@depup/payload 3.79.1-depup.0

package/dist/uploads/checkFileRestrictions.js

@@ -0,0 +1,315 @@
+import { fileTypeFromBuffer } from 'file-type';
+import { ValidationError } from '../errors/index.js';
+import { validateMimeType } from '../utilities/validateMimeType.js';
+import { validatePDF } from '../utilities/validatePDF.js';
+import { detectSvgFromXml } from './detectSvgFromXml.js';
+import { getFileTypeFallback } from './getFileTypeFallback.js';
+import { validateSvg } from './validateSvg.js';
+/**
+ * Restricted file types and their extensions.
+ */ export const RESTRICTED_FILE_EXT_AND_TYPES = [
+    {
+        extensions: [
+            'exe',
+            'dll'
+        ],
+        mimeType: 'application/x-msdownload'
+    },
+    {
+        extensions: [
+            'exe',
+            'com',
+            'app',
+            'action'
+        ],
+        mimeType: 'application/x-executable'
+    },
+    {
+        extensions: [
+            'bat',
+            'cmd'
+        ],
+        mimeType: 'application/x-msdos-program'
+    },
+    {
+        extensions: [
+            'exe',
+            'com'
+        ],
+        mimeType: 'application/x-ms-dos-executable'
+    },
+    {
+        extensions: [
+            'dmg'
+        ],
+        mimeType: 'application/x-apple-diskimage'
+    },
+    {
+        extensions: [
+            'deb'
+        ],
+        mimeType: 'application/x-debian-package'
+    },
+    {
+        extensions: [
+            'rpm'
+        ],
+        mimeType: 'application/x-redhat-package-manager'
+    },
+    {
+        extensions: [
+            'exe',
+            'dll'
+        ],
+        mimeType: 'application/vnd.microsoft.portable-executable'
+    },
+    {
+        extensions: [
+            'msi'
+        ],
+        mimeType: 'application/x-msi'
+    },
+    {
+        extensions: [
+            'jar',
+            'ear',
+            'war'
+        ],
+        mimeType: 'application/java-archive'
+    },
+    {
+        extensions: [
+            'desktop'
+        ],
+        mimeType: 'application/x-desktop'
+    },
+    {
+        extensions: [
+            'cpl'
+        ],
+        mimeType: 'application/x-cpl'
+    },
+    {
+        extensions: [
+            'lnk'
+        ],
+        mimeType: 'application/x-ms-shortcut'
+    },
+    {
+        extensions: [
+            'pkg'
+        ],
+        mimeType: 'application/x-apple-installer'
+    },
+    {
+        extensions: [
+            'htm',
+            'html',
+            'shtml',
+            'xhtml'
+        ],
+        mimeType: 'text/html'
+    },
+    {
+        extensions: [
+            'php',
+            'phtml'
+        ],
+        mimeType: 'application/x-httpd-php'
+    },
+    {
+        extensions: [
+            'js',
+            'jse'
+        ],
+        mimeType: 'text/javascript'
+    },
+    {
+        extensions: [
+            'jsp'
+        ],
+        mimeType: 'application/x-jsp'
+    },
+    {
+        extensions: [
+            'py'
+        ],
+        mimeType: 'text/x-python'
+    },
+    {
+        extensions: [
+            'rb'
+        ],
+        mimeType: 'text/x-ruby'
+    },
+    {
+        extensions: [
+            'pl'
+        ],
+        mimeType: 'text/x-perl'
+    },
+    {
+        extensions: [
+            'ps1',
+            'psc1',
+            'psd1',
+            'psh',
+            'psm1'
+        ],
+        mimeType: 'application/x-powershell'
+    },
+    {
+        extensions: [
+            'vbe',
+            'vbs'
+        ],
+        mimeType: 'application/x-vbscript'
+    },
+    {
+        extensions: [
+            'ws',
+            'wsc',
+            'wsf',
+            'wsh'
+        ],
+        mimeType: 'application/x-ms-wsh'
+    },
+    {
+        extensions: [
+            'scr'
+        ],
+        mimeType: 'application/x-msdownload'
+    },
+    {
+        extensions: [
+            'asp',
+            'aspx'
+        ],
+        mimeType: 'application/x-asp'
+    },
+    {
+        extensions: [
+            'hta'
+        ],
+        mimeType: 'application/x-hta'
+    },
+    {
+        extensions: [
+            'reg'
+        ],
+        mimeType: 'application/x-registry'
+    },
+    {
+        extensions: [
+            'url'
+        ],
+        mimeType: 'application/x-url'
+    },
+    {
+        extensions: [
+            'workflow'
+        ],
+        mimeType: 'application/x-workflow'
+    },
+    {
+        extensions: [
+            'command'
+        ],
+        mimeType: 'application/x-command'
+    }
+];
+export const checkFileRestrictions = async ({ collection, file, req })=>{
+    const errors = [];
+    const { upload: uploadConfig } = collection;
+    const useTempFiles = req?.payload?.config?.upload?.useTempFiles ?? false;
+    const configMimeTypes = uploadConfig && typeof uploadConfig === 'object' && 'mimeTypes' in uploadConfig && Array.isArray(uploadConfig.mimeTypes) ? uploadConfig.mimeTypes : [];
+    const allowRestrictedFileTypes = uploadConfig && typeof uploadConfig === 'object' && 'allowRestrictedFileTypes' in uploadConfig ? uploadConfig.allowRestrictedFileTypes : false;
+    const expectsDetectableType = (mimeType)=>{
+        const textBasedTypes = [
+            '/svg',
+            'image/svg+xml',
+            'image/x-xbitmap',
+            'image/x-xpixmap'
+        ];
+        if (textBasedTypes.includes(mimeType)) {
+            return false;
+        }
+        return mimeType.startsWith('image/') || mimeType.startsWith('video/') || mimeType.startsWith('audio/') || mimeType === 'application/pdf';
+    };
+    // Skip validation if `allowRestrictedFileTypes` is true
+    if (allowRestrictedFileTypes) {
+        return;
+    }
+    // Secondary mimetype check to assess file type from buffer
+    if (configMimeTypes.length > 0) {
+        let detected = await fileTypeFromBuffer(file.data);
+        const typeFromExtension = file.name.split('.').pop() || '';
+        // Handle SVG files that are detected as XML due to <?xml declarations
+        if (detected?.mime === 'application/xml' && configMimeTypes.some((type)=>type.includes('image/') && (type.includes('svg') || type === 'image/*'))) {
+            const isSvg = detectSvgFromXml(file.data);
+            if (isSvg) {
+                detected = {
+                    ext: 'svg',
+                    mime: 'image/svg+xml'
+                };
+            }
+        }
+        if (!detected && !useTempFiles) {
+            const mimeTypeFromExtension = getFileTypeFallback(file.name).mime;
+            const extIsValid = validateMimeType(mimeTypeFromExtension, configMimeTypes);
+            if (!extIsValid) {
+                errors.push(`File type ${mimeTypeFromExtension} (from extension ${typeFromExtension}) is not allowed.`);
+            } else {
+                // SVG security check (text-based files not detectable by buffer)
+                if (typeFromExtension.toLowerCase() === 'svg') {
+                    const isSafeSvg = validateSvg(file.data);
+                    if (!isSafeSvg) {
+                        errors.push('SVG file contains potentially harmful content.');
+                    }
+                }
+                // PDF validation
+                if (mimeTypeFromExtension === 'application/pdf') {
+                    const isValidPDF = validatePDF(file.data);
+                    if (!isValidPDF) {
+                        errors.push('Invalid or corrupted PDF file.');
+                    }
+                }
+            }
+            if (expectsDetectableType(mimeTypeFromExtension)) {
+                req.payload.logger.warn(`File buffer returned no detectable MIME type for ${file.name}. Falling back to extension-based validation.`);
+            }
+        }
+        const passesMimeTypeCheck = detected?.mime && validateMimeType(detected.mime, configMimeTypes);
+        if (passesMimeTypeCheck && detected?.mime === 'application/pdf') {
+            const isValidPDF = validatePDF(file?.data);
+            if (!isValidPDF) {
+                errors.push('Invalid PDF file.');
+            }
+        }
+        if (detected && !passesMimeTypeCheck) {
+            errors.push(`Invalid MIME type: ${detected.mime}.`);
+        }
+    } else {
+        const isRestricted = RESTRICTED_FILE_EXT_AND_TYPES.some((type)=>{
+            const hasRestrictedExt = type.extensions.some((ext)=>file.name.toLowerCase().endsWith(ext));
+            const hasRestrictedMime = type.mimeType === file.mimetype;
+            return hasRestrictedExt || hasRestrictedMime;
+        });
+        if (isRestricted) {
+            errors.push(`File type '${file.mimetype}' not allowed ${file.name}: Restricted file type detected -- set 'allowRestrictedFileTypes' to true to skip this check for this Collection.`);
+        }
+    }
+    if (errors.length > 0) {
+        req.payload.logger.error(errors.join(', '));
+        throw new ValidationError({
+            errors: [
+                {
+                    message: errors.join(', '),
+                    path: 'file'
+                }
+            ]
+        });
+    }
+};
+
+//# sourceMappingURL=checkFileRestrictions.js.map

