@cloudflare/sandbox 0.13.0-next.748.1 → 0.13.0-next.769.1

package/dist/bridge/index.js

@@ -1,7 +1,7 @@
 import "../errors-CXR0xBpw.js";
 import "../errors-QYlSkVGz.js";
 import "../dist-Duor5GbS.js";
-import { g as validateTunnelName, h as validatePort, m as SandboxSecurityError, n as getSandbox$1, x as streamFile } from "../sandbox-CXc1T45U.js";
+import { g as validateTunnelName, h as validatePort, m as SandboxSecurityError, n as getSandbox$1, x as streamFile } from "../sandbox-cmlgGVYX.js";
 import "../extensions-CFB2xHqY.js";
 import { DurableObject, env } from "cloudflare:workers";
 import { Hono } from "hono";

package/dist/index.js

@@ -1,7 +1,7 @@
 import "./errors-CXR0xBpw.js";
 import { $ as TerminalControlError, G as BackupRestoreError, H as BackupCreateError, J as InvalidTerminalCursorError, K as ContainerUnavailableError, Q as StaleTerminalHandleError, U as BackupExpiredError, W as BackupNotFoundError, X as OperationInterruptedError, Y as InvalidTerminalCwdError, Z as RPCTransportError, _ as StaleProcessHandleError, c as InvalidProcessEnvironmentError, d as ProcessExitedBeforeLogError, et as TerminalNotFoundError, f as ProcessExitedBeforeReadyError, g as ProcessWaitTimeoutError, h as ProcessSpawnFailedError, l as ProcessAbortedError, m as ProcessReadyTimeoutError, n as RuntimeIdentityInactiveError, o as InvalidProcessCursorError, p as ProcessNotFoundError, q as InvalidBackupConfigError, r as RuntimeControlProtocolError, s as InvalidProcessCwdError, u as ProcessError } from "./errors-QYlSkVGz.js";
 import { a as TraceContext, r as createLogger } from "./dist-Duor5GbS.js";
-import { _ as proxyTerminal, a as responseToAsyncIterable, b as collectFile, c as BucketUnmountError, d as S3FSMountError, f as parsePreviewRoute, i as parseSSEStream, l as InvalidMountConfigError, n as getSandbox, o as ContainerProxy, p as withPreviewProxyMetadata, r as asyncIterableToSSEStream, s as BucketMountError, t as Sandbox, u as MissingCredentialsError, v as isDurableObjectCodeUpdateReset, x as streamFile, y as isPlatformTransientError } from "./sandbox-CXc1T45U.js";
+import { _ as proxyTerminal, a as responseToAsyncIterable, b as collectFile, c as BucketUnmountError, d as S3FSMountError, f as parsePreviewRoute, i as parseSSEStream, l as InvalidMountConfigError, n as getSandbox, o as ContainerProxy, p as withPreviewProxyMetadata, r as asyncIterableToSSEStream, s as BucketMountError, t as Sandbox, u as MissingCredentialsError, v as isDurableObjectCodeUpdateReset, x as streamFile, y as isPlatformTransientError } from "./sandbox-cmlgGVYX.js";
 import "./extensions-CFB2xHqY.js";
 
 //#region src/request-handler.ts

package/dist/{sandbox-CXc1T45U.js → sandbox-cmlgGVYX.js}

@@ -714,6 +714,13 @@ function xmlResponse(body, status = 200) {
 function normalizeObjectKey(value) {
 	return value.replace(/^\/+/, "");
 }
+function decodeObjectKey(value) {
+	try {
+		return decodeURIComponent(value);
+	} catch {
+		return value;
+	}
+}
 function trimTrailingSlashes(s) {
 	let end = s.length;
 	while (end > 0 && s[end - 1] === "/") end--;
@@ -1001,7 +1008,8 @@ const r2EgressHandler = async (request, env$1, ctx) => {
 	const url = new URL(request.url);
 	const parsed = parsePath(url.pathname);
 	if (!parsed) return new Response("Bad Request: empty path", { status: 400 });
-	const { bucket: bucketName, key } = parsed;
+	const { bucket: bucketName, key: encodedKey } = parsed;
+	const key = decodeObjectKey(encodedKey);
 	if (!ctx.params?.buckets || !(bucketName in ctx.params.buckets)) return new Response(`Access to R2 bucket "${bucketName}" is not permitted. Call mountBucket() with this bucket before accessing it.`, { status: 403 });
 	const bucketParams = ctx.params.buckets[bucketName];
 	const mountPrefix = normalizeMountPrefix(bucketParams.prefix);
@@ -1300,6 +1308,10 @@ function isBucketRootProbe(request, realPath, url, bucket) {
 	const method = request.method.toUpperCase();
 	return (method === "GET" || method === "HEAD") && url.search === "" && getObjectKeyForPath(realPath, bucket) === "";
 }
+function isBucketRootMutation(request, realPath, bucket) {
+	const method = request.method.toUpperCase();
+	return method !== "GET" && method !== "HEAD" && method !== "OPTIONS" && getObjectKeyForPath(realPath, bucket) === "";
+}
 function deleteDirectoryMarkerCacheEntry(mountId, realPath) {
 	directoryMarkerCache.delete(getDirectoryMarkerCacheKey(mountId, realPath));
 }
@@ -1423,6 +1435,7 @@ const s3CredentialProxyHandler = async (request, env$1, ctx) => {
 	}
 	const realUrl = new URL(realPath + (url.search || ""), mount.endpoint);
 	if (isBucketRootProbe(request, realPath, url, mount.bucket)) return new Response(null, { status: 200 });
+	if (isBucketRootMutation(request, realPath, mount.bucket)) return new Response("Method Not Allowed", { status: 405 });
 	if (!isRequestWithinMountScope(realPath, url, mount.bucket, mount.prefix)) return new Response("Forbidden: request is outside mounted bucket scope", { status: 403 });
 	const copySourceError = validateCopySourceWithinMountScope(request.headers, mount.bucket, mount.prefix);
 	if (copySourceError) return copySourceError;
@@ -10040,4 +10053,4 @@ var Sandbox = class extends Container {
 
 //#endregion
 export { proxyTerminal as _, responseToAsyncIterable as a, collectFile as b, BucketUnmountError as c, S3FSMountError as d, parsePreviewRoute as f, validateTunnelName as g, validatePort as h, parseSSEStream as i, InvalidMountConfigError as l, SandboxSecurityError as m, getSandbox as n, ContainerProxy$1 as o, withPreviewProxyMetadata as p, asyncIterableToSSEStream as r, BucketMountError as s, Sandbox as t, MissingCredentialsError as u, isDurableObjectCodeUpdateReset as v, streamFile as x, isPlatformTransientError as y };
-//# sourceMappingURL=sandbox-CXc1T45U.js.map
+//# sourceMappingURL=sandbox-cmlgGVYX.js.map