@cloudflare/sandbox 0.12.5 → 0.12.6

package/dist/bridge/index.js

@@ -1,6 +1,6 @@
 import "../dist-B_eXrP83.js";
 import "../errors-CpkKPbWC.js";
-import { S as validateTunnelName, r as getSandbox, w as streamFile, x as validatePort, y as SandboxSecurityError } from "../sandbox-sU3r5LSr.js";
+import { S as validateTunnelName, r as getSandbox, w as streamFile, x as validatePort, y as SandboxSecurityError } from "../sandbox-FBmZ9mj1.js";
 import { DurableObject, env, tracing } from "cloudflare:workers";
 import { Hono } from "hono";
 

package/dist/index.js

@@ -1,6 +1,6 @@
 import { a as isExecResult, f as TraceContext, o as isProcess, s as isProcessStatus, u as createLogger } from "./dist-B_eXrP83.js";
 import "./errors-CpkKPbWC.js";
-import { A as PortClient, B as InvalidBackupConfigError, C as collectFile, D as SandboxClient, E as isPlatformTransientError, F as BackupCreateError, G as SessionTerminatedError, H as ProcessExitedBeforeReadyError, I as BackupExpiredError, L as BackupNotFoundError, M as FileClient, N as CommandClient, O as UtilityClient, P as BackupClient, R as BackupRestoreError, T as isDurableObjectCodeUpdateReset, U as ProcessReadyTimeoutError, V as OperationInterruptedError, W as RPCTransportError, _ as responseToAsyncIterable, a as PREVIEW_PROXY_HEADER, b as sanitizeSandboxId, c as PREVIEW_PROXY_SANDBOX_ID_HEADER, d as BucketUnmountError, f as InvalidMountConfigError, g as parseSSEStream, h as asyncIterableToSSEStream, i as proxyTerminal, j as GitClient, k as ProcessClient, l as PREVIEW_PROXY_TOKEN_HEADER, m as S3FSMountError, n as Sandbox, o as PREVIEW_PROXY_HEADERS, p as MissingCredentialsError, r as getSandbox, s as PREVIEW_PROXY_PORT_HEADER, t as ContainerProxy, u as BucketMountError, v as CodeInterpreter, w as streamFile, x as validatePort, z as ContainerUnavailableError } from "./sandbox-sU3r5LSr.js";
+import { A as PortClient, B as InvalidBackupConfigError, C as collectFile, D as SandboxClient, E as isPlatformTransientError, F as BackupCreateError, G as SessionTerminatedError, H as ProcessExitedBeforeReadyError, I as BackupExpiredError, L as BackupNotFoundError, M as FileClient, N as CommandClient, O as UtilityClient, P as BackupClient, R as BackupRestoreError, T as isDurableObjectCodeUpdateReset, U as ProcessReadyTimeoutError, V as OperationInterruptedError, W as RPCTransportError, _ as responseToAsyncIterable, a as PREVIEW_PROXY_HEADER, b as sanitizeSandboxId, c as PREVIEW_PROXY_SANDBOX_ID_HEADER, d as BucketUnmountError, f as InvalidMountConfigError, g as parseSSEStream, h as asyncIterableToSSEStream, i as proxyTerminal, j as GitClient, k as ProcessClient, l as PREVIEW_PROXY_TOKEN_HEADER, m as S3FSMountError, n as Sandbox, o as PREVIEW_PROXY_HEADERS, p as MissingCredentialsError, r as getSandbox, s as PREVIEW_PROXY_PORT_HEADER, t as ContainerProxy, u as BucketMountError, v as CodeInterpreter, w as streamFile, x as validatePort, z as ContainerUnavailableError } from "./sandbox-FBmZ9mj1.js";
 
