@ereo/plugin-images 0.1.22 → 0.1.24

package/dist/index.js

@@ -4253,7 +4253,7 @@ async function optimizeImages(options) {
 
 // src/runtime/middleware.ts
 import { readFile as readFile5 } from "fs/promises";
-import { join as join5 } from "path";
+import { join as join5, resolve, normalize } from "path";
 
 // src/runtime/cache.ts
 import { readFile as readFile4, writeFile as writeFile3, mkdir as mkdir3, unlink, readdir as readdir2, stat as stat3 } from "fs/promises";
@@ -4647,7 +4647,11 @@ function createImageMiddleware(options) {
         }
         sourceBuffer = Buffer.from(await response.arrayBuffer());
       } else {
-        const localPath = params.src.startsWith("/") ? join5(options.root, "public", params.src) : join5(options.root, params.src);
+        const baseDir = resolve(options.root, "public");
+        const localPath = resolve(baseDir, normalize(params.src.replace(/^\//, "")));
+        if (!localPath.startsWith(baseDir)) {
+          return new Response("Forbidden", { status: 403 });
+        }
         try {
           sourceBuffer = await readFile5(localPath);
         } catch (error) {

package/dist/runtime/middleware.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"middleware.d.ts","sourceRoot":"","sources":["../../src/runtime/middleware.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH,OAAO,KAAK,EAAE,UAAU,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAChE,OAAO,KAAK,EAAE,iBAAiB,EAA2B,MAAM,qBAAqB,CAAC;AAatF;;GAEG;AACH,MAAM,WAAW,sBAAsB;IACrC,6BAA6B;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,2BAA2B;IAC3B,MAAM,CAAC,EAAE,iBAAiB,CAAC;IAC3B,qBAAqB;IACrB,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,sBAAsB;IACtB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AA6GD;;GAEG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,sBAAsB,IAsBjE,SAAS,OAAO,EAChB,SAAS,UAAU,EACnB,MAAM,MAAM,OAAO,CAAC,QAAQ,CAAC,KAC5B,OAAO,CAAC,QAAQ,CAAC,CA8ErB;AA+BD;;GAEG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,sBAAsB,GAAG,iBAAiB,CAUlF"}
+{"version":3,"file":"middleware.d.ts","sourceRoot":"","sources":["../../src/runtime/middleware.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH,OAAO,KAAK,EAAE,UAAU,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAChE,OAAO,KAAK,EAAE,iBAAiB,EAA2B,MAAM,qBAAqB,CAAC;AAatF;;GAEG;AACH,MAAM,WAAW,sBAAsB;IACrC,6BAA6B;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,2BAA2B;IAC3B,MAAM,CAAC,EAAE,iBAAiB,CAAC;IAC3B,qBAAqB;IACrB,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,sBAAsB;IACtB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AA6GD;;GAEG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,sBAAsB,IAsBjE,SAAS,OAAO,EAChB,SAAS,UAAU,EACnB,MAAM,MAAM,OAAO,CAAC,QAAQ,CAAC,KAC5B,OAAO,CAAC,QAAQ,CAAC,CAkFrB;AA+BD;;GAEG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,sBAAsB,GAAG,iBAAiB,CAUlF"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ereo/plugin-images",
-  "version": "0.1.22",
+  "version": "0.1.24",
   "license": "MIT",
   "author": "Ereo Team",
   "homepage": "https://ereo.dev",
@@ -36,7 +36,7 @@
     "typecheck": "tsc --noEmit"
   },
   "dependencies": {
-    "@ereo/core": "^0.1.22",
+    "@ereo/core": "^0.1.24",
     "sharp": "^0.33.0"
   },
   "devDependencies": {