@c9up/ream 0.1.14 → 0.1.16
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/bodyparser/BodyParserMiddleware.d.ts.map +1 -1
- package/dist/bodyparser/BodyParserMiddleware.js +4 -0
- package/dist/bodyparser/BodyParserMiddleware.js.map +1 -1
- package/dist/bodyparser/MultipartFile.d.ts +24 -3
- package/dist/bodyparser/MultipartFile.d.ts.map +1 -1
- package/dist/bodyparser/MultipartFile.js +40 -4
- package/dist/bodyparser/MultipartFile.js.map +1 -1
- package/dist/rpc/RpcRouter.d.ts.map +1 -1
- package/dist/rpc/RpcRouter.js +30 -2
- package/dist/rpc/RpcRouter.js.map +1 -1
- package/events.win32-x64-msvc.node +0 -0
- package/index.win32-x64-msvc.node +0 -0
- package/package.json +11 -2
- package/scheduler.win32-x64-msvc.node +0 -0
- package/src/bodyparser/BodyParserMiddleware.ts +4 -0
- package/src/bodyparser/MultipartFile.ts +44 -5
- package/src/rpc/RpcRouter.ts +33 -2
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"BodyParserMiddleware.d.ts","sourceRoot":"","sources":["../../src/bodyparser/BodyParserMiddleware.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAA;AAIzD,MAAM,WAAW,gBAAgB;IAC/B,IAAI,CAAC,EAAE;QACL,OAAO,CAAC,EAAE,OAAO,CAAA;QACjB,KAAK,CAAC,EAAE,MAAM,CAAA;QACd,KAAK,CAAC,EAAE,MAAM,EAAE,CAAA;KACjB,CAAA;IACD,IAAI,CAAC,EAAE;QACL,OAAO,CAAC,EAAE,OAAO,CAAA;QACjB,KAAK,CAAC,EAAE,MAAM,CAAA;QACd,KAAK,CAAC,EAAE,MAAM,EAAE,CAAA;KACjB,CAAA;IACD,GAAG,CAAC,EAAE;QACJ,OAAO,CAAC,EAAE,OAAO,CAAA;QACjB,KAAK,CAAC,EAAE,MAAM,CAAA;QACd,KAAK,CAAC,EAAE,MAAM,EAAE,CAAA;KACjB,CAAA;IACD,SAAS,CAAC,EAAE;QACV,OAAO,CAAC,EAAE,OAAO,CAAA;QACjB,8EAA8E;QAC9E,KAAK,CAAC,EAAE,MAAM,CAAA;QACd,wDAAwD;QACxD,QAAQ,CAAC,EAAE,MAAM,CAAA;QACjB,SAAS,CAAC,EAAE,MAAM,CAAA;QAClB,MAAM,CAAC,EAAE,MAAM,CAAA;QACf,KAAK,CAAC,EAAE,MAAM,EAAE,CAAA;KACjB,CAAA;CACF;AAmCD,MAAM,CAAC,OAAO,OAAO,oBAAoB;;gBAG3B,MAAM,CAAC,EAAE,gBAAgB;IAS/B,MAAM,CAAC,GAAG,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC;
|
|
1
|
+
{"version":3,"file":"BodyParserMiddleware.d.ts","sourceRoot":"","sources":["../../src/bodyparser/BodyParserMiddleware.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAA;AAIzD,MAAM,WAAW,gBAAgB;IAC/B,IAAI,CAAC,EAAE;QACL,OAAO,CAAC,EAAE,OAAO,CAAA;QACjB,KAAK,CAAC,EAAE,MAAM,CAAA;QACd,KAAK,CAAC,EAAE,MAAM,EAAE,CAAA;KACjB,CAAA;IACD,IAAI,CAAC,EAAE;QACL,OAAO,CAAC,EAAE,OAAO,CAAA;QACjB,KAAK,CAAC,EAAE,MAAM,CAAA;QACd,KAAK,CAAC,EAAE,MAAM,EAAE,CAAA;KACjB,CAAA;IACD,GAAG,CAAC,EAAE;QACJ,OAAO,CAAC,EAAE,OAAO,CAAA;QACjB,KAAK,CAAC,EAAE,MAAM,CAAA;QACd,KAAK,CAAC,EAAE,MAAM,EAAE,CAAA;KACjB,CAAA;IACD,SAAS,CAAC,EAAE;QACV,OAAO,CAAC,EAAE,OAAO,CAAA;QACjB,8EAA8E;QAC9E,KAAK,CAAC,EAAE,MAAM,CAAA;QACd,wDAAwD;QACxD,QAAQ,CAAC,EAAE,MAAM,CAAA;QACjB,SAAS,CAAC,EAAE,MAAM,CAAA;QAClB,MAAM,CAAC,EAAE,MAAM,CAAA;QACf,KAAK,CAAC,EAAE,MAAM,EAAE,CAAA;KACjB,CAAA;CACF;AAmCD,MAAM,CAAC,OAAO,OAAO,oBAAoB;;gBAG3B,MAAM,CAAC,EAAE,gBAAgB;IAS/B,MAAM,CAAC,GAAG,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC;CA4FzD"}
|
|
@@ -75,6 +75,10 @@ export default class BodyParserMiddleware {
|
|
|
75
75
|
if (this.#rejectMultipart(ctx, payload.files, payload.fields))
|
|
76
76
|
return;
|
|
77
77
|
const { fields, files } = hydrateMultipartPayload(payload);
|
|
78
|
+
// Fingerprint each file's real type from its magic bytes BEFORE handlers
|
|
79
|
+
// run, so `request.file(field, { extnames })` validates against the
|
|
80
|
+
// detected type (not the attacker-controlled filename/header).
|
|
81
|
+
await Promise.all(files.map((file) => file.detectType()));
|
|
78
82
|
ctx.request.setParsedBody(fields);
|
|
79
83
|
ctx.request.setFiles(files);
|
|
80
84
|
}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"BodyParserMiddleware.js","sourceRoot":"","sources":["../../src/bodyparser/BodyParserMiddleware.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAGH,OAAO,EAAE,uBAAuB,EAAE,MAAM,oBAAoB,CAAA;AAC5D,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAqC1C,MAAM,cAAc,GAA6B;IAC/C,IAAI,EAAE;QACJ,OAAO,EAAE,IAAI;QACb,KAAK,EAAE,KAAK;QACZ,KAAK,EAAE,CAAC,kBAAkB,EAAE,0BAA0B,CAAC;KACxD;IACD,IAAI,EAAE;QACJ,OAAO,EAAE,IAAI;QACb,KAAK,EAAE,KAAK;QACZ,KAAK,EAAE,CAAC,mCAAmC,CAAC;KAC7C;IACD,GAAG,EAAE;QACH,OAAO,EAAE,KAAK;QACd,KAAK,EAAE,KAAK;QACZ,KAAK,EAAE,CAAC,YAAY,CAAC;KACtB;IACD,SAAS,EAAE;QACT,OAAO,EAAE,IAAI;QACb,KAAK,EAAE,MAAM;QACb,QAAQ,EAAE,EAAE;QACZ,SAAS,EAAE,GAAG;QACd,MAAM,EAAE,MAAM;QACd,KAAK,EAAE,CAAC,qBAAqB,CAAC;KAC/B;CACF,CAAA;AAED,MAAM,CAAC,OAAO,OAAO,oBAAoB;IACvC,OAAO,CAA0B;IAEjC,YAAY,MAAyB;QACnC,IAAI,CAAC,OAAO,GAAG;YACb,IAAI,EAAE,EAAE,GAAG,cAAc,CAAC,IAAI,EAAE,GAAG,MAAM,EAAE,IAAI,EAAE;YACjD,IAAI,EAAE,EAAE,GAAG,cAAc,CAAC,IAAI,EAAE,GAAG,MAAM,EAAE,IAAI,EAAE;YACjD,GAAG,EAAE,EAAE,GAAG,cAAc,CAAC,GAAG,EAAE,GAAG,MAAM,EAAE,GAAG,EAAE;YAC9C,SAAS,EAAE,EAAE,GAAG,cAAc,CAAC,SAAS,EAAE,GAAG,MAAM,EAAE,SAAS,EAAE;SACjE,CAAA;IACH,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,GAAgB,EAAE,IAAyB;QACtD,MAAM,WAAW,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,CAAA;QAC5D,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,EAAE,CAAA;QAEjC,aAAa;QACb,IAAI,MAAM,CAAC,UAAU,CAAC,OAAO,EAAE,MAAM,CAAC,GAAG,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC,EAAE,CAAC;YAChF,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBAC5B,KAAK,EAAE,EAAE,IAAI,EAAE,4BAA4B,EAAE,OAAO,EAAE,iCAAiC,EAAE;aAC1F,CAAC,CAAA;YACF,OAAM;QACR,CAAC;QAED,OAAO;QACP,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,IAAI,WAAW,CAAC,WAAW,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YACnF,mDAAmD;QACrD,CAAC;QAED,mBAAmB;QACnB,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,IAAI,WAAW,CAAC,WAAW,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YACnF,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC,mBAAmB,CAAC,OAAO,CAAC,CAAC,CAAA;QACzD,CAAC;QAED,kEAAkE;QAClE,uEAAuE;QACvE,2EAA2E;QAC3E,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,IAAI,WAAW,CAAC,WAAW,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;YACjF,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAA;QAC/C,CAAC;QAED,oEAAoE;QACpE,0EAA0E;QAC1E,sEAAsE;QACtE,IAAI,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,OAAO,IAAI,WAAW,CAAC,WAAW,EAAE,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC;YAC7F,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC,SAAS,EAAE,CAAA;YACvC,IAAI,OAAO,EAAE,CAAC;gBACZ,IAAI,IAAI,CAAC,gBAAgB,CAAC,GAAG,EAAE,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,MAAM,CAAC;oBAAE,OAAM;gBACrE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,uBAAuB,CAAC,OAAO,CAAC,CAAA;gBAC1D,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,CAAA;gBACjC,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAA;YAC7B,CAAC;QACH,CAAC;QAED,MAAM,IAAI,EAAE,CAAA;IACd,CAAC;IAED,SAAS,CAAC,WAAmB;QAC3B,IAAI,WAAW,CAAC,WAAW,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAA;QACrF,IAAI,WAAW,CAAC,WAAW,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAA;QACrF,IAAI,WAAW,CAAC,WAAW,EAAE,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,KAAK,CAAA;QAC/F,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAA;IAC/B,CAAC;IAED,gGAAgG;IAChG,gBAAgB,CACd,GAAgB,EAChB,KAA8B,EAC9B,MAAsB;QAEtB,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAA;QAClC,MAAM,QAAQ,GAAG,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;QAErC,IAAI,MAAM,CAAC,MAAM,GAAG,GAAG,CAAC,SAAS,EAAE,CAAC;YAClC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBAC5B,KAAK,EAAE;oBACL,IAAI,EAAE,mBAAmB;oBACzB,OAAO,EAAE,6BAA6B,GAAG,CAAC,SAAS,GAAG;iBACvD;aACF,CAAC,CAAA;YACF,OAAO,IAAI,CAAA;QACb,CAAC;QAED,IAAI,KAAK,CAAC,MAAM,GAAG,GAAG,CAAC,QAAQ,EAAE,CAAC;YAChC