@ditojs/server 2.87.0 → 2.88.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ditojs/server",
-  "version": "2.87.0",
+  "version": "2.88.0",
   "type": "module",
   "description": "Dito.js Server – Dito.js is a declarative and modern web framework, based on Objection.js, Koa.js and Vue.js",
   "repository": "https://github.com/ditojs/dito/tree/main/packages/server",
@@ -90,5 +90,5 @@
     "objection": "^3.1.5",
     "typescript": "^5.9.3"
   },
-  "gitHead": "cbd05e604a1d212dfc91f9686b43bef75815a409"
+  "gitHead": "1d413e8528f8a40e3cc7950db62ebeb4d687ce67"
 }

package/src/app/Application.js

@@ -40,6 +40,7 @@ import { Service } from '../services/index.js'
 import { Storage } from '../storage/index.js'
 import { convertSchema } from '../schema/index.js'
 import { getDuration, subtractDuration } from '../utils/duration.js'
+import { resolveFileUrl } from '../utils/asset.js'
 import {
   ResponseError,
   ValidationError,
@@ -997,8 +998,7 @@ export class Application extends Koa {
                   }...`
                 )
                 if (url.startsWith('file://')) {
-                  const filepath = path.resolve(url.substring(7))
-                  data = await fs.readFile(filepath)
+                  data = await fs.readFile(new URL(resolveFileUrl(url)))
                 } else {
                   const response = await fetch(url)
                   const arrayBuffer = await response.arrayBuffer()
@@ -1007,6 +1007,9 @@ export class Application extends Koa {
                 }
               }
               const importedFile = await storage.addFile(file, data)
+              // Sign the imported foreign file so it passes verification when
+              // createAssets() triggers $parseJson() → convertAssetFile().
+              storage.signAssetFile(importedFile)
               await this.createAssets(storage, [importedFile], 0, transaction)
               importedFiles.push(importedFile)
               // Merge back the changed file properties into the actual file

package/src/storage/Storage.js

@@ -8,6 +8,7 @@ import { readMediaAttributes } from 'leather'
 import { hyphenate, toPromiseCallback } from '@ditojs/utils'
 import { AssetFile } from './AssetFile.js'
 import { AssetError } from '../errors/AssetError.js'
+import { resolveFileUrl } from '../utils/asset.js'
 
 const storageClasses = {}
 
@@ -75,19 +76,23 @@ export class Storage {
   }
 
   isImportSourceAllowed(url) {
-    return picomatch.isMatch(url, this.config.allowedImports || [])
+    return picomatch.isMatch(
+      resolveFileUrl(url),
+      (this.config.allowedImports || []).map(resolveFileUrl)
+    )
   }
 
   convertAssetFile(file, { trusted = false } = {}) {
-    if (
-      !trusted &&
-      !this._verifyAssetKey(file.key, file.signature)
-    ) {
-      throw new AssetError(
-        `Invalid asset signature for file '${
-          file.name ?? file.key
-        }'`
-      )
+    if (!trusted) {
+      if (this.isImportSourceAllowed(file.url)) {
+        this.signAssetFile(file)
+      } else if (!this.verifyAssetFile(file)) {
+        throw new AssetError(
+          `Invalid asset signature for file '${
+            file.name ?? file.key
+          }'`
+        )
+      }
     }
     AssetFile.convert(file, this)
   }
@@ -141,6 +146,23 @@ export class Storage {
     return this._getFileUrl(file)
   }
 
+  signAssetFile(file) {
+    file.signature = this._signAssetKey(file.key)
+  }
+
+  verifyAssetFile(file) {
+    if (file) {
+      const expected = this._signAssetKey(file.key)
+      try {
+        return crypto.timingSafeEqual(
+          Buffer.from(expected, 'hex'),
+          Buffer.from(file.signature, 'hex')
+        )
+      } catch {}
+    }
+    return false
+  }
+
   _signAssetKey(key) {
     const secret = (
       this.app.keys?.[0] ??
@@ -152,19 +174,6 @@ export class Storage {
       .digest('hex')
   }
 
-  _verifyAssetKey(key, signature) {
-    if (!key || !signature) return false
-    const expected = this._signAssetKey(key)
-    try {
-      return crypto.timingSafeEqual(
-        Buffer.from(expected, 'hex'),
-        Buffer.from(signature, 'hex')
-      )
-    } catch {
-      return false
-    }
-  }
-
   _getUrl(...parts) {
     return this.url
       ? new URL(path.posix.join(...parts), this.url).toString()

package/src/utils/asset.js

@@ -0,0 +1,7 @@
+import path from 'path'
+
+export function resolveFileUrl(url) {
+  return url.startsWith('file://')
+    ? `file://${path.resolve(url.slice(7))}`
+    : url
+}