package/dist/uploads/checkFileRestrictions.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/uploads/checkFileRestrictions.ts"],"sourcesContent":["import { fileTypeFromBuffer } from 'file-type'\n\nimport type { checkFileRestrictionsParams, FileAllowList } from './types.js'\n\nimport { ValidationError } from '../errors/index.js'\nimport { validateMimeType } from '../utilities/validateMimeType.js'\nimport { validatePDF } from '../utilities/validatePDF.js'\nimport { detectSvgFromXml } from './detectSvgFromXml.js'\nimport { getFileTypeFallback } from './getFileTypeFallback.js'\nimport { validateSvg } from './validateSvg.js'\n\n/**\n * Restricted file types and their extensions.\n */\nexport const RESTRICTED_FILE_EXT_AND_TYPES: FileAllowList = [\n  { extensions: ['exe', 'dll'], mimeType: 'application/x-msdownload' },\n  { extensions: ['exe', 'com', 'app', 'action'], mimeType: 'application/x-executable' },\n  { extensions: ['bat', 'cmd'], mimeType: 'application/x-msdos-program' },\n  { extensions: ['exe', 'com'], mimeType: 'application/x-ms-dos-executable' },\n  { extensions: ['dmg'], mimeType: 'application/x-apple-diskimage' },\n  { extensions: ['deb'], mimeType: 'application/x-debian-package' },\n  { extensions: ['rpm'], mimeType: 'application/x-redhat-package-manager' },\n  { extensions: ['exe', 'dll'], mimeType: 'application/vnd.microsoft.portable-executable' },\n  { extensions: ['msi'], mimeType: 'application/x-msi' },\n  { extensions: ['jar', 'ear', 'war'], mimeType: 'application/java-archive' },\n  { extensions: ['desktop'], mimeType: 'application/x-desktop' },\n  { extensions: ['cpl'], mimeType: 'application/x-cpl' },\n  { extensions: ['lnk'], mimeType: 'application/x-ms-shortcut' },\n  { extensions: ['pkg'], mimeType: 'application/x-apple-installer' },\n  { extensions: ['htm', 'html', 'shtml', 'xhtml'], mimeType: 'text/html' },\n  { extensions: ['php', 'phtml'], mimeType: 'application/x-httpd-php' },\n  { extensions: ['js', 'jse'], mimeType: 'text/javascript' },\n  { extensions: ['jsp'], mimeType: 'application/x-jsp' },\n  { extensions: ['py'], mimeType: 'text/x-python' },\n  { extensions: ['rb'], mimeType: 'text/x-ruby' },\n  { extensions: ['pl'], mimeType: 'text/x-perl' },\n  { extensions: ['ps1', 'psc1', 'psd1', 'psh', 'psm1'], mimeType: 'application/x-powershell' },\n  { extensions: ['vbe', 'vbs'], mimeType: 'application/x-vbscript' },\n  { extensions: ['ws', 'wsc', 'wsf', 'wsh'], mimeType: 'application/x-ms-wsh' },\n  { extensions: ['scr'], mimeType: 'application/x-msdownload' },\n  { extensions: ['asp', 'aspx'], mimeType: 'application/x-asp' },\n  { extensions: ['hta'], mimeType: 'application/x-hta' },\n  { extensions: ['reg'], mimeType: 'application/x-registry' },\n  { extensions: ['url'], mimeType: 'application/x-url' },\n  { extensions: ['workflow'], mimeType: 'application/x-workflow' },\n  { extensions: ['command'], mimeType: 'application/x-command' },\n]\n\nexport const checkFileRestrictions = async ({\n  collection,\n  file,\n  req,\n}: checkFileRestrictionsParams): Promise<void> => {\n  const errors: string[] = []\n  const { upload: uploadConfig } = collection\n  const useTempFiles = req?.payload?.config?.upload?.useTempFiles ?? false\n  const configMimeTypes =\n    uploadConfig &&\n    typeof uploadConfig === 'object' &&\n    'mimeTypes' in uploadConfig &&\n    Array.isArray(uploadConfig.mimeTypes)\n      ? uploadConfig.mimeTypes\n      : []\n\n  const allowRestrictedFileTypes =\n    uploadConfig && typeof uploadConfig === 'object' && 'allowRestrictedFileTypes' in uploadConfig\n      ? (uploadConfig as { allowRestrictedFileTypes?: boolean }).allowRestrictedFileTypes\n      : false\n\n  const expectsDetectableType = (mimeType: string): boolean => {\n    const textBasedTypes = ['/svg', 'image/svg+xml', 'image/x-xbitmap', 'image/x-xpixmap']\n\n    if (textBasedTypes.includes(mimeType)) {\n      return false\n    }\n\n    return (\n      mimeType.startsWith('image/') ||\n      mimeType.startsWith('video/') ||\n      mimeType.startsWith('audio/') ||\n      mimeType === 'application/pdf'\n    )\n  }\n\n  // Skip validation