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBAC5B,KAAK,EAAE,EAAE,IAAI,EAAE,kBAAkB,EAAE,OAAO,EAAE,4BAA4B,GAAG,CAAC,QAAQ,GAAG,EAAE;aAC1F,CAAC,CAAA;YACF,OAAO,IAAI,CAAA;QACb,CAAC;QAED,MAAM,UAAU,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAA;QAC5D,IAAI,UAAU,GAAG,QAAQ,EAAE,CAAC;YAC1B,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBAC5B,KAAK,EAAE,EAAE,IAAI,EAAE,4BAA4B,EAAE,OAAO,EAAE,2BAA2B,EAAE;aACpF,CAAC,CAAA;YACF,OAAO,IAAI,CAAA;QACb,CAAC;QAED,OAAO,KAAK,CAAA;IACd,CAAC;CACF;AAED,SAAS,WAAW,CAAC,WAAmB,EAAE,KAAe;IACvD,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAA;AACnD,CAAC;AAED,SAAS,mBAAmB,CAAC,IAAY;IACvC,MAAM,MAAM,GAA4B,EAAE,CAAA;IAC1C,IAAI,CAAC,IAAI;QAAE,OAAO,MAAM,CAAA;IACxB,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACnC,IAAI,CAAC,IAAI;YAAE,SAAQ;QACnB,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;QAC/B,IAAI,KAAK,KAAK,CAAC,CAAC,EAAE,CAAC;YACjB,MAAM,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,CAAA;QACxC,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,GAAG,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAA;QAChG,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAA;AACf,CAAC;AAED,gFAAgF;AAChF,4EAA4E;AAC5E,+EAA+E;AAC/E,EAAE;AACF,mEAAmE;AACnE,gFAAgF;AAChF,6EAA6E;AAC7E,aAAa;AACb,SAAS,mBAAmB,CAAC,KAAa;IACxC,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAA;IACxC,IAAI,CAAC;QACH,OAAO,kBAAkB,CAAC,MAAM,CAAC,CAAA;IACnC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,MAAM,CAAA;IACf,CAAC;AACH,CAAC"}
|
|
1
|
+
{"version":3,"file":"BodyParserMiddleware.js","sourceRoot":"","sources":["../../src/bodyparser/BodyParserMiddleware.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAGH,OAAO,EAAE,uBAAuB,EAAE,MAAM,oBAAoB,CAAA;AAC5D,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAqC1C,MAAM,cAAc,GAA6B;IAC/C,IAAI,EAAE;QACJ,OAAO,EAAE,IAAI;QACb,KAAK,EAAE,KAAK;QACZ,KAAK,EAAE,CAAC,kBAAkB,EAAE,0BAA0B,CAAC;KACxD;IACD,IAAI,EAAE;QACJ,OAAO,EAAE,IAAI;QACb,KAAK,EAAE,KAAK;QACZ,KAAK,EAAE,CAAC,mCAAmC,CAAC;KAC7C;IACD,GAAG,EAAE;QACH,OAAO,EAAE,KAAK;QACd,KAAK,EAAE,KAAK;QACZ,KAAK,EAAE,CAAC,YAAY,CAAC;KACtB;IACD,SAAS,EAAE;QACT,OAAO,EAAE,IAAI;QACb,KAAK,EAAE,MAAM;QACb,QAAQ,EAAE,EAAE;QACZ,SAAS,EAAE,GAAG;QACd,MAAM,EAAE,MAAM;QACd,KAAK,EAAE,CAAC,qBAAqB,CAAC;KAC/B;CACF,CAAA;AAED,MAAM,CAAC,OAAO,OAAO,oBAAoB;IACvC,OAAO,CAA0B;IAEjC,YAAY,MAAyB;QACnC,IAAI,CAAC,OAAO,GAAG;YACb,IAAI,EAAE,EAAE,GAAG,cAAc,CAAC,IAAI,EAAE,GAAG,MAAM,EAAE,IAAI,EAAE;YACjD,IAAI,EAAE,EAAE,GAAG,cAAc,CAAC,IAAI,EAAE,GAAG,MAAM,EAAE,IAAI,EAAE;YACjD,GAAG,EAAE,EAAE,GAAG,cAAc,CAAC,GAAG,EAAE,GAAG,MAAM,EAAE,GAAG,EAAE;YAC9C,SAAS,EAAE,EAAE,GAAG,cAAc,CAAC,SAAS,EAAE,GAAG,MAAM,EAAE,SAAS,EAAE;SACjE,CAAA;IACH,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,GAAgB,EAAE,IAAyB;QACtD,MAAM,WAAW,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,CAAA;QAC5D,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,EAAE,CAAA;QAEjC,aAAa;QACb,IAAI,MAAM,CAAC,UAAU,CAAC,OAAO,EAAE,MAAM,CAAC,GAAG,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC,EAAE,CAAC;YAChF,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBAC5B,KAAK,EAAE,EAAE,IAAI,EAAE,4BAA4B,EAAE,OAAO,EAAE,iCAAiC,EAAE;aAC1F,CAAC,CAAA;YACF,OAAM;QACR,CAAC;QAED,OAAO;QACP,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,IAAI,WAAW,CAAC,WAAW,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YACnF,mDAAmD;QACrD,CAAC;QAED,mBAAmB;QACnB,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,IAAI,WAAW,CAAC,WAAW,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YACnF,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC,mBAAmB,CAAC,OAAO,CAAC,CAAC,CAAA;QACzD,CAAC;QAED,kEAAkE;QAClE,uEAAuE;QACvE,2EAA2E;QAC3E,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,IAAI,WAAW,CAAC,WAAW,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;YACjF,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAA;QAC/C,CAAC;QAED,oEAAoE;QACpE,0EAA0E;QAC1E,sEAAsE;QACtE,IAAI,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,OAAO,IAAI,WAAW,CAAC,WAAW,EAAE,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC;YAC7F,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC,SAAS,EAAE,CAAA;YACvC,IAAI,OAAO,EAAE,CAAC;gBACZ,IAAI,IAAI,CAAC,gBAAgB,CAAC,GAAG,EAAE,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,MAAM,CAAC;oBAAE,OAAM;gBACrE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,uBAAuB,CAAC,OAAO,CAAC,CAAA;gBAC1D,yEAAyE;gBACzE,oEAAoE;gBACpE,+DAA+D;gBAC/D,MAAM,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,CAAA;gBACzD,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,CAAA;gBACjC,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAA;YAC7B,CAAC;QACH,CAAC;QAED,MAAM,IAAI,EAAE,CAAA;IACd,CAAC;IAED,SAAS,CAAC,WAAmB;QAC3B,IAAI,WAAW,CAAC,WAAW,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAA;QACrF,IAAI,WAAW,CAAC,WAAW,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAA;QACrF,IAAI,WAAW,CAAC,WAAW,EAAE,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,KAAK,CAAA;QAC/F,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAA;IAC/B,CAAC;IAED,gGAAgG;IAChG,gBAAgB,CACd,GAAgB,EAChB,KAA8B,EAC9B,MAAsB;QAEtB,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAA;QAClC,MAAM,QAAQ,GAAG,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;QAErC,IAAI,MAAM,CAAC,MAAM,GAAG,GAAG,CAAC,SAAS,EAAE,CAAC;YAClC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBAC5B,KAAK,EAAE;oBACL,IAAI,EAAE,mBAAmB;oBACzB,OAAO,EAAE,6BAA6B,GAAG,CAAC,SAAS,GAAG;iBACvD;aACF,CAAC,CAAA;YACF,OAAO,IAAI,CAAA;QACb,CAAC;QAED,IAAI,KAAK,CAAC,MAAM,GAAG,GAAG,CAAC,QAAQ,EAAE,CAAC;YAChC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBAC5B,KAAK,EAAE,EAAE,IAAI,EAAE,kBAAkB,EAAE,OAAO,EAAE,4BAA4B,GAAG,CAAC,QAAQ,GAAG,EAAE;aAC1F,CAAC,CAAA;YACF,OAAO,IAAI,CAAA;QACb,CAAC;QAED,MAAM,UAAU,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAA;QAC5D,IAAI,UAAU,GAAG,QAAQ,EAAE,CAAC;YAC1B,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBAC5B,KAAK,EAAE,EAAE,IAAI,EAAE,4BAA4B,EAAE,OAAO,EAAE,2BAA2B,EAAE;aACpF,CAAC,CAAA;YACF,OAAO,IAAI,CAAA;QACb,CAAC;QAED,OAAO,KAAK,CAAA;IACd,CAAC;CACF;AAED,SAAS,WAAW,CAAC,WAAmB,EAAE,KAAe;IACvD,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAA;AACnD,CAAC;AAED,SAAS,mBAAmB,CAAC,IAAY;IACvC,MAAM,MAAM,GAA4B,EAAE,CAAA;IAC1C,IAAI,CAAC,IAAI;QAAE,OAAO,MAAM,CAAA;IACxB,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACnC,IAAI,CAAC,IAAI;YAAE,SAAQ;QACnB,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;QAC/B,IAAI,KAAK,KAAK,CAAC,CAAC,EAAE,CAAC;YACjB,MAAM,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,CAAA;QACxC,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,GAAG,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAA;QAChG,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAA;AACf,CAAC;AAED,gFAAgF;AAChF,4EAA4E;AAC5E,+EAA+E;AAC/E,EAAE;AACF,mEAAmE;AACnE,gFAAgF;AAChF,6EAA6E;AAC7E,aAAa;AACb,SAAS,mBAAmB,CAAC,KAAa;IACxC,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAA;IACxC,IAAI,CAAC;QACH,OAAO,kBAAkB,CAAC,MAAM,CAAC,CAAA;IACnC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,MAAM,CAAA;IACf,CAAC;AACH,CAAC"}
|
|
@@ -14,9 +14,11 @@ export declare class MultipartFile {
|
|
|
14
14
|
#private;
|
|
15
15
|
/** Original filename from the client. */
|
|
16
16
|
readonly clientName: string;
|
|
17
|
-
/**
|
|
18
|
-
|
|
19
|
-
|
|
17
|
+
/**
|
|
18
|
+
* MIME type from the Content-Type header. ATTACKER-CONTROLLED — never trust it
|
|
19
|
+
* for security decisions or as a response Content-Type. Prefer
|
|
20
|
+
* {@link detectedType}, which is fingerprinted from the file's magic bytes.
