sources":["../../src/bodyparser/MultipartFile.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AACzC,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAA;AAOtC,MAAM,OAAO,aAAa;IACxB,yCAAyC;IAChC,UAAU,CAAQ;IAE3B
|
|
1
|
+
{"version":3,"file":"MultipartFile.js","sourceRoot":"","sources":["../../src/bodyparser/MultipartFile.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AACzC,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAA;AAOtC,MAAM,OAAO,aAAa;IACxB,yCAAyC;IAChC,UAAU,CAAQ;IAE3B;;;;OAIG;IACM,IAAI,CAAQ;IAErB,0BAA0B;IACjB,IAAI,CAAQ;IAErB,kCAAkC;IACzB,OAAO,CAAQ;IAExB,8BAA8B;IACrB,SAAS,CAAQ;IAE1B,yBAAyB;IAChB,MAAM,GAAa,EAAE,CAAA;IAE9B,uCAAuC;IACvC,MAAM,GAAG,KAAK,CAAA;IAEd,wEAAwE;IACxE,cAAc,CAAQ;IAEtB,gIAAgI;IAChI,SAAS,CAAgC;IAEzC,YAAY,OAKX;QACC,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,CAAA;QAClC,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,CAAA;QACpC,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,CAAA;QACxB,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,CAAA;QAC9B,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,CAAA;QAClC,MAAM,QAAQ,GAAG,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QAC9C,IAAI,CAAC,cAAc,GAAG,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAA;IACxF,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,UAAU;QACd,MAAM,EAAE,kBAAkB,EAAE,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,CAAA;QACxD,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;QACrD,IAAI,MAAM;YAAE,IAAI,CAAC,SAAS,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAA;IACrE,CAAC;IAED;;;OAGG;IACH,IAAI,YAAY;QACd,OAAO,IAAI,CAAC,SAAS,EAAE,IAAI,CAAA;IAC7B,CAAC;IAED;;;OAGG;IACH,IAAI,OAAO;QACT,OAAO,IAAI,CAAC,SAAS,EAAE,GAAG,IAAI,IAAI,CAAC,cAAc,CAAA;IACnD,CAAC;IAED,sDAAsD;IACtD,QAAQ,CAAC,OAA8B;QACrC,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;YACjB,MAAM,QAAQ,GAAG,aAAa,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;YAC5C,IAAI,IAAI,CAAC,IAAI,GAAG,QAAQ,EAAE,CAAC;gBACzB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,aAAa,IAAI,CAAC,IAAI,kBAAkB,OAAO,CAAC,IAAI,EAAE,CAAC,CAAA;YAC1E,CAAC;QACH,CAAC;QACD,IAAI,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACpD,2EAA2E;YAC3E,yEAAyE;YACzE,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC7C,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,cAAc,IAAI,CAAC,OAAO,2BAA2B,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACnF,CAAA;YACH,CAAC;QACH,CAAC;QACD,OAAO,IAAI,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,CAAA;IACjC,CAAC;IAED,IAAI,OAAO;QACT,OAAO,IAAI,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,CAAA;IACjC,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,UAAU,CAAC,SAAiB,EAAE,IAAa;QAC/C,MAAM,EAAE,SAAS,EAAE,aAAa,EAAE,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,CAAA;QAC5D,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,CAAA;QAE1C,IAAI,IAAI,KAAK,SAAS,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,EAAE,CAAC;YAChD,MAAM,IAAI,KAAK,CACb,sGAAsG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAC7H,CAAA;QACH,CAAC;QAED,SAAS,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;QACzC,MAAM,QAAQ,GAAG,IAAI,IAAI,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAA;QAC7E,uEAAuE;QACvE,sEAAsE;QACtE,sEAAsE;QACtE,sDAAsD;QACtD,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC9B,MAAM,IAAI,KAAK,CACb,+CAA+C,QAAQ,wEAAwE,CAChI,CAAA;QACH,CAAC;QACD,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAA;QAC1C,aAAa,CAAC,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,CAAA;QACrC,IAAI,CAAC,MAAM,GAAG,IAAI,CAAA;QAClB,OAAO,QAAQ,CAAA;IACjB,CAAC;IAED,IAAI,OAAO;QACT,OAAO,IAAI,CAAC,MAAM,CAAA;IACpB,CAAC;IAED;;;;;OAKG;IACH,MAAM;QACJ,OAAO,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,CAAA;IAC3D,CAAC;CACF;AAED,SAAS,cAAc,CAAC,IAAY;IAClC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAA;IACnC,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,KAAK,CAAA;IAC/C,IAAI,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAA;IACtC,OAAO,IAAI,CAAA;AACb,CAAC;AAED,SAAS,aAAa,CAAC,IAAY;IACjC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAA;IAC/C,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,GAAG,IAAI,CAAA;IAC9B,MAAM,GAAG,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;IAClC,QAAQ,KAAK,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,EAAE,CAAC;QAChC,KAAK,IAAI;YACP,OAAO,GAAG,GAAG,IAAI,CAAA;