if `allowRestrictedFileTypes` is true\n  if (allowRestrictedFileTypes) {\n    return\n  }\n\n  // Secondary mimetype check to assess file type from buffer\n  if (configMimeTypes.length > 0) {\n    let detected = await fileTypeFromBuffer(file.data)\n    const typeFromExtension = file.name.split('.').pop() || ''\n\n    // Handle SVG files that are detected as XML due to <?xml declarations\n    if (\n      detected?.mime === 'application/xml' &&\n      configMimeTypes.some(\n        (type) => type.includes('image/') && (type.includes('svg') || type === 'image/*'),\n      )\n    ) {\n      const isSvg = detectSvgFromXml(file.data)\n      if (isSvg) {\n        detected = { ext: 'svg' as any, mime: 'image/svg+xml' as any }\n      }\n    }\n\n    if (!detected && !useTempFiles) {\n      const mimeTypeFromExtension = getFileTypeFallback(file.name).mime\n      const extIsValid = validateMimeType(mimeTypeFromExtension, configMimeTypes)\n\n      if (!extIsValid) {\n        errors.push(\n          `File type ${mimeTypeFromExtension} (from extension ${typeFromExtension}) is not allowed.`,\n        )\n      } else {\n        // SVG security check (text-based files not detectable by buffer)\n        if (typeFromExtension.toLowerCase() === 'svg') {\n          const isSafeSvg = validateSvg(file.data)\n          if (!isSafeSvg) {\n            errors.push('SVG file contains potentially harmful content.')\n          }\n        }\n\n        // PDF validation\n        if (mimeTypeFromExtension === 'application/pdf') {\n          const isValidPDF = validatePDF(file.data)\n          if (!isValidPDF) {\n            errors.push('Invalid or corrupted PDF file.')\n          }\n        }\n      }\n\n      if (expectsDetectableType(mimeTypeFromExtension)) {\n        req.payload.logger.warn(\n          `File buffer returned no detectable MIME type for ${file.name}. Falling back to extension-based validation.`,\n        )\n      }\n    }\n\n    const passesMimeTypeCheck = detected?.mime && validateMimeType(detected.mime, configMimeTypes)\n\n    if (passesMimeTypeCheck && detected?.mime === 'application/pdf') {\n      const isValidPDF = validatePDF(file?.data)\n      if (!isValidPDF) {\n        errors.push('Invalid PDF file.')\n      }\n    }\n\n    if (detected && !passesMimeTypeCheck) {\n      errors.push(`Invalid MIME type: ${detected.mime}.`)\n    }\n  } else {\n    const isRestricted = RESTRICTED_FILE_EXT_AND_TYPES.some((type) => {\n      const hasRestrictedExt = type.extensions.some((ext) => file.name.toLowerCase().endsWith(ext))\n      const hasRestrictedMime = type.mimeType === file.mimetype\n      return hasRestrictedExt || hasRestrictedMime\n    })\n    if (isRestricted) {\n      errors.push(\n        `File type '${file.mimetype}' not allowed ${file.name}: Restricted file type detected -- set 'allowRestrictedFileTypes' to true to skip this check for this Collection.`,\n      )\n    }\n  }\n\n  if (errors.length > 0) {\n    req.payload.logger.error(errors.join(', '))\n    throw new ValidationError({\n      errors: [{ message: errors.join(', '), path: 'file' }],\n    })\n  }\n}\n"],"names":["fileTypeFromBuffer","ValidationError","validateMimeType","validatePDF","detectSvgFromXml","getFileTypeFallback","validateSvg","RESTRICTED_FILE_EXT_AND_TYPES","extensions","mimeType","checkFileRestrictions","collection","file","req","errors","upload","uploadConfig","useTempFiles","payload","config","configMimeTypes","Array","isArray","mimeTypes","allowRestrictedFileTypes","expectsDetectableType","textBasedTypes","includes","startsWith","length","detected","data","typeFromExtension","name","split","pop","mime","some","type","isSvg","ext","mimeTypeFromExtension","extIsValid","push","toLowerCase","isSafeSvg","isValidPDF","logger","warn","passesMimeTypeCheck","isRestricted","hasRestrictedExt","endsWith","hasRestrictedMime","mimetype","error","join","message","path"],"mappings":"AAAA,SAASA,kBAAkB,QAAQ,YAAW;AAI9C,SAASC,eAAe,QAAQ,qBAAoB;AACpD,SAASC,gBAAgB,QAAQ,mCAAkC;AACnE,SAASC,WAAW,QAAQ,8BAA6B;AACzD,SAASC,gBAAgB,QAAQ,wBAAuB;AACxD,SAASC,mBAAmB,QAAQ,2BAA0B;AAC9D,SAASC,WAAW,QAAQ,