|
|
21
|
+
*/
|
|
20
22
|
readonly type: string;
|
|
21
23
|
/** File size in bytes. */
|
|
22
24
|
readonly size: number;
|
|
@@ -32,6 +34,25 @@ export declare class MultipartFile {
|
|
|
32
34
|
type: string;
|
|
33
35
|
content: Buffer;
|
|
34
36
|
});
|
|
37
|
+
/**
|
|
38
|
+
* Fingerprint the real file type from its magic bytes (via `file-type`), so
|
|
39
|
+
* validation + storage don't trust the attacker-controlled filename/header.
|
|
40
|
+
* Mirrors AdonisJS, which detects binary types this way. Call once after
|
|
41
|
+
* construction (the BodyParser middleware does this for every uploaded file).
|
|
42
|
+
* Content `file-type` can't fingerprint (text formats) leaves the client
|
|
43
|
+
* extension in force — same fallback AdonisJS uses.
|
|
44
|
+
*/
|
|
45
|
+
detectType(): Promise<void>;
|
|
46
|
+
/**
|
|
47
|
+
* Magic-byte-detected MIME type — TRUSTWORTHY (content-derived). `undefined`
|
|
48
|
+
* for text formats `file-type` can't fingerprint. Use this, not {@link type}.
|
|
49
|
+
*/
|
|
50
|
+
get detectedType(): string | undefined;
|
|
51
|
+
/**
|
|
52
|
+
* File extension without the dot — the magic-byte-detected one when available
|
|
53
|
+
* (defeats a renamed binary), else the client filename's extension.
|
|
54
|
+
*/
|
|
55
|
+
get extname(): string;
|
|
35
56
|
/** Validate file against size and extension rules. */
|
|
36
57
|
validate(options: FileValidationOptions): boolean;
|
|
37
58
|
get isValid(): boolean;
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"MultipartFile.d.ts","sourceRoot":"","sources":["../../src/bodyparser/MultipartFile.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAGH,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAA;AAEtC,MAAM,WAAW,qBAAqB;IACpC,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAA;CACpB;AAED,qBAAa,aAAa;;IACxB,yCAAyC;IACzC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAE3B
|
|
1
|
+
{"version":3,"file":"MultipartFile.d.ts","sourceRoot":"","sources":["../../src/bodyparser/MultipartFile.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAGH,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAA;AAEtC,MAAM,WAAW,qBAAqB;IACpC,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAA;CACpB;AAED,qBAAa,aAAa;;IACxB,yCAAyC;IACzC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAE3B;;;;OAIG;IACH,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IAErB,0BAA0B;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IAErB,kCAAkC;IAClC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IAExB,8BAA8B;IAC9B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAE1B,yBAAyB;IACzB,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,CAAK;gBAWlB,OAAO,EAAE;QACnB,SAAS,EAAE,MAAM,CAAA;QACjB,UAAU,EAAE,MAAM,CAAA;QAClB,IAAI,EAAE,MAAM,CAAA;QACZ,OAAO,EAAE,MAAM,CAAA;KAChB;IAUD;;;;;;;OAOG;IACG,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IAMjC;;;OAGG;IACH,IAAI,YAAY,IAAI,MAAM,GAAG,SAAS,CAErC;IAED;;;OAGG;IACH,IAAI,OAAO,IAAI,MAAM,CAEpB;IAED,sDAAsD;IACtD,QAAQ,CAAC,OAAO,EAAE,qBAAqB,GAAG,OAAO;IAmBjD,IAAI,OAAO,IAAI,OAAO,CAErB;IAED;;;;;;OAMG;IACG,UAAU,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IA2BnE,IAAI,OAAO,IAAI,OAAO,CAErB;IAED;;;;;OAKG;IACH,MAAM,IAAI,QAAQ;CAGnB;AAyBD;;;;;GAKG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,EAAE;IAC/C,MAAM,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IAC9C,KAAK,EAAE,KAAK,CAAC;QACX,SAAS,EAAE,MAAM,CAAA;QACjB,UAAU,EAAE,MAAM,CAAA;QAClB,WAAW,EAAE,MAAM,CAAA;QACnB,IAAI,EAAE,MAAM,CAAA;QACZ,UAAU,EAAE,MAAM,CAAA;KACnB,CAAC,CAAA;CACH,GAAG;IAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAAC,KAAK,EAAE,aAAa,EAAE,CAAA;CAAE,CAe7D"}
|
|
@@ -10,9 +10,11 @@ import { Readable } from 'node:stream';
|
|
|
10
10
|
export class MultipartFile {
|
|
11
11
|
/** Original filename from the client. */
|
|
12
12
|
clientName;
|
|
13
|
-
/**
|
|
14
|
-
|
|
15
|
-
|
|
13
|
+
/**
|
|
14
|
+
* MIME type from the Content-Type header. ATTACKER-CONTROLLED — never trust it
|
|
15
|
+
* for security decisions or as a response Content-Type. Prefer
|
|
16
|
+
* {@link detectedType}, which is fingerprinted from the file's magic bytes.
|
|
17
|
+
*/
|
|
16
18
|
type;
|
|
17
19
|
/** File size in bytes. */
|
|
18
20
|
size;
|
|
@@ -24,6 +26,10 @@ export class MultipartFile {
|
|
|
24
26
|
errors = [];
|
|
25
27
|
/** Whether the file has been moved. */
|
|
26
28
|
#moved = false;
|
|
29
|
+
/** Extension derived from the (attacker-controlled) client filename. */
|
|
30
|
+
#clientExtname;
|
|
31
|
+
/** Magic-byte fingerprint — set by {@link detectType}; absent for content `file-type` can't detect (text: txt/csv/svg/json). */
|
|
32
|
+
#detected;
|
|
27
33
|
constructor(options) {
|
|
28
34
|
this.fieldName = options.fieldName;
|
|
29
35
|
this.clientName = options.clientName;
|
|
@@ -31,7 +37,35 @@ export class MultipartFile {
|
|
|
31
37
|
this.content = options.content;
|
|
32
38
|
this.size = options.content.length;
|
|
33
39
|
const segments = options.clientName.split('.');
|
|
34
|
-
this
|
|
40
|
+
this.#clientExtname = segments.length > 1 ? (segments.at(-1) ?? '').toLowerCase() : '';
|
|
41
|
+
}
|
|
42
|
+
/**
|
|
43
|
+
* Fingerprint the real file type from its magic bytes (via `file-type`), so
|
|
44
|
+
* validation + storage don't trust the attacker-controlled filename/header.
|
|
45
|
+
* Mirrors AdonisJS, which detects binary types this way. Call once after
|
|
46
|
+
* construction (the BodyParser middleware does this for every uploaded file).
|
|
47
|
+
* Content `file-type` can't fingerprint (text formats) leaves the client
|
|
48
|
+
* extension in force — same fallback AdonisJS uses.