 //#region src/request-handler.ts
 function createProxyLogger(request) {

package/dist/opencode/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","names":[],"sources":["../../src/opencode/types.ts","../../src/opencode/opencode.ts"],"sourcesContent":[],"mappings":";;;;;;;;;AAOiB,UAAA,eAAA,CAAe;EAcf;EAaA,IAAA,CAAA,EAAA,MAAA;EAAyB;EAEhC,SAAA,CAAA,EAAA,MAAA;EAEA;EAAc,MAAA,CAAA,EAzBb,MAyBa;EAMX;EAEc,GAAA,CAAA,EA/BnB,MA+BmB,CAAA,MAAA,EAAA,MAAA,CAAA;;;;;UAzBV,cAAA;;;ECsSK;EACX,GAAA,EAAA,MAAA;EACC;EACD,KAAA,EAAA,EDnSA,OCmSA,CAAA,IAAA,CAAA;;;AAqEX;;;AAEY,UDnWK,cCmWL,CAAA,UDnW8B,cCmW9B,CAAA,CAAA;EACc;EAAf,MAAA,EDlWD,OCkWC;EAAR;EAAO,MAAA,EDhWA,cCgWA;AA0BV;;;;AAIW,cDxXE,oBAAA,SAA6B,KAAA,CCwX/B;EAAR,SAAA,IAAA,EAAA,yBAAA;EAAO,SAAA,OAAA,EDtXiB,sBCsXjB;EAmDM,WAAA,CAAA,OAAe,EAAA,MAAA,EAAA,OAAA,EDralB,sBCqakB,EAAA,OAAA,CAAA,EDpajB,YCoaiB;;;;;;;ADhd/B;AAcA;AAaA;;;;;AAUA;;;;;;;;;AC+QA;;;;;;AAwEA;;;;;;;;AA6BA;;;;;;;AAuDA;;;;;;AAIc,iBAhKQ,oBAAA,CAgKR,OAAA,EA/JH,OA+JG,CAAA,OAAA,CAAA,EAAA,OAAA,CAAA,EA9JF,eA8JE,CAAA,EA7JX,OA6JW,CA7JH,cA6JG,CAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAxFQ,yBAAyB,yBACpC,4BACC,kBACT,QAAQ,eAAe;;;;;;;;iBA0BV,qBAAA,UACL,kBACA,0BACD,iBACP,QAAQ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAmDK,eAAA,UACL,kBACA,0BACD,iBACP,WAAW,QAAQ"}
+{"version":3,"file":"index.d.ts","names":[],"sources":["../../src/opencode/types.ts","../../src/opencode/opencode.ts"],"sourcesContent":[],"mappings":";;;;;;;;;AAOiB,UAAA,eAAA,CAMN;EAQM;EAaA,IAAA,CAAA,EAAA,MAAA;EAAyB;EAEhC,SAAA,CAAA,EAAA,MAAA;EAEA;EAAc,MAAA,CAAA,EAzBb,MAyBa;EAMX;EAEc,GAAA,CAAA,EA/BnB,MA+BmB,CAAA,MAAA,EAAA,MAAA,CAAA;;;;;UAzBV,cAAA;;;ECsSK;EACX,GAAA,EAAA,MAAA;EACC;EACD,KAAA,EAAA,EDnSA,OCmSA,CAAA,IAAA,CAAA;;;AAqEX;;;AAEY,UDnWK,cCmWL,CAAA,UDnW8B,cCmW9B,CAAA,CAAA;EACc;EAAf,MAAA,EDlWD,OCkWC;EAAR;EAAO,MAAA,EDhWA,cCgWA;AA0BV;;;;AAIW,cDxXE,oBAAA,SAA6B,KAAA,CCwX/B;EAAR,SAAA,IAAA,EAAA,yBAAA;EAAO,SAAA,OAAA,EDtXiB,sBCsXjB;EAmDM,WAAA,CAAA,OAAe,EAAA,MAAA,EAAA,OAAA,EDralB,sBCqakB,EAAA,OAAA,CAAA,EDpajB,YCoaiB;;;;;;;ADhd/B;AAcA;AAaA;;;;;AAUA;;;;;;;;;AC+QA;;;;;;AAwEA;;;;;;;;AA6BA;;;;;;;AAuDA;;;;;;AAIc,iBAhKQ,oBAAA,CAgKR,OAAA,EA/JH,OA+JG,CAAA,OAAA,CAAA,EAAA,OAAA,CAAA,EA9JF,eA8JE,CAAA,EA7JX,OA6JW,CA7JH,cA6JG,CAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAxFQ,yBAAyB,yBACpC,4BACC,kBACT,QAAQ,eAAe;;;;;;;;iBA0BV,qBAAA,UACL,kBACA,0BACD,iBACP,QAAQ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAmDK,eAAA,UACL,kBACA,0BACD,iBACP,WAAW,QAAQ"}