QACnB,KAAK,IAAI;YACP,OAAO,GAAG,GAAG,IAAI,GAAG,IAAI,CAAA;QAC1B,KAAK,IAAI;YACP,OAAO,GAAG,GAAG,IAAI,GAAG,IAAI,GAAG,IAAI,CAAA;QACjC;YACE,OAAO,GAAG,CAAA;IACd,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,uBAAuB,CAAC,OASvC;IACC,MAAM,MAAM,GAA2B,EAAE,CAAA;IACzC,KAAK,MAAM,KAAK,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;QACnC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,KAAK,CAAA;IAClC,CAAC;IACD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAC7B,CAAC,CAAC,EAAE,EAAE,CACJ,IAAI,aAAa,CAAC;QAChB,SAAS,EAAE,CAAC,CAAC,SAAS;QACtB,UAAU,EAAE,CAAC,CAAC,UAAU;QACxB,IAAI,EAAE,CAAC,CAAC,WAAW;QACnB,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,EAAE,QAAQ,CAAC;KAC7C,CAAC,CACL,CAAA;IACD,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAA;AAC1B,CAAC"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"RpcRouter.d.ts","sourceRoot":"","sources":["../../src/rpc/RpcRouter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAA;AAIzD,MAAM,MAAM,UAAU,GAAG,CAAC,GAAG,EAAE,WAAW,EAAE,MAAM,EAAE,OAAO,KAAK,OAAO,CAAC,OAAO,CAAC,GAAG,OAAO,CAAA;AAE1F;;;GAGG;AACH,UAAU,YAAY;IACpB,IAAI,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,GAAG,CAAC,CAAA;IACjD,OAAO,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,GAAG,CAAC,CAAA;IAC5B,GAAG,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAA;CAC5B;AAED,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,MAAM,CAAA;IACZ,OAAO,EAAE,UAAU,CAAA;IACnB,MAAM,EAAE,MAAM,EAAE,CAAA;IAChB,KAAK,EAAE,MAAM,EAAE,CAAA;IACf,WAAW,EAAE,MAAM,EAAE,CAAA;IACrB,UAAU,EAAE,MAAM,EAAE,CAAA;IACpB,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB;AAED,qBAAa,gBAAgB;;gBAGf,GAAG,EAAE,mBAAmB;IAIpC,KAAK,CAAC,GAAG,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI;IAKhC,IAAI,CAAC,GAAG,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI;IAK9B,UAAU,CAAC,GAAG,WAAW,EAAE,MAAM,EAAE,GAAG,IAAI;IAK1C,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI;IAKjC,UAAU,CAAC,GAAG,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI;CAIrC;
|
|
1
|
+
{"version":3,"file":"RpcRouter.d.ts","sourceRoot":"","sources":["../../src/rpc/RpcRouter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAA;AAIzD,MAAM,MAAM,UAAU,GAAG,CAAC,GAAG,EAAE,WAAW,EAAE,MAAM,EAAE,OAAO,KAAK,OAAO,CAAC,OAAO,CAAC,GAAG,OAAO,CAAA;AAE1F;;;GAGG;AACH,UAAU,YAAY;IACpB,IAAI,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,GAAG,CAAC,CAAA;IACjD,OAAO,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,GAAG,CAAC,CAAA;IAC5B,GAAG,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAA;CAC5B;AAED,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,MAAM,CAAA;IACZ,OAAO,EAAE,UAAU,CAAA;IACnB,MAAM,EAAE,MAAM,EAAE,CAAA;IAChB,KAAK,EAAE,MAAM,EAAE,CAAA;IACf,WAAW,EAAE,MAAM,EAAE,CAAA;IACrB,UAAU,EAAE,MAAM,EAAE,CAAA;IACpB,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB;AAED,qBAAa,gBAAgB;;gBAGf,GAAG,EAAE,mBAAmB;IAIpC,KAAK,CAAC,GAAG,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI;IAKhC,IAAI,CAAC,GAAG,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI;IAK9B,UAAU,CAAC,GAAG,WAAW,EAAE,MAAM,EAAE,GAAG,IAAI;IAK1C,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI;IAKjC,UAAU,CAAC,GAAG,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI;CAIrC;AAqGD,qBAAa,SAAS;;IAKpB;;;;;OAKG;IACH,YAAY,CAAC,SAAS,EAAE,YAAY,GAAG,IAAI;IAI3C,8BAA8B;IAC9B,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,UAAU,GAAG,gBAAgB;IAa3D,8EAA8E;IAC9E,SAAS,CACP,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,KAAK,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,OAAO,CAAC,GACtF,IAAI;IAeP,mDAAmD;IACnD,KAAK,CACH,MAAM,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,EACpE,QAAQ,EAAE,CAAC,GAAG,EAAE,SAAS,KAAK,IAAI,GACjC,IAAI;IAgBP,2CAA2C;IACrC,MAAM,CAAC,GAAG,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC;IAkH7C,uCAAuC;IACvC,UAAU,IAAI,MAAM,EAAE;IAItB,+CAA+C;IAC/C,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,mBAAmB,GAAG,SAAS;CAGzD"}
|
package/dist/rpc/RpcRouter.js
CHANGED
|
@@ -37,6 +37,20 @@ export class RpcMethodBuilder {
|
|
|
37
37
|
return this;
|
|
38
38
|
}
|
|
39
39
|
}
|
|
40
|
+
/**
|
|
41
|
+
* Unwrap the `{ _body: [...] }` envelope `request.body()` puts around a
|
|
42
|
+
* top-level JSON array (it only treats plain objects as the body verbatim). A
|
|
43
|
+
* JSON-RPC batch arrives this way; a single request is a plain object and is
|
|
44
|
+
* returned unchanged.