|
|
49
|
+
*/
|
|
50
|
+
async detectType() {
|
|
51
|
+
const { fileTypeFromBuffer } = await import('file-type');
|
|
52
|
+
const result = await fileTypeFromBuffer(this.content);
|
|
53
|
+
if (result)
|
|
54
|
+
this.#detected = { ext: result.ext, mime: result.mime };
|
|
55
|
+
}
|
|
56
|
+
/**
|
|
57
|
+
* Magic-byte-detected MIME type — TRUSTWORTHY (content-derived). `undefined`
|
|
58
|
+
* for text formats `file-type` can't fingerprint. Use this, not {@link type}.
|
|
59
|
+
*/
|
|
60
|
+
get detectedType() {
|
|
61
|
+
return this.#detected?.mime;
|
|
62
|
+
}
|
|
63
|
+
/**
|
|
64
|
+
* File extension without the dot — the magic-byte-detected one when available
|
|
65
|
+
* (defeats a renamed binary), else the client filename's extension.
|
|
66
|
+
*/
|
|
67
|
+
get extname() {
|
|
68
|
+
return this.#detected?.ext ?? this.#clientExtname;
|
|
35
69
|
}
|
|
36
70
|
/** Validate file against size and extension rules. */
|
|
37
71
|
validate(options) {
|
|
@@ -42,6 +76,8 @@ export class MultipartFile {
|
|
|
42
76
|
}
|
|
43
77
|
}
|
|
44
78
|
if (options.extnames && options.extnames.length > 0) {
|
|
79
|
+
// `this.extname` is the magic-byte-detected extension when available, so a
|
|
80
|
+
// binary renamed `evil.png` is validated by its real type, not its name.
|
|
45
81
|
if (!options.extnames.includes(this.extname)) {
|
|
46
82
|
this.errors.push(`Extension '${this.extname}' not allowed. Allowed: ${options.extnames.join(', ')}`);
|
|
47
83
|
}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"MultipartFile.js","sourceRoot":"","sources":["../../src/bodyparser/MultipartFile.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AACzC,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAA;AAOtC,MAAM,OAAO,aAAa;IACxB,yCAAyC;IAChC,UAAU,CAAQ;IAE3B
|
|
1
|
+
{"version":3,"file":"MultipartFile.js","sourceRoot":"","sources":["../../src/bodyparser/MultipartFile.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AACzC,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAA;AAOtC,MAAM,OAAO,aAAa;IACxB,yCAAyC;IAChC,UAAU,CAAQ;IAE3B;;;;OAIG;IACM,IAAI,CAAQ;IAErB,0BAA0B;IACjB,IAAI,CAAQ;IAErB,kCAAkC;IACzB,OAAO,CAAQ;IAExB,8BAA8B;IACrB,SAAS,CAAQ;IAE1B,yBAAyB;IAChB,MAAM,GAAa,EAAE,CAAA;IAE9B,uCAAuC;IACvC,MAAM,GAAG,KAAK,CAAA;IAEd,wEAAwE;IACxE,cAAc,CAAQ;IAEtB,gIAAgI;IAChI,SAAS,CAAgC;IAEzC,YAAY,OAKX;QACC,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,CAAA;QAClC,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,CAAA;QACpC,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,CAAA;QACxB,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,CAAA;QAC9B,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,CAAA;QAClC,MAAM,QAAQ,GAAG,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QAC9C,IAAI,CAAC,cAAc,GAAG,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAA;IACxF,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,UAAU;QACd,MAAM,EAAE,kBAAkB,EAAE,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,CAAA;QACxD,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;QACrD,IAAI,MAAM;YAAE,IAAI,CAAC,SAAS,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAA;IACrE,CAAC;IAED;;;OAGG;IACH,IAAI,YAAY;QACd,OAAO,IAAI,CAAC,SAAS,EAAE,IAAI,CAAA;IAC7B,CAAC;IAED;;;OAGG;IACH,IAAI,OAAO;QACT,OAAO,IAAI,CAAC,SAAS,EAAE,GAAG,IAAI,IAAI,CAAC,cAAc,CAAA;IACnD,CAAC;IAED,sDAAsD;IACtD,QAAQ,CAAC,OAA8B;QACrC,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;YACjB,MAAM,QAAQ,GAAG,aAAa,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;YAC5C,IAAI,IAAI,CAAC,IAAI,GAAG,QAAQ,EAAE,CAAC;gBACzB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,aAAa,IAAI,CAAC,IAAI,kBAAkB,OAAO,CAAC,IAAI,EAAE,CAAC,CAAA;YAC1E,CAAC;QACH,CAAC;QACD,IAAI,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACpD,2EAA2E;YAC3E,yEAAyE;YACzE,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC7C,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,cAAc,IAAI,CAAC,OAAO,2BAA2B,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACnF,CAAA;YACH,CAAC;QACH,CAAC;QACD,OAAO,IAAI,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,CAAA;IACjC,CAAC;IAED,IAAI,OAAO;QACT,OAAO,IAAI,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,CAAA;IACjC,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,UAAU,CAAC,SAAiB,EAAE,IAAa;QAC/C,MAAM,EAAE,SAAS,EAAE,aAAa,EAAE,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,CAAA;QAC5D,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,CAAA;QAE1C,IAAI,IAAI,KAAK,SAAS,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,EAAE,CAAC;YAChD,MAAM,IAAI,KAAK,CACb,sGAAsG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAC7H,CAAA;QACH,CAAC;QAED,SAAS,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;QACzC,MAAM,QAAQ,GAAG,IAAI,IAAI,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAA;QAC7E,uEAAuE;QACvE,sEAAsE;QACtE,sEAAsE;QACtE,sDAAsD;QACtD,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC9B,MAAM,IAAI,KAAK,CACb,+CAA+C,QAAQ,wEAAwE,CAChI,CAAA;QACH,CAAC;QACD,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAA;QAC1C,aAAa,CAAC,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,CAAA;QACrC,IAAI,CAAC,MAAM,GAAG,IAAI,CAAA;QAClB,OAAO,QAAQ,CAAA;IACjB,CAAC;IAED,IAAI,OAAO;QACT,OAAO,IAAI,CAAC,MAAM,CAAA;IACpB,CAAC;IAED;;;;;OAKG;IACH,MAAM;QACJ,OAAO,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,CAAA;IAC3D,CAAC;CACF;AAED,SAAS,cAAc,CAAC,IAAY;IAClC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAA;IACnC,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,KAAK,CAAA;IAC/C,IAAI,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAA;IACtC,OAAO,IAAI,CAAA;AACb,CAAC;AAED,SAAS,aAAa,CAAC,IAAY;IACjC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAA;IAC/C,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,GAAG,IAAI,CAAA;IAC9B,MAAM,GAAG,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;IAClC,QAAQ,KAAK,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,EAAE,CAAC;QAChC,KAAK,IAAI;YACP,OAAO,GAAG,GAAG,IAAI,CAAA;QACnB,KAAK,IAAI;YACP,OAAO,GAAG,GAAG,IAAI,GAAG,IAAI,CAAA;QAC1B,KAAK,IAAI;YACP,OAAO,GAAG,GAAG,IAAI,GAAG,IAAI,GAAG,IAAI,CAAA;QACjC;YACE,OAAO,GAAG,CAAA;IACd,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,uBAAuB,CAAC,OASvC;IACC,MAAM,MAAM,GAA2B,EAAE,CAAA;IACzC,KAAK,MAAM,KAAK,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;QACnC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,KAAK,CAAA;IAClC,CAAC;IACD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAC7B,CAAC,CAAC,EAAE,EAAE,CACJ,IAAI,aAAa,CAAC;QAChB,SAAS,EAAE,CAAC,CAAC,SAAS;QACtB,UAAU,EAAE,CAAC,CAAC,UAAU;QACxB,IAAI,EAAE,CAAC,CAAC,WAAW;QACnB,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,EAAE,QAAQ,CAAC;KAC7C,CAAC,CACL,CAAA;IACD,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAA;AAC1B,CAAC"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"RpcRouter.d.ts","sourceRoot":"","sources":["../../src/rpc/RpcRouter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAA;AAIzD,MAAM,MAAM,UAAU,GAAG,CAAC,GAAG,EAAE,WAAW,EAAE,MAAM,EAAE,OAAO,KAAK,OAAO,CAAC,OAAO,CAAC,GAAG,OAAO,CAAA;AAE1F;;;GAGG;AACH,UAAU,YAAY;IACpB,IAAI,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,GAAG,CAAC,CAAA;IACjD,OAAO,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,GAAG,CAAC,CAAA;IAC5B,GAAG,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAA;CAC5B;AAED,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,MAAM,CAAA;IACZ,OAAO,EAAE,UAAU,CAAA;IACnB,MAAM,EAAE,MAAM,EAAE,CAAA;IAChB,KAAK,EAAE,MAAM,EAAE,CAAA;IACf,WAAW,EAAE,MAAM,EAAE,CAAA;IACrB,UAAU,EAAE,MAAM,EAAE,CAAA;IACpB,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB;AAED,qBAAa,gBAAgB;;gBAGf,GAAG,EAAE,mBAAmB;IAIpC,KAAK,CAAC,GAAG,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI;IAKhC,IAAI,CAAC,GAAG,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI;IAK9B,UAAU,CAAC,GAAG,WAAW,EAAE,MAAM,EAAE,GAAG,IAAI;IAK1C,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI;IAKjC,UAAU,CAAC,GAAG,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI;CAIrC;
