@kne/fastify-app-manager 0.1.3 → 0.1.4
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +2 -2
- package/libs/utils/zip.js +7 -2
- package/package.json +1 -1
package/README.md
CHANGED
|
@@ -117,7 +117,7 @@ deploy(versionId)
|
|
|
117
117
|
|
|
118
118
|
| 特性 | 说明 |
|
|
119
119
|
|------|------|
|
|
120
|
-
| 版本上传 | Zip Slip
|
|
120
|
+
| 版本上传 | Zip Slip 防护、条目数/体积上限、解压丢弃任意层级 `node_modules`、Fullstack 包格式校验、server 生产依赖安装 |
|
|
121
121
|
| 短部署 | `deploy` / `start` / `restart` 立即返回 `deploying`，后台按 PM2 真实状态 + healthCheck 写回 `running`/`error`/`stopped` |
|
|
122
122
|
| 生命周期 | `start` / `stop` / `restart` / `remove`；父应用重启后异步 `syncAllStatuses` 对齐 PM2 |
|
|
123
123
|
| 双通道访问 | 自定义域名透明反代 + `/app/{name}` 剥前缀反代 |
|
|
@@ -196,7 +196,7 @@ await fastify.listen({ port: 3000 });
|
|
|
196
196
|
| `healthCheckTimeoutMs` | number | 否 | `30000` | 探测总超时（毫秒） |
|
|
197
197
|
| `healthCheckIntervalMs` | number | 否 | `1000` | 探测轮询间隔（毫秒） |
|
|
198
198
|
| `maxZipSize` | number | 否 | `209715200` | zip 最大字节（200MB）；同步 multipart 限制 |
|
|
199
|
-
| `maxZipEntries` | number | 否 | `20000` | zip
|
|
199
|
+
| `maxZipEntries` | number | 否 | `20000` | zip 最大条目数（不含被丢弃的 `node_modules` 条目） |
|
|
200
200
|
| `npmInstallTimeoutMs` | number | 否 | `600000` | `server` 目录 `npm install` 超时 |
|
|
201
201
|
| `sseReplayLines` | number | 否 | `100` | SSE 连接时回放最近行数 |
|
|
202
202
|
| `sseHeartbeatMs` | number | 否 | `15000` | SSE 心跳间隔 |
|
package/libs/utils/zip.js
CHANGED
|
@@ -7,6 +7,10 @@ const isPathInside = (parent, child) => {
|
|
|
7
7
|
return relative === '' || (!relative.startsWith('..') && !path.isAbsolute(relative));
|
|
8
8
|
};
|
|
9
9
|
|
|
10
|
+
const normalizeEntryName = name => name.replace(/^[/\\]+/, '').replace(/\\/g, '/');
|
|
11
|
+
|
|
12
|
+
const isNodeModulesEntry = name => normalizeEntryName(name).split('/').includes('node_modules');
|
|
13
|
+
|
|
10
14
|
const extractZipSafe = async (zipBuffer, destDir, { maxZipSize, maxZipEntries }) => {
|
|
11
15
|
if (!Buffer.isBuffer(zipBuffer)) {
|
|
12
16
|
throw new Error('zip content must be a Buffer');
|
|
@@ -17,13 +21,14 @@ const extractZipSafe = async (zipBuffer, destDir, { maxZipSize, maxZipEntries })
|
|
|
17
21
|
|
|
18
22
|
await fs.ensureDir(destDir);
|
|
19
23
|
const zip = new AdmZip(zipBuffer);
|
|
20
|
-
|
|
24
|
+
// Dependencies are reinstalled after extraction, so bundled node_modules are dropped before the entry limit applies.
|
|
25
|
+
const entries = zip.getEntries().filter(entry => !isNodeModulesEntry(entry.entryName));
|
|
21
26
|
if (entries.length > maxZipEntries) {
|
|
22
27
|
throw new Error(`zip has too many entries (${entries.length} > ${maxZipEntries})`);
|
|
23
28
|
}
|
|
24
29
|
|
|
25
30
|
for (const entry of entries) {
|
|
26
|
-
const entryName = entry.entryName
|
|
31
|
+
const entryName = normalizeEntryName(entry.entryName);
|
|
27
32
|
if (!entryName || entryName.includes('\0')) {
|
|
28
33
|
throw new Error('invalid zip entry name');
|
|
29
34
|
}
|