|
|
45
|
+
*/
|
|
46
|
+
function unwrapBatchBody(value) {
|
|
47
|
+
if (typeof value === 'object' && value !== null && '_body' in value) {
|
|
48
|
+
const inner = value._body;
|
|
49
|
+
if (Array.isArray(inner))
|
|
50
|
+
return inner;
|
|
51
|
+
}
|
|
52
|
+
return value;
|
|
53
|
+
}
|
|
40
54
|
/** Build a JSON-RPC 2.0 error envelope. */
|
|
41
55
|
function rpcError(code, message, id, data) {
|
|
42
56
|
return {
|
|
@@ -159,7 +173,10 @@ export class RpcRouter {
|
|
|
159
173
|
}
|
|
160
174
|
/** Handle an incoming JSON-RPC request. */
|
|
161
175
|
async handle(ctx) {
|
|
162
|
-
|
|
176
|
+
// `request.body()` wraps a top-level JSON array — a JSON-RPC batch — as its
|
|
177
|
+
// non-object envelope `{ _body: [...] }`. Unwrap it so batch detection works;
|
|
178
|
+
// a single request is a plain object and passes through untouched.
|
|
179
|
+
const body = unwrapBatchBody(ctx.request.body());
|
|
163
180
|
// Batch support (max 50 to prevent DoS)
|
|
164
181
|
if (Array.isArray(body)) {
|
|
165
182
|
if (body.length > 50) {
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"RpcRouter.js","sourceRoot":"","sources":["../../src/rpc/RpcRouter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAIH,OAAO,EAAE,OAAO,EAAE,MAAM,2BAA2B,CAAA;AAwBnD,MAAM,OAAO,gBAAgB;IAC3B,IAAI,CAAqB;IAEzB,YAAY,GAAwB;QAClC,IAAI,CAAC,IAAI,GAAG,GAAG,CAAA;IACjB,CAAC;IAED,KAAK,CAAC,GAAG,MAAgB;QACvB,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,CAAA;QAChC,OAAO,IAAI,CAAA;IACb,CAAC;IAED,IAAI,CAAC,GAAG,KAAe;QACrB,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,CAAA;QAC9B,OAAO,IAAI,CAAA;IACb,CAAC;IAED,UAAU,CAAC,GAAG,WAAqB;QACjC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,GAAG,WAAW,CAAC,CAAA;QAC1C,OAAO,IAAI,CAAA;IACb,CAAC;IAED,QAAQ,CAAC,SAAiB;QACxB,IAAI,CAAC,IAAI,CAAC,SAAS,GAAG,SAAS,CAAA;QAC/B,OAAO,IAAI,CAAA;IACb,CAAC;IAED,UAAU,CAAC,GAAG,KAAe;QAC3B,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,CAAA;QACnC,OAAO,IAAI,CAAA;IACb,CAAC;CACF;AAQD,2CAA2C;AAC3C,SAAS,QAAQ,CAAC,IAAY,EAAE,OAAe,EAAE,EAAW,EAAE,IAAc;IAC1E,OAAO;QACL,OAAO,EAAE,KAAK;QACd,KAAK,EAAE,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE;QACvE,EAAE;KACH,CAAA;AACH,CAAC;AAMD,mEAAmE;AACnE,SAAS,eAAe,CAAC,OAAgB;IACvC,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;QAC5C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC,KAAK,EAAE,iBAAiB,EAAE,IAAI,CAAC,EAAE,CAAA;IAC3E,CAAC;IACD,sEAAsE;IACtE,MAAM,OAAO,GACX,SAAS,IAAI,OAAO,IAAI,OAAO,OAAO,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAA;IAC3F,MAAM,MAAM,GACV,QAAQ,IAAI,OAAO,IAAI,OAAO,OAAO,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAA;IACxF,MAAM,MAAM,GAAG,QAAQ,IAAI,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAA;IAC/D,MAAM,EAAE,GAAG,IAAI,IAAI,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAA;IACnD,IAAI,OAAO,KAAK,KAAK,IAAI,CAAC,MAAM,EAAE,CAAC;QACjC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC,KAAK,EAAE,iBAAiB,EAAE,EAAE,IAAI,IAAI,CAAC,EAAE,CAAA;IACjF,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,CAAA;AACzC,CAAC;AAED;;;;;GAKG;AACH,SAAS,cAAc,CAAC,OAAgB;IACtC,OAAO,CACL,CAAC,CAAC,OAAO;QACT,OAAO,OAAO,KAAK,QAAQ;QAC3B,SAAS,IAAI,OAAO;QACpB,OAAO,CAAC,OAAO,KAAK,KAAK;QACzB,QAAQ,IAAI,OAAO;QACnB,OAAO,OAAO,CAAC,MAAM,KAAK,QAAQ;QAClC,CAAC,CAAC,IAAI,IAAI,OAAO,CAAC,CACnB,CAAA;AACH,CAAC;AAED;;;;GAIG;AACH,SAAS,qBAAqB,CAC5B,GAAgB,EAChB,GAAwB;IAExB,MAAM,SAAS,GAAG,GAAG,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,GAAG,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,CAAA;IAC7F,IAAI,SAAS,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,aAAa,EAAE,CAAC;QAC1C,OAAO,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,cAAc,EAAE,CAAA;IAClD,CAAC;IACD,IAAI,GAAG,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACzB,4EAA4E;QAC5E,iFAAiF;QACjF,MAAM,SAAS,GAAG,GAAG,CAAC,IAAI,EAAE,KAAK,IAAI,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,IAAI,EAAE,CAAA;QAChE,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAC1D,OAAO,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,mBAAmB,EAAE,CAAA;QACvD,CAAC;IACH,CAAC;IACD,IAAI,GAAG,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC/B,MAAM,SAAS,GAAG,GAAG,CAAC,IAAI,EAAE,WAAW,IAAI,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,WAAW,IAAI,EAAE,CAAA;QAC5E,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACjE,OAAO,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,0BAA0B,EAAE,CAAA;QAC9D,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAA;AAClB,CAAC;AAED,MAAM,OAAO,SAAS;IACpB,QAAQ,GAAqC,IAAI,GAAG,EAAE,CAAA;IACtD,YAAY,GAAuE,IAAI,CAAA;IACvF,UAAU,CAAe;IAEzB;;;;;OAKG;IACH,YAAY,CAAC,SAAuB;QAClC,IAAI,CAAC,UAAU,GAAG,SAAS,CAAA;IAC7B,CAAC;IAED,8BAA8B;IAC9B,MAAM,CAAC,IAAY,EAAE,OAAmB;QACtC,MAAM,GAAG,GAAwB;YAC/B,IAAI;YACJ,OAAO;YACP,MAAM,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,YAAY,EAAE,MAAM,IAAI,EAAE,CAAC,CAAC;YAC9C,KAAK,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,YAAY,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC;YAC5C,WAAW,EAAE,EAAE;YACf,UAAU,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,YAAY,EAAE,UAAU,IAAI,EAAE,CAAC,CAAC;SACvD,CAAA;QACD,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,CAAA;QAC5B,OAAO,IAAI,gBAAgB,CAAC,GAAG,CAAC,CAAA;IAClC,CAAC;IAED,8EAA8E;IAC9E,SAAS,CACP,MAAc,EACd,UAAuF;QAEvF,MAAM,KAAK,GAAG,UAAU,CAAC,SAAS,CAAA;QAClC,MAAM,OAAO,GAAG,MAAM,CAAC,mBAAmB,CAAC,KAAK,CAAC,CAAC,MAAM,CACtD,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,aAAa,IAAI,OAAO,KAAK,CAAC,CAAC,CAAC,KAAK,UAAU,CAC7D,CAAA;QACD,KAAK,MAAM,UAAU,IAAI,OAAO,EAAE,CAAC;YACjC,IAAI,CAAC,MAAM,CAAC,GAAG,MAAM,IAAI,UAAU,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE;gBAC3D,qEAAqE;gBACrE,gEAAgE;gBAChE,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,UAAU,EAAE,CAAA;gBACtF,OAAO,QAAQ,CAAC,UAAU,CAAC,CAAC,GAAG,EAAE,MAAM,CAAC,CAAA;YAC1C,CAAC,CAAC,CAAA;QACJ,CAAC;IACH,CAAC;IAED,mDAAmD;IACnD,KAAK,CACH,MAAoE,EACpE,QAAkC;QAElC,MAAM,UAAU,GAAG,IAAI,CAAC,YAAY,CAAA;QACpC,IAAI,CAAC,YAAY,GAAG;YAClB,MAAM,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YAC3E,KAAK,EAAE,EAAE;YACT,UAAU,EAAE,MAAM,CAAC,UAAU,IAAI,EAAE;SACpC,CAAA;QACD,2EAA2E;QAC3E,2EAA2E;QAC3E,IAAI,CAAC;YACH,QAAQ,CAAC,IAAI,CAAC,CAAA;QAChB,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC,YAAY,GAAG,UAAU,CAAA;QAChC,CAAC;IACH,CAAC;IAED,2CAA2C;IAC3C,KAAK,CAAC,MAAM,CAAC,GAAgB;QAC3B,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAA;
|
|
1
|
+
{"version":3,"file":"RpcRouter.js","sourceRoot":"","sources":["../../src/rpc/RpcRouter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAIH,OAAO,EAAE,OAAO,EAAE,MAAM,2BAA2B,CAAA;AAwBnD,MAAM,OAAO,gBAAgB;IAC3B,IAAI,CAAqB;IAEzB,YAAY,GAAwB;QAClC,IAAI,CAAC,IAAI,GAAG,GAAG,CAAA;IACjB,CAAC;IAED,KAAK,CAAC,GAAG,MAAgB;QACvB,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,CAAA;QAChC,OAAO,IAAI,CAAA;IACb,CAAC;IAED,IAAI,CAAC,GAAG,KAAe;QACrB,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,CAAA;QAC9B,OAAO,IAAI,CAAA;IACb,CAAC;IAED,UAAU,CAAC,GAAG,WAAqB;QACjC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,GAAG,WAAW,CAAC,CAAA;QAC1C,OAAO,IAAI,CAAA;IACb,CAAC;IAED,QAAQ,CAAC,SAAiB;QACxB,IAAI,CAAC,IAAI,CAAC,SAAS,GAAG,SAAS,CAAA;QAC/B,OAAO,IAAI,CAAA;IACb,CAAC;IAED,UAAU,CAAC,GAAG,KAAe;QAC3B,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,CAAA;QACnC,OAAO,IAAI,CAAA;IACb,CAAC;CACF;AAQD;;;;;GAKG;AACH,SAAS,eAAe,CAAC,KAAc;IACrC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,EAAE,CAAC;QACpE,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAA;QACzB,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;YAAE,OAAO,KAAK,CAAA;IACxC,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAED,2CAA2C;AAC3C,SAAS,QAAQ,CAAC,IAAY,EAAE,OAAe,EAAE,EAAW,EAAE,IAAc;IAC1E,OAAO;QACL,OAAO,EAAE,KAAK;QACd,KAAK,EAAE,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE;QACvE,EAAE;KACH,CAAA;AACH,CAAC;AAMD,mEAAmE;AACnE,SAAS,eAAe,CAAC,OAAgB;IACvC,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;QAC5C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC,KAAK,EAAE,iBAAiB,EAAE,IAAI,CAAC,EAAE,CAAA;IAC3E,CAAC;IACD,sEAAsE;IACtE,MAAM,OAAO,GACX,SAAS,IAAI,OAAO,IAAI,OAAO,OAAO,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAA;IAC3F,MAAM,MAAM,GACV,QAAQ,IAAI,OAAO,IAAI,OAAO,OAAO,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAA;IACxF,MAAM,MAAM,GAAG,QAAQ,IAAI,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAA;IAC/D,MAAM,EAAE,GAAG,IAAI,IAAI,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAA;IACnD,IAAI,OAAO,KAAK,KAAK,IAAI,CAAC,MAAM,EAAE,CAAC;QACjC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC,KAAK,EAAE,iBAAiB,EAAE,EAAE,IAAI,IAAI,CAAC,EAAE,CAAA;IACjF,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,CAAA;AACzC,CAAC;AAED;;;;;GAKG;AACH,SAAS,cAAc,CAAC,OAAgB;IACtC,OAAO,CACL,CAAC,CAAC,OAAO;QACT,OAAO,OAAO,KAAK,QAAQ;QAC3B,SAAS,IAAI,OAAO;QACpB,OAAO,CAAC,OAAO,KAAK,KAAK;QACzB,QAAQ,IAAI,OAAO;QACnB,OAAO,OAAO,CAAC,MAAM,KAAK,QAAQ;QAClC,CAAC,CAAC,IAAI,IAAI,OAAO,CAAC,CACnB,CAAA;AACH,CAAC;AAED;;;;GAIG;AACH,SAAS,qBAAqB,CAC5B,GAAgB,EAChB,GAAwB;IAExB,MAAM,SAAS,GAAG,GAAG,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,GAAG,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,CAAA;IAC7F,IAAI,SAAS,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,aAAa,EAAE,CAAC;QAC1C,OAAO,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,cAAc,EAAE,CAAA;IAClD,CAAC;IACD,IAAI,GAAG,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACzB,4EAA4E;QAC5E,iFAAiF;QACjF,MAAM,SAAS,GAAG,GAAG,CAAC,IAAI,EAAE,KAAK,IAAI,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,IAAI,EAAE,CAAA;QAChE,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAC1D,OAAO,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,mBAAmB,EAAE,CAAA;QACvD,CAAC;IACH,CAAC;IACD,IAAI,GAAG,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC/B,MAAM,SAAS,GAAG,GAAG,CAAC,IAAI,EAAE,WAAW,IAAI,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,WAAW,IAAI,EAAE,CAAA;QAC5E,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACjE,OAAO,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,0BAA0B,EAAE,CAAA;QAC9D,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAA;AAClB,CAAC;AAED,MAAM,OAAO,SAAS;IACpB,QAAQ,GAAqC,IAAI,GAAG,EAAE,CAAA;IACtD,YAAY,GAAuE,IAAI,CAAA;IACvF,UAAU,CAAe;IAEzB;;;;;OAKG;IACH,YAAY,CAAC,SAAuB;QAClC,IAAI,CAAC,UAAU,GAAG,SAAS,CAAA;IAC7B,CAAC;IAED,8BAA8B;IAC9B,MAAM,CAAC,IAAY,EAAE,OAAmB;QACtC,MAAM,GAAG,GAAwB;YAC/B,IAAI;YACJ,OAAO;YACP,MAAM,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,YAAY,EAAE,MAAM,IAAI,EAAE,CAAC,CAAC;YAC9C,KAAK,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,YAAY,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC;YAC5C,WAAW,EAAE,EAAE;YACf,UAAU,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,YAAY,EAAE,UAAU,IAAI,EAAE,CAAC,CAAC;SACvD,CAAA;QACD,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,CAAA;QAC5B,OAAO,IAAI,gBAAgB,CAAC,GAAG,CAAC,CAAA;IAClC,CAAC;IAED,8EAA8E;IAC9E,SAAS,CACP,MAAc,EACd,UAAuF;QAEvF,MAAM,KAAK,GAAG,UAAU,CAAC,SAAS,CAAA;QAClC,MAAM,OAAO,GAAG,MAAM,CAAC,mBAAmB,CAAC,KAAK,CAAC,CAAC,MAAM,CACtD,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,aAAa,IAAI,OAAO,KAAK,CAAC,CAAC,CAAC,KAAK,UAAU,CAC7D,CAAA;QACD,KAAK,MAAM,UAAU,IAAI,OAAO,EAAE,CAAC;YACjC,IAAI,CAAC,MAAM,CAAC,GAAG,MAAM,IAAI,UAAU,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE;gBAC3D,qEAAqE;gBACrE,gEAAgE;gBAChE,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,UAAU,EAAE,CAAA;gBACtF,OAAO,QAAQ,CAAC,UAAU,CAAC,CAAC,GAAG,EAAE