|
|
1
|
+
{"version":3,"file":"RpcRouter.d.ts","sourceRoot":"","sources":["../../src/rpc/RpcRouter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAA;AAIzD,MAAM,MAAM,UAAU,GAAG,CAAC,GAAG,EAAE,WAAW,EAAE,MAAM,EAAE,OAAO,KAAK,OAAO,CAAC,OAAO,CAAC,GAAG,OAAO,CAAA;AAE1F;;;GAGG;AACH,UAAU,YAAY;IACpB,IAAI,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,GAAG,CAAC,CAAA;IACjD,OAAO,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,GAAG,CAAC,CAAA;IAC5B,GAAG,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAA;CAC5B;AAED,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,MAAM,CAAA;IACZ,OAAO,EAAE,UAAU,CAAA;IACnB,MAAM,EAAE,MAAM,EAAE,CAAA;IAChB,KAAK,EAAE,MAAM,EAAE,CAAA;IACf,WAAW,EAAE,MAAM,EAAE,CAAA;IACrB,UAAU,EAAE,MAAM,EAAE,CAAA;IACpB,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB;AAED,qBAAa,gBAAgB;;gBAGf,GAAG,EAAE,mBAAmB;IAIpC,KAAK,CAAC,GAAG,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI;IAKhC,IAAI,CAAC,GAAG,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI;IAK9B,UAAU,CAAC,GAAG,WAAW,EAAE,MAAM,EAAE,GAAG,IAAI;IAK1C,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI;IAKjC,UAAU,CAAC,GAAG,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI;CAIrC;AA4GD,qBAAa,SAAS;;IAKpB;;;;;OAKG;IACH,YAAY,CAAC,SAAS,EAAE,YAAY,GAAG,IAAI;IAI3C,8BAA8B;IAC9B,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,UAAU,GAAG,gBAAgB;IAa3D,8EAA8E;IAC9E,SAAS,CACP,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,KAAK,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,OAAO,CAAC,GACtF,IAAI;IAeP,mDAAmD;IACnD,KAAK,CACH,MAAM,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,EACpE,QAAQ,EAAE,CAAC,GAAG,EAAE,SAAS,KAAK,IAAI,GACjC,IAAI;IAgBP,2CAA2C;IACrC,MAAM,CAAC,GAAG,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC;IAyH7C,uCAAuC;IACvC,UAAU,IAAI,MAAM,EAAE;IAItB,+CAA+C;IAC/C,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,mBAAmB,GAAG,SAAS;CAGzD"}
|
package/dist/rpc/RpcRouter.js
CHANGED
|
@@ -37,6 +37,24 @@ export class RpcMethodBuilder {
|
|
|
37
37
|
return this;
|
|
38
38
|
}
|
|
39
39
|
}
|
|
40
|
+
/**
|
|
41
|
+
* Unwrap the `{ _body: [...] }` envelope `request.body()` puts around a
|
|
42
|
+
* top-level JSON array (it only treats plain objects as the body verbatim). A
|
|
43
|
+
* JSON-RPC batch arrives this way; a single request is a plain object and is
|
|
44
|
+
* returned unchanged.
|
|
45
|
+
*/
|
|
46
|
+
function unwrapBatchBody(value) {
|
|
47
|
+
if (typeof value === 'object' && value !== null && '_body' in value) {
|
|
48
|
+
const inner = value._body;
|
|
49
|
+
if (Array.isArray(inner))
|
|
50
|
+
return inner;
|
|
51
|
+
}
|
|
52
|
+
return value;
|
|
53
|
+
}
|
|
54
|
+
/** A handler error shaped like a JSON-RPC error — it carries a numeric `code`. */
|
|
55
|
+
function isRpcShapedError(err) {
|
|
56
|
+
return typeof err === 'object' && err !== null && 'code' in err && typeof err.code === 'number';
|
|
57
|
+
}
|
|
40
58
|
/** Build a JSON-RPC 2.0 error envelope. */
|
|
41
59
|
function rpcError(code, message, id, data) {
|
|
42
60
|
return {
|
|
@@ -159,7 +177,10 @@ export class RpcRouter {
|
|
|
159
177
|
}
|
|
160
178
|
/** Handle an incoming JSON-RPC request. */
|
|
161
179
|
async handle(ctx) {
|
|
162
|
-
|
|
180
|
+
// `request.body()` wraps a top-level JSON array — a JSON-RPC batch — as its
|
|
181
|
+
// non-object envelope `{ _body: [...] }`. Unwrap it so batch detection works;
|
|
182
|
+
// a single request is a plain object and passes through untouched.
|
|
183
|
+
const body = unwrapBatchBody(ctx.request.body());
|
|
163
184
|
// Batch support (max 50 to prevent DoS)
|
|
164
185
|
if (Array.isArray(body)) {
|
|
165
186
|
if (body.length > 50) {
|
|
@@ -253,7 +274,14 @@ export class RpcRouter {
|
|
|
253
274
|
return { jsonrpc: '2.0', result, id };
|
|
254
275
|
}
|
|
255
276
|
catch (err) {
|
|
256
|
-
//
|
|
277
|
+
// Honor a JSON-RPC-shaped error thrown by a handler (one carrying a numeric
|
|
278
|
+
// `code`), so handlers can return domain errors — -32004 not-found, -32009
|
|
279
|
+
// conflict, etc. — instead of every throw collapsing to -32603.
|
|
280
|
+
if (isRpcShapedError(err)) {
|
|
281
|
+
const message = typeof err.message === 'string' ? err.message : 'RPC error';
|
|
282
|
+
return rpcError(err.code, message, id, err.data);
|
|
283
|
+
}
|
|
284
|
+
// Otherwise don't leak internal error details to the caller.
|
|
257
285
|
const isDev = process.env.NODE_ENV !== 'production';
|
|
258
286
|
const message = isDev && err instanceof Error ? err.message : 'Internal error';
|
|
259
287
|
return rpcError(-32603, message, id);
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"RpcRouter.js","sourceRoot":"","sources":["../../src/rpc/RpcRouter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAIH,OAAO,EAAE,OAAO,EAAE,MAAM,2BAA2B,CAAA;AAwBnD,MAAM,OAAO,gBAAgB;IAC3B,IAAI,CAAqB;IAEzB,YAAY,GAAwB;QAClC,IAAI,CAAC,IAAI,GAAG,GAAG,CAAA;IACjB,CAAC;IAED,KAAK,CAAC,GAAG,MAAgB;QACvB,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,CAAA;QAChC,OAAO,IAAI,CAAA;IACb,CAAC;IAED,IAAI,CAAC,GAAG,KAAe;QACrB,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,CAAA;QAC9B,OAAO,IAAI,CAAA;IACb,CAAC;IAED,UAAU,CAAC,GAAG,WAAqB;QACjC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,GAAG,WAAW,CAAC,CAAA;QAC1C,OAAO,IAAI,CAAA;IACb,CAAC;IAED,QAAQ,CAAC,SAAiB;QACxB,IAAI,CAAC,IAAI,CAAC,SAAS,GAAG,SAAS,CAAA;QAC/B,OAAO,IAAI,CAAA;IACb,CAAC;IAED,UAAU,CAAC,GAAG,KAAe;QAC3B,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,CAAA;QACnC,OAAO,IAAI,CAAA;IACb,CAAC;CACF;AAQD,2CAA2C;AAC3C,SAAS,QAAQ,CAAC,IAAY,EAAE,OAAe,EAAE,EAAW,EAAE,IAAc;IAC1E,OAAO;QACL,OAAO,EAAE,KAAK;QACd,KAAK,EAAE,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE;QACvE,EAAE;KACH,CAAA;AACH,CAAC;AAMD,mEAAmE;AACnE,SAAS,eAAe,CAAC,OAAgB;IACvC,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;QAC5C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC,KAAK,EAAE,iBAAiB,EAAE,IAAI,CAAC,EAAE,CAAA;IAC3E,CAAC;IACD,sEAAsE;IACtE,MAAM,OAAO,GACX,SAAS,IAAI,OAAO,IAAI,OAAO,OAAO,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAA;IAC3F,MAAM,MAAM,GACV,QAAQ,IAAI,OAAO,IAAI,OAAO,OAAO,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAA;IACxF,MAAM,MAAM,GAAG,QAAQ,IAAI,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAA;IAC/D,MAAM,EAAE,GAAG,IAAI,IAAI,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAA;IACnD,IAAI,OAAO,KAAK,KAAK,IAAI,CAAC,MAAM,EAAE,CAAC;QACjC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC,KAAK,EAAE,iBAAiB,EAAE,EAAE,IAAI,IAAI,CAAC,EAAE,CAAA;IACjF,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,CAAA;AACzC,CAAC;AAED;;;;;GAKG;AACH,SAAS,cAAc,CAAC,OAAgB;IACtC,OAAO,CACL,CAAC,CAAC,OAAO;QACT,OAAO,OAAO,KAAK,QAAQ;QAC3B,SAAS,IAAI,OAAO;QACpB,OAAO,CAAC,OAAO,KAAK,KAAK;QACzB,QAAQ,IAAI,OAAO;QACnB,OAAO,OAAO,CAAC,MAAM,KAAK,QAAQ;QAClC,CAAC,CAAC,IAAI,IAAI,OAAO,CAAC,CACnB,CAAA;AACH,CAAC;AAED;;;;GAIG;AACH,SAAS,qBAAqB,CAC5B,GAAgB,EAChB,GAAwB;IAExB,MAAM,SAAS,GAAG,GAAG,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,GAAG,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,CAAA;IAC7F,IAAI,SAAS,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,aAAa,EAAE,CAAC;QAC1C,OAAO,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,cAAc,EAAE,CAAA;IAClD,CAAC;IACD,IAAI,GAAG,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACzB,4EAA4E;QAC5E,iFAAiF;QACjF,MAAM,SAAS,GAAG,GAAG,CAAC,IAAI,EAAE,KAAK,IAAI,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,IAAI,EAAE,CAAA;QAChE,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAC1D,OAAO,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,mBAAmB,EAAE,CAAA;QACvD,CAAC;IACH,CAAC;IACD,IAAI,GAAG,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC/B,MAAM,SAAS,GAAG,GAAG,CAAC,IAAI,EAAE,WAAW,IAAI,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,WAAW,IAAI,EAAE,CAAA;QAC5E,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACjE,OAAO,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,0BAA0B,EAAE,CAAA;QAC9D,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAA;AAClB,CAAC;AAED,MAAM,OAAO,SAAS;IACpB,QAAQ,GAAqC,IAAI,GAAG,EAAE,CAAA;IACtD,YAAY,GAAuE,IAAI,CAAA;IACvF,UAAU,CAAe;IAEzB;;;;;OAKG;IACH,YAAY,CAAC,SAAuB;QAClC,IAAI,CAAC,UAAU,GAAG,SAAS,CAAA;IAC7B,CAAC;IAED,8BAA8B;IAC9B,MAAM,CAAC,IAAY,EAAE,OAAmB;QACtC,MAAM,GAAG,GAAwB;YAC/B,IAAI;YACJ,OAAO;YACP,MAAM,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,YAAY,EAAE,MAAM,IAAI,EAAE,CAAC,CAAC;YAC9C,KAAK,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,YAAY,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC;YAC5C,WAAW,EAAE,EAAE;YACf,UAAU,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,YAAY,EAAE,UAAU,IAAI,EAAE,CAAC,CAAC;SACvD,CAAA;QACD,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,CAAA;QAC5B,OAAO,IAAI,gBAAgB,CAAC,GAAG,CAAC,CAAA;IAClC,CAAC;IAED,8EAA8E;IAC9E,SAAS,CACP,MAAc,EACd,UAAuF;QAEvF,MAAM,KAAK,GAAG,UAAU,CAAC,SAAS,CAAA;QAClC,MAAM,OAAO,GAAG,MAAM,CAAC,mBAAmB,CAAC,KAAK,CAAC,CAAC,MAAM,CACtD,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,aAAa,IAAI,OAAO,KAAK,CAAC,CAAC,CAAC,KAAK,UAAU,CAC7D,CAAA;QACD,KAAK,MAAM,UAAU,IAAI,OAAO,EAAE,CAAC;YACjC,IAAI,CAAC,MAAM,CAAC,GAAG,MAAM,IAAI,UAAU,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE;gBAC3D,qEAAqE;gBACrE,gEAAgE;gBAChE,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,UAAU,EAAE,CAAA;gBACtF,OAAO,QAAQ,CAAC,UAAU,CAAC,CAAC,GAAG,EAAE,MAAM,CAAC,CAAA;YAC1C,CAAC,CAAC,CAAA;QACJ,CAAC;IACH,CAAC;IAED,mDAAmD;IACnD,KAAK,CACH,MAAoE,EACpE,QAAkC;QAElC,MAAM,UAAU,GAAG,IAAI,CAAC,YAAY,CAAA;QACpC,IAAI,CAAC,YAAY,GAAG;YAClB,MAAM,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YAC3E,KAAK,EAAE,EAAE;YACT,UAAU,EAAE,MAAM,CAAC,UAAU,IAAI,EAAE;SACpC,CAAA;QACD,2EAA2E;QAC3E,2EAA2E;QAC3E,IAAI,CAAC;YACH,QAAQ,CAAC,IAAI,CAAC,CAAA;QAChB,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC,YAAY,GAAG,UAAU,CAAA;QAChC,CAAC;IACH,CAAC;IAED,2CAA2C;IAC3C,KAAK,CAAC,MAAM,CAAC,GAAgB;QAC3B,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAA;
|
|
1
|
+
{"version":3,"file":"RpcRouter.js","sourceRoot":"","sources":["../../src/rpc/RpcRouter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAIH,OAAO,EAAE,OAAO,EAAE,MAAM,2BAA2B,CAAA;AAwBnD,MAAM,OAAO,gBAAgB;IAC3B,IAAI,CAAqB;IAEzB,YAAY,GAAwB;QAClC,IAAI,CAAC,IAAI,GAAG,GAAG,CAAA;IACjB,CAAC;IAED,KAAK,CAAC,GAAG,MAAgB;QACvB,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,CAAA;QAChC,OAAO,IAAI,CAAA;IACb,CAAC;IAED,IAAI,CAAC,GAAG,KAAe;QACrB,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,CAAA;QAC9B,OAAO,IAAI,CAAA;IACb,CAAC;IAED,UAAU,CAAC,GAAG,WAAqB;QACjC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,GAAG,WAAW,CAAC,CAAA;QAC1C,OAAO,IAAI,CAAA;IACb,CAAC;IAED,QAAQ,CAAC,SAAiB;QACxB,IAAI,CAAC,IAAI,CAAC,SAAS,GAAG,SAAS,CAAA;QAC/B,OAAO,IAAI,CAAA;IACb,CAAC;IAED,UAAU,CAAC,GAAG,KAAe;QAC3B,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,CAAA;QACnC,OAAO,IAAI,CAAA;IACb,CAAC;CACF;AAQD;;;;;GAKG;AACH,SAAS,eAAe,CAAC,KAAc;IACrC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,EAAE,CAAC;QACpE,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAA;QACzB,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;YAAE,OAAO,KAAK,CAAA;IACxC,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAED,kFAAkF;AAClF,SAAS,gBAAgB,CACvB,GAAY;IAEZ,OAAO,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI,IAAI,MAAM,IAAI,GAAG,IAAI,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,CAAA;AACjG,CAAC;AAED,2CAA2C;AAC3C,SAAS,QAAQ,CAAC,IAAY,EAAE,OAAe,EAAE,EAAW,EAAE,IAAc;IAC1E,OAAO;QACL,OAAO,EAAE,KAAK;QACd,KAAK,EAAE,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE;QACvE,EAAE;KACH,CAAA;AACH,CAAC;AAMD,mEAAmE;AACnE,SAAS,eAAe,CAAC,OAAgB;IACvC,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;QAC5C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC,KAAK,EAAE,iBAAiB,EAAE,IAAI,CAAC,EAAE,CAAA;IAC3E,CAAC;IACD,sEAAsE;IACtE,MAAM,OAAO,GACX,SAAS,IAAI,OAAO,IAAI,OAAO,OAAO,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAA;IAC3F,MAAM,MAAM,GACV,QAAQ,IAAI,OAAO,IAAI,OAAO,OAAO,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAA;IACxF,MAAM,MAAM,GAAG,QAAQ,IAAI,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAA;IAC/D,MAAM,EAAE,GAAG,IAAI,IAAI,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAA;IACnD,IAAI,OAAO,KAAK,KAAK,IAAI,CAAC,MAAM,EAAE,CAAC;QACjC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC,KAAK,EAAE,iBAAiB,EAAE,EAAE,IAAI,IAAI,CAAC,EAAE,CAAA;IACjF,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,CAAA;AACzC,CAAC;AAED;;;;;GAKG;AACH,SAAS,cAAc,CAAC,OAAgB;IACtC,OAAO,CACL,CAAC,CAAC,OAAO;QACT,OAAO,OAAO,KAAK,QAAQ;QAC3B,SAAS,IAAI,OAAO;QACpB,OAAO,CAAC,OAAO,KAAK,KAAK;QACzB,QAAQ,IAAI,OAAO;QACnB,OAAO,OAAO,CAAC,MAAM,KAAK,QAAQ;QAClC,CAAC,CAAC,IAAI,IAAI,OAAO,CAAC,CACnB,CAAA;AACH,CAAC;AAED;;;;GAIG;AACH,SAAS,qBAAqB,CAC5B,GAAgB,EAChB,GAAwB;IAExB,MAAM,SAAS,GAAG,GAAG,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,GAAG,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,CAAA;IAC7F,IAAI,SAAS,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,aAAa,EAAE,CAAC;QAC1C,OAAO,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,cAAc,EAAE,CAAA;IAClD,CAAC;IACD,IAAI,GAAG,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACzB,4EAA4E;QAC5E,iFAAiF;QACjF,MAAM,SAAS,GAAG,GAAG,CAAC,IAAI,EAAE,KAAK,IAAI,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,IAAI,EAAE,CAAA;QAChE,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAC1D,OAAO,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,mBAAmB,EAAE,CAAA;QACvD,CAAC;IACH,CAAC;IACD,IAAI,GAAG,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC/B,MAAM,SAAS,GAAG,GAAG,CAAC,IAAI,EAAE,WAAW,IAAI,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,WAAW,IAAI,EAAE,CAAA;QAC5E,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACjE,OAAO,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,0BAA0B,EAAE,CAAA;QAC9D,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAA;AAClB,CAAC;AAED,MAAM,OAAO,SAAS;IACpB,QAAQ,GAAqC,IAAI,GAAG,EAAE,CAAA;IACtD,YAAY,GAAuE,IAAI,CAAA;IACvF,UAAU,CAAe;IAEzB;;;;;OAKG;IACH,YAAY,CAAC,SAAuB;QAClC,IAAI,CAAC,UAAU,GAAG,SAAS,CAAA;IAC7B,CAAC;IAED,8BAA8B;IAC9B,MAAM,CAAC,IAAY,EAAE,OAAmB;QACtC,MAAM,GAAG,GAAwB;YAC/B,IAAI;YACJ,OAAO;YACP,MAAM,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,YAAY,EAAE,MAAM,IAAI,EAAE,CAAC,CAAC;YAC9C,KAAK,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,YAAY,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC;YAC5C,WAAW,EAAE,EAAE;YACf,UAAU,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,YAAY,EAAE,UAAU,IAAI,EAAE,CAAC,CAAC;SACvD,CAAA;QACD,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,CAAA;QAC5B,OAAO,IAAI,gBAAgB,CAAC,GAAG,CAAC,CAAA;IAClC,CAAC;IAED,8EAA8E;IAC9E,SAAS,CACP,MAAc,EACd,UAAuF;QAEvF,MAAM,KAAK,GAAG,UAAU,CAAC,SAAS,CAAA;QAClC,MAAM,OAAO,GAAG,MAAM,CAAC,mBAAmB,CAAC,KAAK,CAAC,CAAC,MAAM,CACtD,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,aAAa,IAAI,OAAO,KAAK,CAAC,CAAC,CAAC,KAAK,UAAU,CAC7D,CAAA;QACD,KAAK,MAAM,UAAU,IAAI,OAAO,EAAE,CAAC;YACjC,IAAI,CAAC,MAAM,CAAC,GAAG,MAAM,IAAI,UAAU,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE;gBAC3D,qEAAqE;gBACrE,gEAAgE;gBAChE,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,UAAU,EAAE,CAAA;gBACtF,OAAO,QAAQ,CAAC,UAAU,CAAC,CAAC,GAAG,EAAE,MAAM,CAAC,CAAA;YAC1C,CAAC,CAAC,CAAA;QACJ,CAAC;IACH,CAAC;IAED,mDAAmD;IACnD,KAAK,CACH,MAAoE,EACpE,QAAkC;QAElC,MAAM,UAAU,GAAG,IAAI,CAAC,YAAY,CAAA;QACpC,IAAI,CAAC,YAAY,GAAG;YAClB,MAAM,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YAC3E,KAAK,EAAE,EAAE;YACT,UAAU,EAAE,MAAM,CAAC,UAAU,IAAI,EAAE;SACpC,CAAA;QACD,2EAA2E;QAC3E,2EAA2E;QAC3E,IAAI,CAAC;YACH,QAAQ,CAAC,IAAI,CAAC,CAAA;QAChB,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC,YAAY,GAAG,UAAU,CAAA;QAChC,CAAC;IACH,CAAC;IAED,2CAA2C;IAC3C,KAAK,CAAC,MAAM,CAAC,GAAgB;QAC3B,4EAA4E;QAC5E,8EAA8E;QAC9E,mEAAmE;QACnE,MAAM,IAAI,GAAG,eAAe,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAA;QAEhD,wCAAwC;QACxC,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YACxB,IAAI,IAAI,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;gBACrB,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;oBAC5B,OAAO,EAAE,KAAK;oBACd,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,0BAA0B,EAAE;oBAC5D,EAAE,EAAE,IAAI;iBACT,CAAC,CAAA;gBACF,OAAM;YACR,CAAC;YACD,qFAAqF;YACrF,0EAA0E;YAC1E,+BAA+B;YAC/B,MAAM,OAAO,GAAc,EAAE,CAAA;YAC7B,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;gBACvB,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;gBAC1C,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC;oBAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;YAC3C,CAAC;YACD,wEAAwE;YACxE,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACzB,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;gBACjC,OAAM;YACR,CAAC;YACD,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;YACtC,OAAM;QACR,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;QAChD,qEAAqE;QACrE,IAAI,cAAc,CAAC,IAAI,CAAC,EAAE,CAAC;YACzB,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;YACjC,OAAM;QACR,CAAC;QACD,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;IACvC,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,cAAc,CAAC,GAAgB,EAAE,KAAe;QACpD,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,EAAE,GAAG,CAAC,YAAY,CAAC;YACjD,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAqB,YAAY,CAAC;YAC3D,CAAC,CAAC,SAAS,CAAA;QACb,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,KAAK,CACb,4CAA4C,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,uEAAuE,CACpI,CAAA;QACH,CAAC;QACD,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;YAC7B,MAAM,EAAE,GAAG,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;YAC7B,IAAI,CAAC,EAAE,EAAE,CAAC;gBACR,MAAM,IAAI,KAAK,CAAC,8CAA8C,IAAI,sBAAsB,CAAC,CAAA;YAC3F,CAAC;YACD,OAAO,EAAE,CAAA;QACX,CAAC,CAAC,CAAA;QACF,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,KAAK,IAAI,EAAE,GAAE,CAAC,CAAC,CAAA;IACzC,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,GAAgB,EAAE,OAAgB;QAClD,MAAM,MAAM,GAAG,eAAe,CAAC,OAAO,CAAC,CAAA;QACvC,IAAI,CAAC,MAAM,CAAC,EAAE;YAAE,OAAO,MAAM,CAAC,QAAQ,CAAA;QACtC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,GAAG,MAAM,CAAA;QAErC,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;QACrC,IAAI,CAAC,GAAG;YAAE,OAAO,QAAQ,CAAC,CAAC,KAAK,EAAE,kBAAkB,EAAE,EAAE,CAAC,CAAA;QAEzD,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,qBAAqB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;YAC9C,IAAI,MAAM;gBAAE,OAAO,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,OAAO,EAAE,EAAE,CAAC,CAAA;YAE5D,2EAA2E;YAC3E,0CAA0C;YAC1C,IAAI,GAAG,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC9B,MAAM,IAAI,CAAC,cAAc,CAAC,GAAG,EAAE,GAAG,CAAC,UAAU,CAAC,CAAA;YAChD,CAAC;YAED,yEAAyE;YACzE,8DAA8D;YAC9D,IAAI,eAAe,GAAG,MAAM,CAAA;YAC5B,IAAI,GAAG,CAAC,SAAS,EAAE,CAAC;gBAClB,MAAM,KAAK,GAAG,aAAa,GAAG,CAAC,SAAS,EAAE,CAAA;gBAC1C,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;oBACjC,OAAO,QAAQ,CACb,CAAC,KAAK,EACN,cAAc,GAAG,CAAC,SAAS,kDAAkD,KAAK,oBAAoB,EACtG,EAAE,CACH,CAAA;gBACH,CAAC;gBACD,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,CAAC,OAAO,CAAmB,KAAK,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;gBACjF,IAAI,CAAC,OAAO,CAAC,KAAK;oBAAE,OAAO,QAAQ,CAAC,CAAC,KAAK,EAAE,gBAAgB,EAAE,EAAE,EAAE,OAAO,CAAC,MAAM,CAAC,CAAA;gBACjF,eAAe,GAAG,OAAO,CAAC,IAAI,IAAI,MAAM,CAAA;YAC1C,CAAC;YAED,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,GAAG,EAAE,eAAe,CAAC,CAAA;YACtD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,CAAA;QACvC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,4EAA4E;YAC5E,2EAA2E;YAC3E,gEAAgE;YAChE,IAAI,gBAAgB,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC1B,MAAM,OAAO,GAAG,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,WAAW,CAAA;gBAC3E,OAAO,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,GAAG,CAAC,IAAI,CAAC,CAAA;YAClD,CAAC;YACD,6DAA6D;YAC7D,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,CAAA;YACnD,MAAM,OAAO,GAAG,KAAK,IAAI,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,gBAAgB,CAAA;YAC9E,OAAO,QAAQ,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE,CAAC,CAAA;QACtC,CAAC;IACH,CAAC;IAED,uCAAuC;IACvC,UAAU;QACR,OAAO,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAA;IAClC,CAAC;IAED,+CAA+C;IAC/C,SAAS,CAAC,IAAY;QACpB,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;IAChC,CAAC;CACF"}
|
|
Binary file
|
|
Binary file
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@c9up/ream",
|
|
3
|
-
"version": "0.1.
|
|
3
|
+
"version": "0.1.16",
|
|
4
4
|
"description": "Ream — Rust-powered Node.js application framework",
|
|
5
5
|
"license": "MIT",
|
|
6
6
|
"type": "module",
|
|
@@ -39,6 +39,14 @@
|
|
|
39
39
|
"types": "./dist/events/EventsProvider.d.ts",
|
|
40
40
|
"import": "./dist/events/EventsProvider.js"
|
|
41
41
|
},
|
|
42
|
+
"./rpc/provider": {
|
|
43
|
+
"types": "./dist/rpc/RpcProvider.d.ts",
|
|
44
|
+
"import": "./dist/rpc/RpcProvider.js"
|
|
45
|
+
},
|
|
46
|
+
"./rpc/router": {
|
|
47
|
+
"types": "./dist/rpc/RpcRouter.d.ts",
|
|
48
|
+
"import": "./dist/rpc/RpcRouter.js"
|
|
49
|
+
},
|
|
42
50
|
"./events/config": {
|
|
43
51
|
"types": "./dist/events/config.d.ts",
|
|
44
52
|
"import": "./dist/events/config.js"
|
|
@@ -103,13 +111,14 @@
|
|
|
103
111
|
"tsconfig.app.json"
|
|
104
112
|
],
|
|
105
113
|
"dependencies": {
|
|
114
|
+
"file-type": "^22.0.1",
|
|
106
115
|
"reflect-metadata": "^0.2"
|
|
107
116
|
},
|
|
108
117
|
"devDependencies": {
|
|
109
118
|
"@biomejs/biome": "^2.4.10",
|
|
110
119
|
"@types/node": "^22.19.15",
|
|
111
120
|
"typescript": "^6.0.2",
|
|
112
|
-
"vitest": "^4.1.
