@ezs/basics 1.23.0 → 1.23.1

package/CHANGELOG.md

@@ -3,6 +3,23 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+## [1.23.1](https://github.com/Inist-CNRS/ezs/compare/@ezs/basics@1.23.0...@ezs/basics@1.23.1) (2023-01-28)
+
+
+### Bug Fixes
+
+* 🐛 improve security in file access ([6942a8e](https://github.com/Inist-CNRS/ezs/commit/6942a8e039a05d820d8643fa0908287a0a6aefda))
+* 🐛 objstandarize lost boolean values ([dca4714](https://github.com/Inist-CNRS/ezs/commit/dca4714c984214f422f9ed8951575de66af0f0ce))
+
+
+### Reverts
+
+* Revert "chore: 🤖 use lerna exec instead bootstrap" ([56375ee](https://github.com/Inist-CNRS/ezs/commit/56375ee2bd7e9f69f61da3993ab569ca1c16c547))
+
+
+
+
+
 # [1.23.0](https://github.com/Inist-CNRS/ezs/compare/@ezs/basics@1.22.7...@ezs/basics@1.23.0) (2023-01-20)
 
 

package/lib/file-load.js

@@ -13,6 +13,10 @@ var _path = require("path");
 
 var _os = require("os");
 
+var _higherPath = _interopRequireDefault(require("higher-path"));
+
+function _interopRequireDefault(obj) { return obj && obj.__esModule ? obj : { default: obj }; }
+
 /**
  * Take `Object` containing filename et throw content by chunk
  *
@@ -52,18 +56,19 @@ async function FILELoad(data, feed) {
     return;
   }
 
-  const cwd = process.cwd();
-  const tpd = (0, _os.tmpdir)();
   const compress = this.getParam('compress', false);
-  const locations = this.ezs.getPath().concat(cwd, tpd, this.getParam('location'));
-  const file = locations.filter(Boolean).map(dir => (0, _path.resolve)(dir, String(data).trim())).filter(fil => (0, _fs.existsSync)(fil)).shift();
+  const location = (0, _path.normalize)(this.getParam('location', '/'));
+  const locations = [(0, _higherPath.default)((0, _os.tmpdir)(), location), (0, _higherPath.default)(process.cwd(), location)];
+  const filename = locations.filter(Boolean).map(dir => (0, _path.resolve)(dir, String(data).trim())).filter(fil => (0, _fs.existsSync)(fil)).shift();
 
-  if (!file) {
-    feed.end();
+  if (!filename) {
+    feed.stop(new Error('File location check failed.'));
     return;
   }
 
-  const stream = compress ? (0, _fs.createReadStream)(file).pipe((0, _zlib.createGunzip)()) : (0, _fs.createReadStream)(file);
+  (0, _fs.accessSync)((0, _path.dirname)(filename), _fs.constants.R_OK | _fs.constants.W_OK);
+  (0, _fs.accessSync)(filename, _fs.constants.R_OK | _fs.constants.W_OK);
+  const stream = compress ? (0, _fs.createReadStream)(filename).pipe((0, _zlib.createGunzip)()) : (0, _fs.createReadStream)(filename);
   await feed.flow(stream);
   return;
 }

package/lib/file-save.js

@@ -68,13 +68,21 @@ const toJSONL = line => JSON.stringify(line).concat(eol);
 function FILESave(data, feed) {
   if (this.isFirst()) {
     const identifier = String(this.getParam('identifier'));
-    const location = this.getParam('location', (0, _os.tmpdir)());
+
+    const location = _path.default.normalize(this.getParam('location', (0, _os.tmpdir)()));
+
     const compress = this.getParam('compress', false);
 
+    if (location.indexOf((0, _os.tmpdir)()) !== 0 && location.indexOf(process.cwd()) !== 0) {
+      feed.stop(new Error('File location check failed.'));
+      return;
+    }
+
     if (!_pathExists.default.sync(location)) {
       _makeDir.default.sync(location);
     }
 
+    (0, _fs.accessSync)(location, _fs.constants.R_OK | _fs.constants.W_OK);
     const name = compress ? `${identifier}.gz` : identifier;
 
     const filename = _path.default.resolve(location, name);

package/lib/obj-standardize.js

@@ -21,7 +21,7 @@ function normalize(data, feed) {
   const struct = this.getEnv();
   const vv = {};
   struct.forEach(k => {
-    if (!data[k]) {
+    if (data[k] === undefined || data[k] === null) {
       vv[k] = '';
     } else {
       vv[k] = data[k];

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@ezs/basics",
   "description": "Basics statements for EZS",
-  "version": "1.23.0",
+  "version": "1.23.1",
   "author": "Nicolas Thouvenin <nthouvenin@gmail.com>",
   "bugs": "https://github.com/Inist-CNRS/ezs/issues",
   "dependencies": {
@@ -13,6 +13,7 @@
     "fetch-with-proxy": "3.0.1",
     "flat": "5.0.2",
     "get-stream": "6.0.1",
+    "higher-path": "1.0.0",
     "lodash.escaperegexp": "4.1.2",
     "lodash.get": "4.4.2",
     "lodash.mapkeys": "4.6.0",
@@ -37,7 +38,7 @@
   "directories": {
     "test": "test"
   },
-  "gitHead": "20ec5a02e63dfff4859d64e96cd5e2bb05e48504",
+  "gitHead": "c244731593d7181d55b1d0c20373e5a263f18f02",
   "homepage": "https://github.com/Inist-CNRS/ezs/tree/master/packages/basics#readme",
   "keywords": [
     "ezs"