mBAAkB;AAE9C;;CAEC,GACD,OAAO,MAAMC,gCAA+C;IAC1D;QAAEC,YAAY;YAAC;YAAO;SAAM;QAAEC,UAAU;IAA2B;IACnE;QAAED,YAAY;YAAC;YAAO;YAAO;YAAO;SAAS;QAAEC,UAAU;IAA2B;IACpF;QAAED,YAAY;YAAC;YAAO;SAAM;QAAEC,UAAU;IAA8B;IACtE;QAAED,YAAY;YAAC;YAAO;SAAM;QAAEC,UAAU;IAAkC;IAC1E;QAAED,YAAY;YAAC;SAAM;QAAEC,UAAU;IAAgC;IACjE;QAAED,YAAY;YAAC;SAAM;QAAEC,UAAU;IAA+B;IAChE;QAAED,YAAY;YAAC;SAAM;QAAEC,UAAU;IAAuC;IACxE;QAAED,YAAY;YAAC;YAAO;SAAM;QAAEC,UAAU;IAAgD;IACxF;QAAED,YAAY;YAAC;SAAM;QAAEC,UAAU;IAAoB;IACrD;QAAED,YAAY;YAAC;YAAO;YAAO;SAAM;QAAEC,UAAU;IAA2B;IAC1E;QAAED,YAAY;YAAC;SAAU;QAAEC,UAAU;IAAwB;IAC7D;QAAED,YAAY;YAAC;SAAM;QAAEC,UAAU;IAAoB;IACrD;QAAED,YAAY;YAAC;SAAM;QAAEC,UAAU;IAA4B;IAC7D;QAAED,YAAY;YAAC;SAAM;QAAEC,UAAU;IAAgC;IACjE;QAAED,YAAY;YAAC;YAAO;YAAQ;YAAS;SAAQ;QAAEC,UAAU;IAAY;IACvE;QAAED,YAAY;YAAC;YAAO;SAAQ;QAAEC,UAAU;IAA0B;IACpE;QAAED,YAAY;YAAC;YAAM;SAAM;QAAEC,UAAU;IAAkB;IACzD;QAAED,YAAY;YAAC;SAAM;QAAEC,UAAU;IAAoB;IACrD;QAAED,YAAY;YAAC;SAAK;QAAEC,UAAU;IAAgB;IAChD;QAAED,YAAY;YAAC;SAAK;QAAEC,UAAU;IAAc;IAC9C;QAAED,YAAY;YAAC;SAAK;QAAEC,UAAU;IAAc;IAC9C;QAAED,YAAY;YAAC;YAAO;YAAQ;YAAQ;YAAO;SAAO;QAAEC,UAAU;IAA2B;IAC3F;QAAED,YAAY;YAAC;YAAO;SAAM;QAAEC,UAAU;IAAyB;IACjE;QAAED,YAAY;YAAC;YAAM;YAAO;YAAO;SAAM;QAAEC,UAAU;IAAuB;IAC5E;QAAED,YAAY;YAAC;SAAM;QAAEC,UAAU;IAA2B;IAC5D;QAAED,YAAY;YAAC;YAAO;SAAO;QAAEC,UAAU;IAAoB;IAC7D;QAAED,YAAY;YAAC;SAAM;QAAEC,UAAU;IAAoB;IACrD;QAAED,YAAY;YAAC;SAAM;QAAEC,UAAU;IAAyB;IAC1D;QAAED,YAAY;YAAC;SAAM;QAAEC,UAAU;IAAoB;IACrD;QAAED,YAAY;YAAC;SAAW;QAAEC,UAAU;IAAyB;IAC/D;QAAED,YAAY;YAAC;SAAU;QAAEC,UAAU;IAAwB;CAC9D,CAAA;AAED,OAAO,MAAMC,wBAAwB,OAAO,EAC1CC,UAAU,EACVC,IAAI,EACJC,GAAG,EACyB;IAC5B,MAAMC,SAAmB,EAAE;IAC3B,MAAM,EAAEC,QAAQC,YAAY,EAAE,GAAGL;IACjC,MAAMM,eAAeJ,KAAKK,SAASC,QAAQJ,QAAQE,gBAAgB;IACnE,MAAMG,kBACJJ,gBACA,OAAOA,iBAAiB,YACxB,eAAeA,gBACfK,MAAMC,OAAO,CAACN,aAAaO,SAAS,IAChCP,aAAaO,SAAS,GACtB,EAAE;IAER,MAAMC,2BACJR,gBAAgB,OAAOA,iBAAiB,YAAY,8BAA8BA,eAC9E,AAACA,aAAwDQ,wBAAwB,GACjF;IAEN,MAAMC,wBAAwB,CAAChB;QAC7B,MAAMiB,iBAAiB;YAAC;YAAQ;YAAiB;YAAmB;SAAkB;QAEtF,IAAIA,eAAeC,QAAQ,CAAClB,WAAW;YACrC,OAAO;QACT;QAEA,OACEA,SAASmB,UAAU,CAAC,aACpBnB,SAASmB,UAAU,CAAC,aACpBnB,SAASmB,UAAU,CAAC,aACpBnB,aAAa;IAEjB;IAEA,wDAAwD;IACxD,IAAIe,0BAA0B;QAC5B;IACF;IAEA,2DAA2D;IAC3D,IAAIJ,gBAAgBS,MAAM,GAAG,GAAG;QAC9B,IAAIC,WAAW,MAAM9B,mBAAmBY,KAAKmB,IAAI;QACjD,MAAMC,oBAAoBpB,KAAKqB,IAAI,CAACC,KAAK,CAAC,KAAKC,GAAG,MAAM;QAExD,sEAAsE;QACtE,IACEL,UAAUM,SAAS,qBACnBhB,gBAAgBiB,IAAI,CAClB,CAACC,OAASA,KAAKX,QAAQ,CAAC,aAAcW,CAAAA,KAAKX,QAAQ,CAAC,UAAUW,SAAS,SAAQ,IAEjF;YACA,MAAMC,QAAQnC,iBAAiBQ,KAAKmB,IAAI;YACxC,IAAIQ,OAAO;gBACTT,WAAW;oBAAEU,KAAK;oBAAcJ,MAAM;gBAAuB;YAC/D;QACF;QAEA,IAAI,CAACN,YAAY,CAACb,cAAc;YAC9B,MAAMwB,wBAAwBpC,oBAAoBO,KAAKqB,IAAI,EAAEG,IAAI;YACjE,MAAMM,aAAaxC,iBAAiBuC,uBAAuBrB;YAE3D,IAAI,CAACsB,YAAY;gBACf5B,OAAO6B,IAAI,CACT,CAAC,UAAU,EAAEF,sBAAsB,iBAAiB,EAAET,kBAAkB,iBAAiB,CAAC;YAE9F,OAAO;gBACL,iEAAiE;gBACjE,IAAIA,kBAAkBY,WAAW,OAAO,OAAO;oBAC7C,MAAMC,YAAYvC,YAAYM,KAAKmB,IAAI;oBACvC,IAAI,CAACc,WAAW;wBACd/B,OAAO6B,IAAI,CAAC;oBACd;gBACF;gBAEA,iBAAiB;gBACjB,IAAIF,0BAA0B,mBAAmB;oBAC/C,MAAMK,aAAa3C,YAAYS,KAAKmB,IAAI;oBACxC,IAAI,CAACe,YAAY;wBACfhC,OAAO6B,IAAI,CAAC;oBACd;gBACF;YACF;YAEA,IAAIlB,sBAAsBgB,wBAAwB;gBAChD5B,IAAIK,OAAO,CAAC6B,MAAM,CAACC,IAAI,CACrB,CAAC,iDAAiD,EAAEpC,KAAKqB,IAAI,CAAC,6CAA6C,CAAC;YAEhH;QACF;QAEA,MAAMgB,sBAAsBnB,UAAUM,QAAQlC,iBAAiB4B,SAASM,IAAI,EAAEhB;QAE9E,IAAI6B,uBAAuBnB,UAAUM,SAAS,mBAAmB;YAC/D,MAAMU,aAAa3C,YAAYS,MAAMmB;YACrC,IAAI,CAACe,YAAY;gBACfhC,OAAO6B,IAAI,CAAC;YACd;QACF;QAEA,IAAIb,YAAY,CAACmB,qBAAqB;YACpCnC,OAAO6B,IAAI,CAAC,CAAC,mBAAmB,EAAEb,SAASM,IAAI,CAAC,CAAC,CAAC;QACpD;IACF,OAAO;QACL,MAAMc,eAAe3C,8BAA8B8B,IAAI,CAAC,CAACC;YACvD,MAAMa,mBAAmBb,KAAK9B,UAAU,CAAC6B,IAAI,CAAC,CAACG,MAAQ5B,KAAKqB,IAAI,CAACW,WAAW,GAAGQ,QAAQ,CAACZ;YACxF,MAAMa,oBAAoBf,KAAK7B,QAAQ,KAAKG,KAAK0C,QAAQ;YACzD,OAAOH,oBAAoBE;QAC7B;QACA,IAAIH,cAAc;YAChBpC,OAAO6B,IAAI,CACT,CAAC,WAAW,EAAE/B,KAAK0C,QAAQ,CAAC,cAAc,EAAE1C,KAAKqB,IAAI,CAAC,iHAAiH,CAAC;QAE5K;IACF;IAEA,IAAInB,OAAOe,MAAM,GAAG,GAAG;QACrBhB,IAAIK,OAAO,CAAC6B,MAAM,CAACQ,KAAK,CAACzC,OAAO0C,IAAI,CAAC;QACrC,MAAM,IAAIvD,gBAAgB;YACxBa,QAAQ;gBAAC;oBAAE2C,SAAS3C,OAAO0C,IAAI,CAAC;oBAAOE,MAAM;gBAAO;aAAE;QACxD;IACF;AACF,EAAC"}