,MAAM,CAAC,CAAA;YAC1C,CAAC,CAAC,CAAA;QACJ,CAAC;IACH,CAAC;IAED,mDAAmD;IACnD,KAAK,CACH,MAAoE,EACpE,QAAkC;QAElC,MAAM,UAAU,GAAG,IAAI,CAAC,YAAY,CAAA;QACpC,IAAI,CAAC,YAAY,GAAG;YAClB,MAAM,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YAC3E,KAAK,EAAE,EAAE;YACT,UAAU,EAAE,MAAM,CAAC,UAAU,IAAI,EAAE;SACpC,CAAA;QACD,2EAA2E;QAC3E,2EAA2E;QAC3E,IAAI,CAAC;YACH,QAAQ,CAAC,IAAI,CAAC,CAAA;QAChB,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC,YAAY,GAAG,UAAU,CAAA;QAChC,CAAC;IACH,CAAC;IAED,2CAA2C;IAC3C,KAAK,CAAC,MAAM,CAAC,GAAgB;QAC3B,4EAA4E;QAC5E,8EAA8E;QAC9E,mEAAmE;QACnE,MAAM,IAAI,GAAG,eAAe,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAA;QAEhD,wCAAwC;QACxC,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YACxB,IAAI,IAAI,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;gBACrB,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;oBAC5B,OAAO,EAAE,KAAK;oBACd,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,0BAA0B,EAAE;oBAC5D,EAAE,EAAE,IAAI;iBACT,CAAC,CAAA;gBACF,OAAM;YACR,CAAC;YACD,qFAAqF;YACrF,0EAA0E;YAC1E,+BAA+B;YAC/B,MAAM,OAAO,GAAc,EAAE,CAAA;YAC7B,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;gBACvB,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;gBAC1C,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC;oBAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;YAC3C,CAAC;YACD,wEAAwE;YACxE,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACzB,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;gBACjC,OAAM;YACR,CAAC;YACD,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;YACtC,OAAM;QACR,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;QAChD,qEAAqE;QACrE,IAAI,cAAc,CAAC,IAAI,CAAC,EAAE,CAAC;YACzB,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;YACjC,OAAM;QACR,CAAC;QACD,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;IACvC,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,cAAc,CAAC,GAAgB,EAAE,KAAe;QACpD,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,EAAE,GAAG,CAAC,YAAY,CAAC;YACjD,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAqB,YAAY,CAAC;YAC3D,CAAC,CAAC,SAAS,CAAA;QACb,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,KAAK,CACb,4CAA4C,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,uEAAuE,CACpI,CAAA;QACH,CAAC;QACD,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;YAC7B,MAAM,EAAE,GAAG,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;YAC7B,IAAI,CAAC,EAAE,EAAE,CAAC;gBACR,MAAM,IAAI,KAAK,CAAC,8CAA8C,IAAI,sBAAsB,CAAC,CAAA;YAC3F,CAAC;YACD,OAAO,EAAE,CAAA;QACX,CAAC,CAAC,CAAA;QACF,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,KAAK,IAAI,EAAE,GAAE,CAAC,CAAC,CAAA;IACzC,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,GAAgB,EAAE,OAAgB;QAClD,MAAM,MAAM,GAAG,eAAe,CAAC,OAAO,CAAC,CAAA;QACvC,IAAI,CAAC,MAAM,CAAC,EAAE;YAAE,OAAO,MAAM,CAAC,QAAQ,CAAA;QACtC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,GAAG,MAAM,CAAA;QAErC,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;QACrC,IAAI,CAAC,GAAG;YAAE,OAAO,QAAQ,CAAC,CAAC,KAAK,EAAE,kBAAkB,EAAE,EAAE,CAAC,CAAA;QAEzD,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,qBAAqB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;YAC9C,IAAI,MAAM;gBAAE,OAAO,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,OAAO,EAAE,EAAE,CAAC,CAAA;YAE5D,2EAA2E;YAC3E,0CAA0C;YAC1C,IAAI,GAAG,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC9B,MAAM,IAAI,CAAC,cAAc,CAAC,GAAG,EAAE,GAAG,CAAC,UAAU,CAAC,CAAA;YAChD,CAAC;YAED,yEAAyE;YACzE,8DAA8D;YAC9D,IAAI,eAAe,GAAG,MAAM,CAAA;YAC5B,IAAI,GAAG,CAAC,SAAS,EAAE,CAAC;gBAClB,MAAM,KAAK,GAAG,aAAa,GAAG,CAAC,SAAS,EAAE,CAAA;gBAC1C,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;oBACjC,OAAO,QAAQ,CACb,CAAC,KAAK,EACN,cAAc,GAAG,CAAC,SAAS,kDAAkD,KAAK,oBAAoB,EACtG,EAAE,CACH,CAAA;gBACH,CAAC;gBACD,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,CAAC,OAAO,CAAmB,KAAK,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;gBACjF,IAAI,CAAC,OAAO,CAAC,KAAK;oBAAE,OAAO,QAAQ,CAAC,CAAC,KAAK,EAAE,gBAAgB,EAAE,EAAE,EAAE,OAAO,CAAC,MAAM,CAAC,CAAA;gBACjF,eAAe,GAAG,OAAO,CAAC,IAAI,IAAI,MAAM,CAAA;YAC1C,CAAC;YAED,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,GAAG,EAAE,eAAe,CAAC,CAAA;YACtD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,CAAA;QACvC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,8CAA8C;YAC9C,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,CAAA;YACnD,MAAM,OAAO,GAAG,KAAK,IAAI,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,gBAAgB,CAAA;YAC9E,OAAO,QAAQ,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE,CAAC,CAAA;QACtC,CAAC;IACH,CAAC;IAED,uCAAuC;IACvC,UAAU;QACR,OAAO,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAA;IAClC,CAAC;IAED,+CAA+C;IAC/C,SAAS,CAAC,IAAY;QACpB,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;IAChC,CAAC;CACF"}
|
|
Binary file
|
|
Binary file
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@c9up/ream",
|
|
3
|
-
"version": "0.1.
|
|
3
|
+
"version": "0.1.15",
|
|
4
4
|
"description": "Ream — Rust-powered Node.js application framework",
|
|
5
5
|
"license": "MIT",
|
|
6
6
|
"type": "module",
|
|
@@ -103,13 +103,14 @@
|
|
|
103
103
|
"tsconfig.app.json"
|
|
104
104
|
],
|
|
105
105
|
"dependencies": {
|
|
106
|
+
"file-type": "^22.0.1",
|
|
106
107
|
"reflect-metadata": "^0.2"
|
|
107
108
|
},
|
|
108
109
|
"devDependencies": {
|
|
109
110
|
"@biomejs/biome": "^2.4.10",
|
|
110
111
|
"@types/node": "^22.19.15",
|
|
111
112
|
"typescript": "^6.0.2",
|
|
112
|
-
"vitest": "^4.1.
|
|
113
|
+
"vitest": "^4.1.6"
|
|
113
114
|
},
|
|
114
115
|
"engines": {
|
|
115
116
|
"node": ">=22.0.0"
|
|
Binary file
|
|
@@ -120,6 +120,10 @@ export default class BodyParserMiddleware {
|
|
|
120
120
|
if (payload) {
|
|
121
121
|
if (this.#rejectMultipart(ctx, payload.files, payload.fields)) return
|
|
122
122
|
const { fields, files } = hydrateMultipartPayload(payload)
|
|
123
|
+
// Fingerprint each file's real type from its magic bytes BEFORE handlers
|
|
124
|
+
// run, so `request.file(field, { extnames })` validates against the
|
|
125
|
+
// detected type (not the attacker-controlled filename/header).
|
|
126
|
+
await Promise.all(files.map((file) => file.detectType()))
|
|
123
127
|
ctx.request.setParsedBody(fields)
|
|
124
128
|
ctx.request.setFiles(files)
|
|
125
129
|
}
|
|
@@ -18,10 +18,11 @@ export class MultipartFile {
|
|
|
18
18
|
/** Original filename from the client. */
|
|
19
19
|
readonly clientName: string
|
|
20
20
|
|
|
21
|
-
/**
|
|
22
|
-
|
|
23
|
-
|
|
24
|
-
|
|
21
|
+
/**
|
|
22
|
+
* MIME type from the Content-Type header. ATTACKER-CONTROLLED — never trust it
|
|
23
|
+
* for security decisions or as a response Content-Type. Prefer
|
|
24
|
+
* {@link detectedType}, which is fingerprinted from the file's magic bytes.
|
|
25
|
+
*/
|
|
25
26
|
readonly type: string
|
|
26
27
|
|
|
27
28
|
/** File size in bytes. */
|
|
@@ -39,6 +40,12 @@ export class MultipartFile {
|
|
|
39
40
|
/** Whether the file has been moved. */
|
|
40
41
|
#moved = false
|
|
41
42
|
|
|
43
|
+
/** Extension derived from the (attacker-controlled) client filename. */
|
|
44
|
+
#clientExtname: string
|
|
45
|
+
|
|
46
|
+
/** Magic-byte fingerprint — set by {@link detectType}; absent for content `file-type` can't detect (text: txt/csv/svg/json). */
|
|
47
|
+
#detected?: { ext: string; mime: string }
|
|
48
|
+
|
|
42
49
|
constructor(options: {
|
|
43
50
|
fieldName: string
|
|
44
51
|
clientName: string
|
|
@@ -51,7 +58,37 @@ export class MultipartFile {
|
|
|
51
58
|
this.content = options.content
|
|
52
59
|
this.size = options.content.length
|
|
53
60
|
const segments = options.clientName.split('.')