package/dist/{sandbox-sU3r5LSr.js → sandbox-FBmZ9mj1.js}

@@ -5864,6 +5864,33 @@ function isObjectKeyWithinPrefix(objectKey, prefix) {
 	if (!normalizedPrefix) return true;
 	return objectKey === normalizedPrefix || objectKey.startsWith(`${normalizedPrefix}/`);
 }
+function parseCopySourceHeader(value) {
+	const encodedPath = value.split("?", 1)[0];
+	if (!encodedPath) return null;
+	let decodedPath;
+	try {
+		decodedPath = decodeURIComponent(encodedPath);
+	} catch {
+		return null;
+	}
+	const path$1 = decodedPath.startsWith("/") ? decodedPath.slice(1) : decodedPath;
+	const separatorIndex = path$1.indexOf("/");
+	if (separatorIndex <= 0 || separatorIndex === path$1.length - 1) return null;
+	return {
+		bucket: path$1.slice(0, separatorIndex),
+		objectKey: path$1.slice(separatorIndex + 1)
+	};
+}
+function validateCopySourceWithinMountScope(headers, bucket, prefix) {
+	const copySources = [["x-amz-copy-source", headers.get("x-amz-copy-source")], ["x-goog-copy-source", headers.get("x-goog-copy-source")]].filter((entry) => entry[1] !== null);
+	if (copySources.length > 1) return new Response("Bad Request: multiple copy source headers", { status: 400 });
+	if (copySources.length === 0) return null;
+	const [headerName, value] = copySources[0];
+	const copySource = parseCopySourceHeader(value);
+	if (!copySource) return new Response(`Bad Request: invalid ${headerName}`, { status: 400 });
+	if (copySource.bucket !== bucket || !isObjectKeyWithinPrefix(copySource.objectKey, prefix)) return new Response("Forbidden: copy source is outside mounted scope", { status: 403 });
+	return null;
+}
 function isRequestWithinMountScope(realPath, url, bucket, prefix) {
 	const objectKey = getObjectKeyForPath(realPath, bucket);
 	if (objectKey === null) return false;
@@ -6001,6 +6028,8 @@ const s3CredentialProxyHandler = async (request, env$1, ctx) => {
 	const realUrl = new URL(realPath + (url.search || ""), mount.endpoint);
 	if (isBucketRootProbe(request, realPath, url, mount.bucket)) return new Response(null, { status: 200 });
 	if (!isRequestWithinMountScope(realPath, url, mount.bucket, mount.prefix)) return new Response("Forbidden: request is outside mounted bucket scope", { status: 403 });
+	const copySourceError = validateCopySourceWithinMountScope(request.headers, mount.bucket, mount.prefix);
+	if (copySourceError) return copySourceError;
 	const cleanHeaders = buildCleanHeaders(request.headers);
 	const cleanRequest = new Request(realUrl.toString(), {
 		method: request.method,
@@ -7139,7 +7168,7 @@ function createTunnelsHandler(host) {
 * This file is auto-updated by .github/changeset-version.ts during releases
 * DO NOT EDIT MANUALLY - Changes will be overwritten on the next version bump
 */
-const SDK_VERSION = "0.12.5";
+const SDK_VERSION = "0.12.6";
 
 //#endregion
 //#region src/sandbox.ts
@@ -11520,4 +11549,4 @@ var Sandbox = class Sandbox extends Container {
 
 //#endregion
 export { PortClient as A, InvalidBackupConfigError as B, collectFile as C, SandboxClient as D, isPlatformTransientError as E, BackupCreateError as F, SessionTerminatedError as G, ProcessExitedBeforeReadyError as H, BackupExpiredError as I, BackupNotFoundError as L, FileClient as M, CommandClient as N, UtilityClient as O, BackupClient as P, BackupRestoreError as R, validateTunnelName as S, isDurableObjectCodeUpdateReset as T, ProcessReadyTimeoutError as U, OperationInterruptedError as V, RPCTransportError as W, responseToAsyncIterable as _, PREVIEW_PROXY_HEADER as a, sanitizeSandboxId as b, PREVIEW_PROXY_SANDBOX_ID_HEADER as c, BucketUnmountError as d, InvalidMountConfigError as f, parseSSEStream as g, asyncIterableToSSEStream as h, proxyTerminal as i, GitClient as j, ProcessClient as k, PREVIEW_PROXY_TOKEN_HEADER as l, S3FSMountError as m, Sandbox as n, PREVIEW_PROXY_HEADERS as o, MissingCredentialsError as p, getSandbox as r, PREVIEW_PROXY_PORT_HEADER as s, ContainerProxy$1 as t, BucketMountError as u, CodeInterpreter as v, streamFile as w, validatePort as x, SandboxSecurityError as y, ContainerUnavailableError as z };
-//# sourceMappingURL=sandbox-sU3r5LSr.js.map
+//# sourceMappingURL=sandbox-FBmZ9mj1.js.map