package/dist/uploads/cropImage.d.ts

@@ -0,0 +1,30 @@
+import type { SanitizedConfig } from '../config/types.js';
+import type { PayloadRequest } from '../types/index.js';
+import type { WithMetadata } from './optionallyAppendMetadata.js';
+import type { UploadEdits } from './types.js';
+type CropImageArgs = {
+    cropData: UploadEdits['crop'];
+    dimensions: {
+        height: number;
+        width: number;
+    };
+    file: PayloadRequest['file'];
+    heightInPixels: number;
+    req?: PayloadRequest;
+    sharp: SanitizedConfig['sharp'];
+    widthInPixels: number;
+    withMetadata?: WithMetadata;
+};
+export declare function cropImage({ cropData, dimensions, file: fileArg, heightInPixels, req, sharp, widthInPixels, withMetadata, }: CropImageArgs): Promise<{
+    data: Buffer;
+    info: import("sharp").OutputInfo;
+} | {
+    data: Buffer<ArrayBufferLike>;
+    info: {
+        height: number;
+        size: number;
+        width: number;
+    };
+}>;
+export {};
+//# sourceMappingURL=cropImage.d.ts.map

package/dist/uploads/cropImage.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cropImage.d.ts","sourceRoot":"","sources":["../../src/uploads/cropImage.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAA;AACzD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAA;AACvD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAA;AACjE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAA;AAQ7C,KAAK,aAAa,GAAG;IACnB,QAAQ,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;IAC7B,UAAU,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAA;IAC7C,IAAI,EAAE,cAAc,CAAC,MAAM,CAAC,CAAA;IAC5B,cAAc,EAAE,MAAM,CAAA;IACtB,GAAG,CAAC,EAAE,cAAc,CAAA;IACpB,KAAK,EAAE,eAAe,CAAC,OAAO,CAAC,CAAA;IAC/B,aAAa,EAAE,MAAM,CAAA;IACrB,YAAY,CAAC,EAAE,YAAY,CAAA;CAC5B,CAAA;AACD,wBAAsB,SAAS,CAAC,EAC9B,QAAQ,EACR,UAAU,EACV,IAAI,EAAE,OAAO,EACb,cAAc,EACd,GAAG,EACH,KAAK,EACL,aAAa,EACb,YAAY,GACb,EAAE,aAAa;;;;;;;;;;GA8Df"}

package/dist/uploads/cropImage.js

@@ -0,0 +1,58 @@
+import { optionallyAppendMetadata } from './optionallyAppendMetadata.js';
+const percentToPixel = (value, dimension)=>{
+    return Math.floor(value / 100 * dimension);
+};
+export async function cropImage({ cropData, dimensions, file: fileArg, heightInPixels, req, sharp, widthInPixels, withMetadata }) {
+    try {
+        const { x, y } = cropData;
+        const file = fileArg;
+        const fileIsAnimatedType = [
+            'image/avif',
+            'image/gif',
+            'image/webp'
+        ].includes(file.mimetype);
+        const sharpOptions = {};
+        if (fileIsAnimatedType) {
+            sharpOptions.animated = true;
+        }
+        const { height: originalHeight, width: originalWidth } = dimensions;
+        const newWidth = Number(widthInPixels);
+        const newHeight = Number(heightInPixels);
+        const dimensionsChanged = originalWidth !== newWidth || originalHeight !== newHeight;
+        if (!dimensionsChanged) {
+            let adjustedHeight = originalHeight;
+            if (fileIsAnimatedType) {
+                const animatedMetadata = await sharp(file.tempFilePath || file.data, sharpOptions).metadata();
+                adjustedHeight = animatedMetadata.pages ? animatedMetadata.height : originalHeight;
+            }
+            return {
+                data: file.data,
+                info: {
+                    height: adjustedHeight,
+                    size: file.size,
+                    width: originalWidth
+                }
+            };
+        }
+        const formattedCropData = {
+            height: Number(heightInPixels),
+            left: percentToPixel(x, dimensions.width),
+            top: percentToPixel(y, dimensions.height),
+            width: Number(widthInPixels)
+        };
+        let cropped = sharp(file.tempFilePath || file.data, sharpOptions).extract(formattedCropData);
+        cropped = await optionallyAppendMetadata({
+            req: req,
+            sharpFile: cropped,
+            withMetadata: withMetadata
+        });
+        return await cropped.toBuffer({
+            resolveWithObject: true
+        });
+    } catch (error) {
+        console.error(`Error cropping image:`, error);
+        throw error;
+    }
+}
+
+//# sourceMappingURL=cropImage.js.map