|
|
54
|
-
this
|
|
61
|
+
this.#clientExtname = segments.length > 1 ? (segments.at(-1) ?? '').toLowerCase() : ''
|
|
62
|
+
}
|
|
63
|
+
|
|
64
|
+
/**
|
|
65
|
+
* Fingerprint the real file type from its magic bytes (via `file-type`), so
|
|
66
|
+
* validation + storage don't trust the attacker-controlled filename/header.
|
|
67
|
+
* Mirrors AdonisJS, which detects binary types this way. Call once after
|
|
68
|
+
* construction (the BodyParser middleware does this for every uploaded file).
|
|
69
|
+
* Content `file-type` can't fingerprint (text formats) leaves the client
|
|
70
|
+
* extension in force — same fallback AdonisJS uses.
|
|
71
|
+
*/
|
|
72
|
+
async detectType(): Promise<void> {
|
|
73
|
+
const { fileTypeFromBuffer } = await import('file-type')
|
|
74
|
+
const result = await fileTypeFromBuffer(this.content)
|
|
75
|
+
if (result) this.#detected = { ext: result.ext, mime: result.mime }
|
|
76
|
+
}
|
|
77
|
+
|
|
78
|
+
/**
|
|
79
|
+
* Magic-byte-detected MIME type — TRUSTWORTHY (content-derived). `undefined`
|
|
80
|
+
* for text formats `file-type` can't fingerprint. Use this, not {@link type}.
|
|
81
|
+
*/
|
|
82
|
+
get detectedType(): string | undefined {
|
|
83
|
+
return this.#detected?.mime
|
|
84
|
+
}
|
|
85
|
+
|
|
86
|
+
/**
|
|
87
|
+
* File extension without the dot — the magic-byte-detected one when available
|
|
88
|
+
* (defeats a renamed binary), else the client filename's extension.
|
|
89
|
+
*/
|
|
90
|
+
get extname(): string {
|
|
91
|
+
return this.#detected?.ext ?? this.#clientExtname
|
|
55
92
|
}
|
|
56
93
|
|
|
57
94
|
/** Validate file against size and extension rules. */
|
|
@@ -63,6 +100,8 @@ export class MultipartFile {
|
|
|
63
100
|
}
|
|
64
101
|
}
|
|
65
102
|
if (options.extnames && options.extnames.length > 0) {
|
|
103
|
+
// `this.extname` is the magic-byte-detected extension when available, so a
|
|
104
|
+
// binary renamed `evil.png` is validated by its real type, not its name.
|
|
66
105
|
if (!options.extnames.includes(this.extname)) {
|
|
67
106
|
this.errors.push(
|
|
68
107
|
`Extension '${this.extname}' not allowed. Allowed: ${options.extnames.join(', ')}`,
|
package/src/rpc/RpcRouter.ts
CHANGED
|
@@ -76,6 +76,20 @@ interface RpcErrorResponse {
|
|
|
76
76
|
id: unknown
|
|
77
77
|
}
|
|
78
78
|
|
|
79
|
+
/**
|
|
80
|
+
* Unwrap the `{ _body: [...] }` envelope `request.body()` puts around a
|
|
81
|
+
* top-level JSON array (it only treats plain objects as the body verbatim). A
|
|
82
|
+
* JSON-RPC batch arrives this way; a single request is a plain object and is
|
|
83
|
+
* returned unchanged.
|
|
84
|
+
*/
|
|
85
|
+
function unwrapBatchBody(value: unknown): unknown {
|
|
86
|
+
if (typeof value === 'object' && value !== null && '_body' in value) {
|
|
87
|
+
const inner = value._body
|
|
88
|
+
if (Array.isArray(inner)) return inner
|
|
89
|
+
}
|
|
90
|
+
return value
|
|
91
|
+
}
|
|
92
|
+
|
|
79
93
|
/** Build a JSON-RPC 2.0 error envelope. */
|
|
80
94
|
function rpcError(code: number, message: string, id: unknown, data?: unknown): RpcErrorResponse {
|
|
81
95
|
return {
|
|
@@ -225,7 +239,10 @@ export class RpcRouter {
|
|
|
225
239
|
|
|
226
240
|
/** Handle an incoming JSON-RPC request. */
|
|
227
241
|
async handle(ctx: HttpContext): Promise<void> {
|
|
228
|
-
|
|
242
|
+
// `request.body()` wraps a top-level JSON array — a JSON-RPC batch — as its
|
|
243
|
+
// non-object envelope `{ _body: [...] }`. Unwrap it so batch detection works;
|
|
244
|
+
// a single request is a plain object and passes through untouched.
|
|
245
|
+
const body = unwrapBatchBody(ctx.request.body())
|
|
229
246
|
|
|
230
247
|
// Batch support (max 50 to prevent DoS)
|
|
231
248
|
if (Array.isArray(body)) {
|