@flowfuse/nr-launcher 3.1.1-df4cf86-202609281615.0 → 3.1.1

package/CHANGELOG.md

@@ -1,3 +1,17 @@
+#### 3.1.1: Release
+
+ - fix: Refuse deleting the file store root and sibling paths that share its prefix (#634)
+ - chore: Override moment (#633)
+ - chore: Override uuid@8 to 11.1.1 (#632)
+ - Bump brace-expansion (#629)
+ - Bump serialize-javascript from 7.1.1 to 7.1.2 (#631)
+ - Bump fastify from 5.12.1 to 5.12.5 (#630)
+ - Bump fast-uri (#628)
+ - Bump ip-address from 10.4.0 to 10.7.2 (#627)
+ - Bump multer from 2.3.0 to 2.4.0 (#626)
+ - Update versions of  nr-mqtt & nr-tables (#625)
+ - Update File-Server reference (#624)
+
 #### 3.1.0: Release
 
  - Update launcher to assistant@0.20 (#622)

package/lib/files/index.js

@@ -1,6 +1,6 @@
 const { mkdir, readdir, rm, rename, stat, writeFile } = require('fs/promises')
 const { existsSync } = require('fs')
-const { dirname, join, normalize } = require('path')
+const { dirname, join, normalize, sep } = require('path')
 const multer = require('multer')
 
 const filesInterface = (app, settings) => {
@@ -9,11 +9,18 @@ const filesInterface = (app, settings) => {
     const storage = multer.memoryStorage()
     const upload = multer({ storage })
 
+    const resolvePath = (path = '') => {
+        const fullPath = normalize(join(BASE_PATH, path))
+        return fullPath.replace(/[\\/]+$/, '')
+    }
+    const isInsideBase = (fullPath) => fullPath.startsWith(BASE_PATH + sep)
+    const isBaseOrInside = (fullPath) => fullPath === BASE_PATH || isInsideBase(fullPath)
+
     const regex = /^\/flowforge\/files\/_\/(.*)$/
 
     const listDirectory = async (path = '') => {
-        const fullPath = normalize(join(BASE_PATH, path))
-        if (fullPath.startsWith(BASE_PATH)) {
+        const fullPath = resolvePath(path)
+        if (isBaseOrInside(fullPath)) {
             const files = await readdir(fullPath, { withFileTypes: true })
             const response = {
                 meta: { },
@@ -58,9 +65,9 @@ const filesInterface = (app, settings) => {
     })
 
     app.put(regex, async (request, reply) => {
-        const fullPath = normalize(join(BASE_PATH, request.params[0]))
-        const newPath = normalize(join(BASE_PATH, request.body.path))
-        if (fullPath.startsWith(BASE_PATH) && newPath.startsWith(BASE_PATH)) {
+        const fullPath = resolvePath(request.params[0])
+        const newPath = resolvePath(request.body.path)
+        if (isInsideBase(fullPath) && isInsideBase(newPath)) {
             if (existsSync(fullPath) && existsSync(dirname(newPath))) {
                 try {
                     await rename(fullPath, newPath)
@@ -76,12 +83,12 @@ const filesInterface = (app, settings) => {
     })
 
     app.post(regex, upload.single('file'), async (request, reply) => {
-        const startPath = normalize(join(BASE_PATH, request.params[0]))
-        if (startPath.startsWith(BASE_PATH)) {
+        const startPath = resolvePath(request.params[0])
+        if (isBaseOrInside(startPath)) {
             if (request.get('content-type') === 'application/json') {
                 const newPath = request.body.path
-                const fullPath = normalize(join(startPath, newPath))
-                if (fullPath.startsWith(BASE_PATH)) {
+                const fullPath = resolvePath(join(startPath.slice(BASE_PATH.length), newPath))
+                if (isBaseOrInside(fullPath)) {
                     try {
                         await mkdir(fullPath, { recursive: true })
                         reply.status(201).send()
@@ -93,7 +100,9 @@ const filesInterface = (app, settings) => {
                 }
             } else if (request.get('content-type').startsWith('multipart/form-data')) {
                 const targetDir = dirname(startPath)
-                if (existsSync(targetDir)) {
+                if (!isInsideBase(startPath)) {
+                    reply.status(403).send()
+                } else if (existsSync(targetDir)) {
                     await writeFile(startPath, request.file.buffer)
                     reply.status(201).send()
                 } else {
@@ -108,8 +117,8 @@ const filesInterface = (app, settings) => {
     })
 
     app.delete(regex, async (request, reply) => {
-        const fullPath = normalize(join(BASE_PATH, request.params[0]))
-        if (fullPath !== BASE_PATH && fullPath.startsWith(BASE_PATH)) {
+        const fullPath = resolvePath(request.params[0])
+        if (isInsideBase(fullPath)) {
             if (existsSync(fullPath)) {
                 try {
                     await rm(fullPath, {