package/dist/uploads/cropImage.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/uploads/cropImage.ts"],"sourcesContent":["import type { SharpOptions } from 'sharp'\n\nimport type { SanitizedConfig } from '../config/types.js'\nimport type { PayloadRequest } from '../types/index.js'\nimport type { WithMetadata } from './optionallyAppendMetadata.js'\nimport type { UploadEdits } from './types.js'\n\nimport { optionallyAppendMetadata } from './optionallyAppendMetadata.js'\n\nconst percentToPixel = (value: number, dimension: number) => {\n  return Math.floor((value / 100) * dimension)\n}\n\ntype CropImageArgs = {\n  cropData: UploadEdits['crop']\n  dimensions: { height: number; width: number }\n  file: PayloadRequest['file']\n  heightInPixels: number\n  req?: PayloadRequest\n  sharp: SanitizedConfig['sharp']\n  widthInPixels: number\n  withMetadata?: WithMetadata\n}\nexport async function cropImage({\n  cropData,\n  dimensions,\n  file: fileArg,\n  heightInPixels,\n  req,\n  sharp,\n  widthInPixels,\n  withMetadata,\n}: CropImageArgs) {\n  try {\n    const { x, y } = cropData!\n    const file = fileArg!\n\n    const fileIsAnimatedType = ['image/avif', 'image/gif', 'image/webp'].includes(file.mimetype)\n\n    const sharpOptions: SharpOptions = {}\n\n    if (fileIsAnimatedType) {\n      sharpOptions.animated = true\n    }\n\n    const { height: originalHeight, width: originalWidth } = dimensions\n    const newWidth = Number(widthInPixels)\n    const newHeight = Number(heightInPixels)\n\n    const dimensionsChanged = originalWidth !== newWidth || originalHeight !== newHeight\n\n    if (!dimensionsChanged) {\n      let adjustedHeight = originalHeight\n\n      if (fileIsAnimatedType) {\n        const animatedMetadata = await sharp(\n          file.tempFilePath || file.data,\n          sharpOptions,\n        ).metadata()\n        adjustedHeight = animatedMetadata.pages ? animatedMetadata.height! : originalHeight\n      }\n\n      return {\n        data: file.data,\n        info: {\n          height: adjustedHeight,\n          size: file.size,\n          width: originalWidth,\n        },\n      }\n    }\n\n    const formattedCropData = {\n      height: Number(heightInPixels),\n      left: percentToPixel(x, dimensions.width),\n      top: percentToPixel(y, dimensions.height),\n      width: Number(widthInPixels),\n    }\n\n    let cropped = sharp(file.tempFilePath || file.data, sharpOptions).extract(formattedCropData)\n\n    cropped = await optionallyAppendMetadata({\n      req: req!,\n      sharpFile: cropped,\n      withMetadata: withMetadata!,\n    })\n\n    return await cropped.toBuffer({\n      resolveWithObject: true,\n    })\n  } catch (error) {\n    console.error(`Error cropping image:`, error)\n    throw error\n  }\n}\n"],"names":["optionallyAppendMetadata","percentToPixel","value","dimension","Math","floor","cropImage","cropData","dimensions","file","fileArg","heightInPixels","req","sharp","widthInPixels","withMetadata","x","y","fileIsAnimatedType","includes","mimetype","sharpOptions","animated","height","originalHeight","width","originalWidth","newWidth","Number","newHeight","dimensionsChanged","adjustedHeight","animatedMetadata","tempFilePath","data","metadata","pages","info","size","formattedCropData","left","top","cropped","extract","sharpFile","toBuffer","resolveWithObject","error","console"],"mappings":"AAOA,SAASA,wBAAwB,QAAQ,gCAA+B;AAExE,MAAMC,iBAAiB,CAACC,OAAeC;IACrC,OAAOC,KAAKC,KAAK,CAAC,AAACH,QAAQ,MAAOC;AACpC;AAYA,OAAO,eAAeG,UAAU,EAC9BC,QAAQ,EACRC,UAAU,EACVC,MAAMC,OAAO,EACbC,cAAc,EACdC,GAAG,EACHC,KAAK,EACLC,aAAa,EACbC,YAAY,EACE;IACd,IAAI;QACF,MAAM,EAAEC,CAAC,EAAEC,CAAC,EAAE,GAAGV;QACjB,MAAME,OAAOC;QAEb,MAAMQ,qBAAqB;YAAC;YAAc;YAAa;SAAa,CAACC,QAAQ,CAACV,KAAKW,QAAQ;QAE3F,MAAMC,eAA6B,CAAC;QAEpC,IAAIH,oBAAoB;YACtBG,aAAaC,QAAQ,GAAG;QAC1B;QAEA,MAAM,EAAEC,QAAQC,cAAc,EAAEC,OAAOC,aAAa,EAAE,GAAGlB;QACzD,MAAMmB,WAAWC,OAAOd;QACxB,MAAMe,YAAYD,OAAOjB;QAEzB,MAAMmB,oBAAoBJ,kBAAkBC,YAAYH,mBAAmBK;QAE3E,IAAI,CAACC,mBAAmB;YACtB,IAAIC,iBAAiBP;YAErB,IAAIN,oBAAoB;gBACtB,MAAMc,mBAAmB,MAAMnB,MAC7BJ,KAAKwB,YAAY,IAAIxB,KAAKyB,IAAI,EAC9Bb,cACAc,QAAQ;gBACVJ,iBAAiBC,iBAAiBI,KAAK,GAAGJ,iBAAiBT,MAAM,GAAIC;YACvE;YAEA,OAAO;gBACLU,MAAMzB,KAAKyB,IAAI;gBACfG,MAAM;oBACJd,QAAQQ;oBACRO,MAAM7B,KAAK6B,IAAI;oBACfb,OAAOC;gBACT;YACF;QACF;QAEA,MAAMa,oBAAoB;YACxBhB,QAAQK,OAAOjB;YACf6B,MAAMvC,eAAee,GAAGR,WAAWiB,KAAK;YACxCgB,KAAKxC,eAAegB,GAAGT,WAAWe,MAAM;YACxCE,OAAOG,OAAOd;QAChB;QAEA,IAAI4B,UAAU7B,MAAMJ,KAAKwB,YAAY,IAAIxB,KAAKyB,IAAI,EAAEb,cAAcsB,OAAO,CAACJ;QAE1EG,UAAU,MAAM1C,yBAAyB;YACvCY,KAAKA;YACLgC,WAAWF;YACX3B,cAAcA;QAChB;QAEA,OAAO,MAAM2B,QAAQG,QAAQ,CAAC;YAC5BC,mBAAmB;QACrB;IACF,EAAE,OAAOC,OAAO;QACdC,QAAQD,KAAK,CAAC,CAAC,qBAAqB,CAAC,EAAEA;QACvC,MAAMA;IACR;AACF"}

package/dist/uploads/deleteAssociatedFiles.d.ts

@@ -0,0 +1,15 @@
+import type { SanitizedCollectionConfig } from '../collections/config/types.js';
+import type { SanitizedConfig } from '../config/types.js';
+import type { PayloadRequest } from '../types/index.js';
+import type { FileToSave } from './types.js';
+type Args = {
+    collectionConfig: SanitizedCollectionConfig;
+    config: SanitizedConfig;
+    doc: Record<string, unknown>;
+    files?: FileToSave[];
+    overrideDelete: boolean;
+    req: PayloadRequest;
+};
+export declare const deleteAssociatedFiles: (args: Args) => Promise<void>;
+export {};
+//# sourceMappingURL=deleteAssociatedFiles.d.ts.map

package/dist/uploads/deleteAssociatedFiles.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"deleteAssociatedFiles.d.ts","sourceRoot":"","sources":["../../src/uploads/deleteAssociatedFiles.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,gCAAgC,CAAA;AAC/E,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAA;AACzD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAA;AACvD,OAAO,KAAK,EAAY,UAAU,EAAE,MAAM,YAAY,CAAA;AAKtD,KAAK,IAAI,GAAG;IACV,gBAAgB,EAAE,yBAAyB,CAAA;IAC3C,MAAM,EAAE,eAAe,CAAA;IACvB,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAC5B,KAAK,CAAC,EAAE,UAAU,EAAE,CAAA;IACpB,cAAc,EAAE,OAAO,CAAA;IACvB,GAAG,EAAE,cAAc,CAAA;CACpB,CAAA;AAED,eAAO,MAAM,qBAAqB,EAAE,CAAC,IAAI,EAAE,IAAI,KAAK,OAAO,CAAC,IAAI,CAyC/D,CAAA"}

package/dist/uploads/deleteAssociatedFiles.js

@@ -0,0 +1,37 @@
+import fs from 'fs/promises';
+import { ErrorDeletingFile } from '../errors/index.js';
+import { fileExists } from './fileExists.js';
+export const deleteAssociatedFiles = async ({ collectionConfig, doc, files = [], overrideDelete, req })=>{
+    if (!collectionConfig.upload) {
+        return;
+    }
+    if (overrideDelete || files.length > 0) {
+        const { staticDir: staticPath } = collectionConfig.upload;
+        const fileToDelete = `${staticPath}/${doc.filename}`;
+        try {
+            if (await fileExists(fileToDelete)) {
+                await fs.unlink(fileToDelete);
+            }
+        } catch (ignore) {
+            throw new ErrorDeletingFile(req.t);
+        }
+        if (doc.sizes) {
+            const sizes = Object.values(doc.sizes);
+            // Since forEach will not wait until unlink is finished it could
+            // happen that two operations will try to delete the same file.
+            // To avoid this it is recommended to use "sync" instead
+            for (const size of sizes){
+                const sizeToDelete = `${staticPath}/${size.filename}`;
+                try {
+                    if (await fileExists(sizeToDelete)) {
+                        await fs.unlink(sizeToDelete);
+                    }
+                } catch (ignore) {
+                    throw new ErrorDeletingFile(req.t);
+                }
+            }
+        }
+    }
+};
+
+//# sourceMappingURL=deleteAssociatedFiles.js.map