|
|
121
|
+
"vitest": "^4.1.6"
|
|
113
122
|
},
|
|
114
123
|
"engines": {
|
|
115
124
|
"node": ">=22.0.0"
|
|
Binary file
|
|
@@ -120,6 +120,10 @@ export default class BodyParserMiddleware {
|
|
|
120
120
|
if (payload) {
|
|
121
121
|
if (this.#rejectMultipart(ctx, payload.files, payload.fields)) return
|
|
122
122
|
const { fields, files } = hydrateMultipartPayload(payload)
|
|
123
|
+
// Fingerprint each file's real type from its magic bytes BEFORE handlers
|
|
124
|
+
// run, so `request.file(field, { extnames })` validates against the
|
|
125
|
+
// detected type (not the attacker-controlled filename/header).
|
|
126
|
+
await Promise.all(files.map((file) => file.detectType()))
|
|
123
127
|
ctx.request.setParsedBody(fields)
|
|
124
128
|
ctx.request.setFiles(files)
|
|
125
129
|
}
|
|
@@ -18,10 +18,11 @@ export class MultipartFile {
|
|
|
18
18
|
/** Original filename from the client. */
|
|
19
19
|
readonly clientName: string
|
|
20
20
|
|
|
21
|
-
/**
|
|
22
|
-
|
|
23
|
-
|
|
24
|
-
|
|
21
|
+
/**
|
|
22
|
+
* MIME type from the Content-Type header. ATTACKER-CONTROLLED — never trust it
|
|
23
|
+
* for security decisions or as a response Content-Type. Prefer
|
|
24
|
+
* {@link detectedType}, which is fingerprinted from the file's magic bytes.
|
|
25
|
+
*/
|
|
25
26
|
readonly type: string
|
|
26
27
|
|
|
27
28
|
/** File size in bytes. */
|
|
@@ -39,6 +40,12 @@ export class MultipartFile {
|
|
|
39
40
|
/** Whether the file has been moved. */
|
|
40
41
|
#moved = false
|
|
41
42
|
|
|
43
|
+
/** Extension derived from the (attacker-controlled) client filename. */
|
|
44
|
+
#clientExtname: string
|
|
45
|
+
|
|
46
|
+
/** Magic-byte fingerprint — set by {@link detectType}; absent for content `file-type` can't detect (text: txt/csv/svg/json). */
|
|
47
|
+
#detected?: { ext: string; mime: string }
|
|
48
|
+
|
|
42
49
|
constructor(options: {
|
|
43
50
|
fieldName: string
|
|
44
51
|
clientName: string
|
|
@@ -51,7 +58,37 @@ export class MultipartFile {
|
|
|
51
58
|
this.content = options.content
|
|
52
59
|
this.size = options.content.length
|
|
53
60
|
const segments = options.clientName.split('.')
|
|
54
|
-
this
|
|
61
|
+
this.#clientExtname = segments.length > 1 ? (segments.at(-1) ?? '').toLowerCase() : ''
|
|
62
|
+
}
|
|
63
|
+
|
|
64
|
+
/**
|
|
65
|
+
* Fingerprint the real file type from its magic bytes (via `file-type`), so
|
|
66
|
+
* validation + storage don't trust the attacker-controlled filename/header.
|
|
67
|
+
* Mirrors AdonisJS, which detects binary types this way. Call once after
|
|
68
|
+
* construction (the BodyParser middleware does this for every uploaded file).
|
|
69
|
+
* Content `file-type` can't fingerprint (text formats) leaves the client
|
|
70
|
+
* extension in force — same fallback AdonisJS uses.
|
|
71
|
+
*/
|
|
72
|
+
async detectType(): Promise<void> {
|
|
73
|
+
const { fileTypeFromBuffer } = await import('file-type')
|
|
74
|
+
const result = await fileTypeFromBuffer(this.content)
|
|
75
|
+
if (result) this.#detected = { ext: result.ext, mime: result.mime }
|
|
76
|
+
}
|
|
77
|
+
|
|
78
|
+
/**
|
|
79
|
+
* Magic-byte-detected MIME type — TRUSTWORTHY (content-derived). `undefined`
|
|
80
|
+
* for text formats `file-type` can't fingerprint. Use this, not {@link type}.
|
|
81
|
+
*/
|
|
82
|
+
get detectedType(): string | undefined {
|
|
83
|
+
return this.#detected?.mime
|
|
84
|
+
}
|
|
85
|
+
|
|
86
|
+
/**
|
|
87
|
+
* File extension without the dot — the magic-byte-detected one when available
|
|
88
|
+
* (defeats a renamed binary), else the client filename's extension.
|
|
89
|
+
*/
|
|
90
|
+
get extname(): string {
|
|
91
|
+
return this.#detected?.ext ?? this.#clientExtname
|
|
55
92
|
}
|
|
56
93
|
|
|
57
94
|
/** Validate file against size and extension rules. */
|
|
@@ -63,6 +100,8 @@ export class MultipartFile {
|
|
|
63
100
|
}
|
|
64
101
|
}
|
|
65
102
|
if (options.extnames && options.extnames.length > 0) {
|
|
103
|
+
// `this.extname` is the magic-byte-detected extension when available, so a
|
|
104
|
+
// binary renamed `evil.png` is validated by its real type, not its name.
|
|
66
105
|
if (!options.extnames.includes(this.extname)) {
|
|
67
106
|
this.errors.push(
|
|
68
107
|
`Extension '${this.extname}' not allowed. Allowed: ${options.extnames.join(', ')}`,
|
package/src/rpc/RpcRouter.ts
CHANGED
|
@@ -76,6 +76,27 @@ interface RpcErrorResponse {
|
|
|
76
76
|
id: unknown
|
|
77
77
|
}
|
|
78
78
|
|
|
79
|
+
/**
|
|
80
|
+
* Unwrap the `{ _body: [...] }` envelope `request.body()` puts around a
|
|
81
|
+
* top-level JSON array (it only treats plain objects as the body verbatim). A
|
|
82
|
+
* JSON-RPC batch arrives this way; a single request is a plain object and is
|
|
83
|
+
* returned unchanged.
|
|
84
|
+
*/
|
|
85
|
+
function unwrapBatchBody(value: unknown): unknown {
|
|
86
|
+
if (typeof value === 'object' && value !== null && '_body' in value) {
|
|
87
|
+
const inner = value._body
|
|
88
|
+
if (Array.isArray(inner)) return inner
|
|
89
|
+
}
|
|
90
|
+
return value
|
|
91
|
+
}
|
|
92
|
+
|
|
93
|
+
/** A handler error shaped like a JSON-RPC error — it carries a numeric `code`. */
|
|
94
|
+
function isRpcShapedError(
|
|
95
|
+
err: unknown,
|
|
96
|
+
): err is { code: number; message?: unknown; data?: unknown } {
|
|
97
|
+
return typeof err === 'object' && err !== null && 'code' in err && typeof err.code === 'number'
|
|
98
|
+
}
|
|
99
|
+
|
|
79
100
|
/** Build a JSON-RPC 2.0 error envelope. */
|
|
80
101
|
function rpcError(code: number, message: string, id: unknown, data?: unknown): RpcErrorResponse {
|
|
81
102
|
return {
|
|
@@ -225,7 +246,10 @@ export class RpcRouter {
|
|
|
225
246
|
|
|
226
247
|
/** Handle an incoming JSON-RPC request. */
|
|
227
248
|
async handle(ctx: HttpContext): Promise<void> {
|
|
228
|
-
|
|
249
|
+
// `request.body()` wraps a top-level JSON array — a JSON-RPC batch — as its
|
|
250
|
+
// non-object envelope `{ _body: [...] }`. Unwrap it so batch detection works;
|
|
251
|
+
// a single request is a plain object and passes through untouched.
|
|
252
|
+
const body = unwrapBatchBody(ctx.request.body())
|
|
229
253
|
|
|
230
254
|
// Batch support (max 50 to prevent DoS)
|
|
231
255
|
if (Array.isArray(body)) {
|
|
@@ -328,7 +352,14 @@ export class RpcRouter {
|
|
|
328
352
|
const result = await def.handler(ctx, effectiveParams)
|
|
329
353
|
return { jsonrpc: '2.0', result, id }
|
|
330
354
|
} catch (err) {
|
|
331
|
-
//
|
|
355
|
+
// Honor a JSON-RPC-shaped error thrown by a handler (one carrying a numeric
|
|
356
|
+
// `code`), so handlers can return domain errors — -32004 not-found, -32009
|
|
357
|
+
// conflict, etc. — instead of every throw collapsing to -32603.
|
|
358
|
+
if (isRpcShapedError(err)) {
|
|
359
|
+
const message = typeof err.message === 'string' ? err.message : 'RPC error'
|
|
360
|
+
return rpcError(err.code, message, id, err.data)
|
|
361
|
+
}
|
|
362
|
+
// Otherwise don't leak internal error details to the caller.
|
|
332
363
|
const isDev = process.env.NODE_ENV !== 'production'
|
|
333
364
|
const message = isDev && err instanceof Error ? err.message : 'Internal error'
|
|
334
365
|
return rpcError(-32603, message, id)
|