package/dist/uploads/deleteAssociatedFiles.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/uploads/deleteAssociatedFiles.ts"],"sourcesContent":["import fs from 'fs/promises'\n\nimport type { SanitizedCollectionConfig } from '../collections/config/types.js'\nimport type { SanitizedConfig } from '../config/types.js'\nimport type { PayloadRequest } from '../types/index.js'\nimport type { FileData, FileToSave } from './types.js'\n\nimport { ErrorDeletingFile } from '../errors/index.js'\nimport { fileExists } from './fileExists.js'\n\ntype Args = {\n  collectionConfig: SanitizedCollectionConfig\n  config: SanitizedConfig\n  doc: Record<string, unknown>\n  files?: FileToSave[]\n  overrideDelete: boolean\n  req: PayloadRequest\n}\n\nexport const deleteAssociatedFiles: (args: Args) => Promise<void> = async ({\n  collectionConfig,\n  doc,\n  files = [],\n  overrideDelete,\n  req,\n}) => {\n  if (!collectionConfig.upload) {\n    return\n  }\n  if (overrideDelete || files.length > 0) {\n    const { staticDir: staticPath } = collectionConfig.upload\n\n    const fileToDelete = `${staticPath}/${doc.filename as string}`\n\n    try {\n      if (await fileExists(fileToDelete)) {\n        await fs.unlink(fileToDelete)\n      }\n    } catch (ignore) {\n      throw new ErrorDeletingFile(req.t)\n    }\n\n    if (doc.sizes) {\n      const sizes: FileData[] = Object.values(doc.sizes)\n      // Since forEach will not wait until unlink is finished it could\n      // happen that two operations will try to delete the same file.\n      // To avoid this it is recommended to use \"sync\" instead\n\n      for (const size of sizes) {\n        const sizeToDelete = `${staticPath}/${size.filename}`\n        try {\n          if (await fileExists(sizeToDelete)) {\n            await fs.unlink(sizeToDelete)\n          }\n        } catch (ignore) {\n          throw new ErrorDeletingFile(req.t)\n        }\n      }\n    }\n  }\n}\n"],"names":["fs","ErrorDeletingFile","fileExists","deleteAssociatedFiles","collectionConfig","doc","files","overrideDelete","req","upload","length","staticDir","staticPath","fileToDelete","filename","unlink","ignore","t","sizes","Object","values","size","sizeToDelete"],"mappings":"AAAA,OAAOA,QAAQ,cAAa;AAO5B,SAASC,iBAAiB,QAAQ,qBAAoB;AACtD,SAASC,UAAU,QAAQ,kBAAiB;AAW5C,OAAO,MAAMC,wBAAuD,OAAO,EACzEC,gBAAgB,EAChBC,GAAG,EACHC,QAAQ,EAAE,EACVC,cAAc,EACdC,GAAG,EACJ;IACC,IAAI,CAACJ,iBAAiBK,MAAM,EAAE;QAC5B;IACF;IACA,IAAIF,kBAAkBD,MAAMI,MAAM,GAAG,GAAG;QACtC,MAAM,EAAEC,WAAWC,UAAU,EAAE,GAAGR,iBAAiBK,MAAM;QAEzD,MAAMI,eAAe,GAAGD,WAAW,CAAC,EAAEP,IAAIS,QAAQ,EAAY;QAE9D,IAAI;YACF,IAAI,MAAMZ,WAAWW,eAAe;gBAClC,MAAMb,GAAGe,MAAM,CAACF;YAClB;QACF,EAAE,OAAOG,QAAQ;YACf,MAAM,IAAIf,kBAAkBO,IAAIS,CAAC;QACnC;QAEA,IAAIZ,IAAIa,KAAK,EAAE;YACb,MAAMA,QAAoBC,OAAOC,MAAM,CAACf,IAAIa,KAAK;YACjD,gEAAgE;YAChE,+DAA+D;YAC/D,wDAAwD;YAExD,KAAK,MAAMG,QAAQH,MAAO;gBACxB,MAAMI,eAAe,GAAGV,WAAW,CAAC,EAAES,KAAKP,QAAQ,EAAE;gBACrD,IAAI;oBACF,IAAI,MAAMZ,WAAWoB,eAAe;wBAClC,MAAMtB,GAAGe,MAAM,CAACO;oBAClB;gBACF,EAAE,OAAON,QAAQ;oBACf,MAAM,IAAIf,kBAAkBO,IAAIS,CAAC;gBACnC;YACF;QACF;IACF;AACF,EAAC"}

package/dist/uploads/detectSvgFromXml.d.ts

@@ -0,0 +1,5 @@
+/**
+ * Securely detect if an XML buffer contains a valid SVG document
+ */
+export declare function detectSvgFromXml(buffer: Buffer): boolean;
+//# sourceMappingURL=detectSvgFromXml.d.ts.map

package/dist/uploads/detectSvgFromXml.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"detectSvgFromXml.d.ts","sourceRoot":"","sources":["../../src/uploads/detectSvgFromXml.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CA6CxD"}

package/dist/uploads/detectSvgFromXml.js

@@ -0,0 +1,43 @@
+/**
+ * Securely detect if an XML buffer contains a valid SVG document
+ */ export function detectSvgFromXml(buffer) {
+    try {
+        // Limit buffer size to prevent processing large malicious files
+        const maxSize = 2048;
+        const content = buffer.toString('utf8', 0, Math.min(buffer.length, maxSize));
+        // Check for XML declaration and extract encoding if present
+        const xmlDeclMatch = content.match(/^<\?xml[^>]*encoding=["']([^"']+)["']/i);
+        const declaredEncoding = xmlDeclMatch?.[1]?.toLowerCase();
+        // Only support safe encodings
+        if (declaredEncoding && ![
+            'ascii',
+            'utf-8',
+            'utf8'
+        ].includes(declaredEncoding)) {
+            return false;
+        }
+        // Remove XML declarations, comments, and processing instructions
+        const cleanContent = content.replace(/<\?xml[^>]*\?>/gi, '').replace(/<!--[\s\S]*?-->/g, '').replace(/<\?[^>]*\?>/g, '').trim();
+        // Find the first actual element (root element)
+        const rootElementMatch = cleanContent.match(/^<(\w+)(?:\s|>)/);
+        if (!rootElementMatch || rootElementMatch[1] !== 'svg') {
+            return false;
+        }
+        // Validate SVG namespace - must be present for valid SVG
+        const svgNamespaceRegex = /xmlns=["']http:\/\/www\.w3\.org\/2000\/svg["']/;
+        if (!svgNamespaceRegex.test(content)) {
+            return false;
+        }
+        // Additional validation: ensure it's not malformed
+        const svgOpenTag = content.match(/<svg[\s>]/);
+        if (!svgOpenTag) {
+            return false;
+        }
+        return true;
+    } catch (_error) {
+        // If any error occurs during parsing, treat as not SVG
+        return false;
+    }
+}
+
+//# sourceMappingURL=detectSvgFromXml.js.map

package/dist/uploads/detectSvgFromXml.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/uploads/detectSvgFromXml.ts"],"sourcesContent":["/**\n * Securely detect if an XML buffer contains a valid SVG document\n */\nexport function detectSvgFromXml(buffer: Buffer): boolean {\n  try {\n    // Limit buffer size to prevent processing large malicious files\n    const maxSize = 2048\n    const content = buffer.toString('utf8', 0, Math.min(buffer.length, maxSize))\n\n    // Check for XML declaration and extract encoding if present\n    const xmlDeclMatch = content.match(/^<\\?xml[^>]*encoding=[\"']([^\"']+)[\"']/i)\n    const declaredEncoding = xmlDeclMatch?.[1]?.toLowerCase()\n\n    // Only support safe encodings\n    if (declaredEncoding && !['ascii', 'utf-8', 'utf8'].includes(declaredEncoding)) {\n      return false\n    }\n\n    // Remove XML declarations, comments, and processing instructions\n    const cleanContent = content\n      .replace(/<\\?xml[^>]*\\?>/gi, '')\n      .replace(/<!--[\\s\\S]*?-->/g, '')\n      .replace(/<\\?[^>]*\\?>/g, '')\n      .trim()\n\n    // Find the first actual element (root element)\n    const rootElementMatch = cleanContent.match(/^<(\\w+)(?:\\s|>)/)\n    if (!rootElementMatch || rootElementMatch[1] !== 'svg') {\n      return false\n    }\n\n    // Validate SVG namespace - must be present for valid SVG\n    const svgNamespaceRegex = /xmlns=[\"']http:\\/\\/www\\.w3\\.org\\/2000\\/svg[\"']/\n    if (!svgNamespaceRegex.test(content)) {\n      return false\n    }\n\n    // Additional validation: ensure it's not malformed\n    const svgOpenTag = content.match(/<svg[\\s>]/)\n    if (!svgOpenTag) {\n      return false\n    }\n\n    return true\n  } catch (_error) {\n    // If any error occurs during parsing, treat as not SVG\n    return false\n  }\n}\n"],"names":["detectSvgFromXml","buffer","maxSize","content","toString","Math","min","length","xmlDeclMatch","match","declaredEncoding","toLowerCase","includes","cleanContent","replace","trim","rootElementMatch","svgNamespaceRegex","test","svgOpenTag","_error"],"mappings":"AAAA;;CAEC,GACD,OAAO,SAASA,iBAAiBC,MAAc;IAC7C,IAAI;QACF,gEAAgE;QAChE,MAAMC,UAAU;QAChB,MAAMC,UAAUF,OAAOG,QAAQ,CAAC,QAAQ,GAAGC,KAAKC,GAAG,CAACL,OAAOM,MAAM,EAAEL;QAEnE,4DAA4D;QAC5D,MAAMM,eAAeL,QAAQM,KAAK,CAAC;QACnC,MAAMC,mBAAmBF,cAAc,CAAC,EAAE,EAAEG;QAE5C,8BAA8B;QAC9B,IAAID,oBAAoB,CAAC;YAAC;YAAS;YAAS;SAAO,CAACE,QAAQ,CAACF,mBAAmB;YAC9E,OAAO;QACT;QAEA,iEAAiE;QACjE,MAAMG,eAAeV,QAClBW,OAAO,CAAC,oBAAoB,IAC5BA,OAAO,CAAC,oBAAoB,IAC5BA,OAAO,CAAC,gBAAgB,IACxBC,IAAI;QAEP,+CAA+C;QAC/C,MAAMC,mBAAmBH,aAAaJ,KAAK,CAAC;QAC5C,IAAI,CAACO,oBAAoBA,gBAAgB,CAAC,EAAE,KAAK,OAAO;YACtD,OAAO;QACT;QAEA,yDAAyD;QACzD,MAAMC,oBAAoB;QAC1B,IAAI,CAACA,kBAAkBC,IAAI,CAACf,UAAU;YACpC,OAAO;QACT;QAEA,mDAAmD;QACnD,MAAMgB,aAAahB,QAAQM,KAAK,CAAC;QACjC,IAAI,CAACU,YAAY;YACf,OAAO;QACT;QAEA,OAAO;IACT,EAAE,OAAOC,QAAQ;QACf,uDAAuD;QACvD,OAAO;IACT;AACF"}

package/dist/uploads/docWithFilenameExists.d.ts

@@ -0,0 +1,11 @@
+import type { PayloadRequest } from '../types/index.js';
+type Args = {
+    collectionSlug: string;
+    filename: string;
+    path: string;
+    prefix?: string;
+    req: PayloadRequest;
+};
+export declare const docWithFilenameExists: ({ collectionSlug, filename, prefix, req, }: Args) => Promise<boolean>;
+export {};
+//# sourceMappingURL=docWithFilenameExists.d.ts.map

package/dist/uploads/docWithFilenameExists.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"docWithFilenameExists.d.ts","sourceRoot":"","sources":["../../src/uploads/docWithFilenameExists.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAS,MAAM,mBAAmB,CAAA;AAE9D,KAAK,IAAI,GAAG;IACV,cAAc,EAAE,MAAM,CAAA;IACtB,QAAQ,EAAE,MAAM,CAAA;IAChB,IAAI,EAAE,MAAM,CAAA;IACZ,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,GAAG,EAAE,cAAc,CAAA;CACpB,CAAA;AAED,eAAO,MAAM,qBAAqB,+CAK/B,IAAI,KAAG,OAAO,CAAC,OAAO,CAkBxB,CAAA"}

package/dist/uploads/docWithFilenameExists.js

@@ -0,0 +1,20 @@
+export const docWithFilenameExists = async ({ collectionSlug, filename, prefix, req })=>{
+    const where = {
+        filename: {
+            equals: filename
+        }
+    };
+    if (prefix) {
+        where.prefix = {
+            equals: prefix
+        };
+    }
+    const doc = await req.payload.db.findOne({
+        collection: collectionSlug,
+        req,
+        where
+    });
+    return !!doc;
+};
+
+//# sourceMappingURL=docWithFilenameExists.js.map

package/dist/uploads/docWithFilenameExists.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/uploads/docWithFilenameExists.ts"],"sourcesContent":["import type { PayloadRequest, Where } from '../types/index.js'\n\ntype Args = {\n  collectionSlug: string\n  filename: string\n  path: string\n  prefix?: string\n  req: PayloadRequest\n}\n\nexport const docWithFilenameExists = async ({\n  collectionSlug,\n  filename,\n  prefix,\n  req,\n}: Args): Promise<boolean> => {\n  const where: Where = {\n    filename: {\n      equals: filename,\n    },\n  }\n\n  if (prefix) {\n    where.prefix = { equals: prefix }\n  }\n\n  const doc = await req.payload.db.findOne({\n    collection: collectionSlug,\n    req,\n    where,\n  })\n\n  return !!doc\n}\n"],"names":["docWithFilenameExists","collectionSlug","filename","prefix","req","where","equals","doc","payload","db","findOne","collection"],"mappings":"AAUA,OAAO,MAAMA,wBAAwB,OAAO,EAC1CC,cAAc,EACdC,QAAQ,EACRC,MAAM,EACNC,GAAG,EACE;IACL,MAAMC,QAAe;QACnBH,UAAU;YACRI,QAAQJ;QACV;IACF;IAEA,IAAIC,QAAQ;QACVE,MAAMF,MAAM,GAAG;YAAEG,QAAQH;QAAO;IAClC;IAEA,MAAMI,MAAM,MAAMH,IAAII,OAAO,CAACC,EAAE,CAACC,OAAO,CAAC;QACvCC,YAAYV;QACZG;QACAC;IACF;IAEA,OAAO,CAAC,CAACE;AACX,EAAC"}

package/dist/uploads/endpoints/getFile.d.ts

@@ -0,0 +1,3 @@
+import type { PayloadHandler } from '../../config/types.js';
+export declare const getFileHandler: PayloadHandler;
+//# sourceMappingURL=getFile.d.ts.map

package/dist/uploads/endpoints/getFile.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"getFile.d.ts","sourceRoot":"","sources":["../../../src/uploads/endpoints/getFile.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAA;AAU3D,eAAO,MAAM,cAAc,EAAE,cA0J5B,CAAA"}