@n8n/backend-common 0.12.1 → 0.12.2

package/dist/index.d.ts

@@ -5,3 +5,4 @@ export { isObjectLiteral } from './utils/is-object-literal';
 export { Logger } from './logging/logger';
 export { ModuleRegistry } from './modules/module-registry';
 export { ModulesConfig, ModuleName } from './modules/modules.config';
+export { isContainedWithin, safeJoinPath } from './utils/path-util';

package/dist/index.js

@@ -14,7 +14,7 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
     for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.ModulesConfig = exports.ModuleRegistry = exports.Logger = exports.isObjectLiteral = exports.inTest = exports.inProduction = exports.inDevelopment = void 0;
+exports.safeJoinPath = exports.isContainedWithin = exports.ModulesConfig = exports.ModuleRegistry = exports.Logger = exports.isObjectLiteral = exports.inTest = exports.inProduction = exports.inDevelopment = void 0;
 __exportStar(require("./license-state"), exports);
 __exportStar(require("./types"), exports);
 var environment_1 = require("./environment");
@@ -29,4 +29,7 @@ var module_registry_1 = require("./modules/module-registry");
 Object.defineProperty(exports, "ModuleRegistry", { enumerable: true, get: function () { return module_registry_1.ModuleRegistry; } });
 var modules_config_1 = require("./modules/modules.config");
 Object.defineProperty(exports, "ModulesConfig", { enumerable: true, get: function () { return modules_config_1.ModulesConfig; } });
+var path_util_1 = require("./utils/path-util");
+Object.defineProperty(exports, "isContainedWithin", { enumerable: true, get: function () { return path_util_1.isContainedWithin; } });
+Object.defineProperty(exports, "safeJoinPath", { enumerable: true, get: function () { return path_util_1.safeJoinPath; } });
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;AAAA,kDAAgC;AAChC,0CAAwB;AAExB,6CAAoE;AAA3D,4GAAA,aAAa,OAAA;AAAE,2GAAA,YAAY,OAAA;AAAE,qGAAA,MAAM,OAAA;AAC5C,+DAA4D;AAAnD,oHAAA,eAAe,OAAA;AACxB,2CAA0C;AAAjC,gGAAA,MAAM,OAAA;AACf,6DAA2D;AAAlD,iHAAA,cAAc,OAAA;AACvB,2DAAqE;AAA5D,+GAAA,aAAa,OAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;AAAA,kDAAgC;AAChC,0CAAwB;AAExB,6CAAoE;AAA3D,4GAAA,aAAa,OAAA;AAAE,2GAAA,YAAY,OAAA;AAAE,qGAAA,MAAM,OAAA;AAC5C,+DAA4D;AAAnD,oHAAA,eAAe,OAAA;AACxB,2CAA0C;AAAjC,gGAAA,MAAM,OAAA;AACf,6DAA2D;AAAlD,iHAAA,cAAc,OAAA;AACvB,2DAAqE;AAA5D,+GAAA,aAAa,OAAA;AACtB,+CAAoE;AAA3D,8GAAA,iBAAiB,OAAA;AAAE,yGAAA,YAAY,OAAA"}

package/dist/utils/path-util.d.ts

@@ -0,0 +1,2 @@
+export declare function isContainedWithin(parentPath: string, childPath: string): boolean;
+export declare function safeJoinPath(parentPath: string, ...paths: string[]): string;

package/dist/utils/path-util.js

@@ -0,0 +1,55 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isContainedWithin = isContainedWithin;
+exports.safeJoinPath = safeJoinPath;
+const n8n_workflow_1 = require("n8n-workflow");
+const path = __importStar(require("node:path"));
+function isContainedWithin(parentPath, childPath) {
+    parentPath = path.resolve(parentPath);
+    childPath = path.resolve(childPath);
+    if (parentPath === childPath) {
+        return true;
+    }
+    return childPath.startsWith(parentPath + path.sep);
+}
+function safeJoinPath(parentPath, ...paths) {
+    const candidate = path.join(parentPath, ...paths);
+    if (!isContainedWithin(parentPath, candidate)) {
+        throw new n8n_workflow_1.UnexpectedError(`Path traversal detected, refusing to join paths: ${parentPath} and ${JSON.stringify(paths)}`);
+    }
+    return candidate;
+}
+//# sourceMappingURL=path-util.js.map

package/dist/utils/path-util.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"path-util.js","sourceRoot":"","sources":["../../src/utils/path-util.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAOA,8CASC;AASD,oCAUC;AAnCD,+CAA+C;AAC/C,gDAAkC;AAMlC,SAAgB,iBAAiB,CAAC,UAAkB,EAAE,SAAiB;IACtE,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IACtC,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAEpC,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAC9B,OAAO,IAAI,CAAC;IACb,CAAC;IAED,OAAO,SAAS,CAAC,UAAU,CAAC,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC;AACpD,CAAC;AASD,SAAgB,YAAY,CAAC,UAAkB,EAAE,GAAG,KAAe;IAClE,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,GAAG,KAAK,CAAC,CAAC;IAElD,IAAI,CAAC,iBAAiB,CAAC,UAAU,EAAE,SAAS,CAAC,EAAE,CAAC;QAC/C,MAAM,IAAI,8BAAe,CACxB,oDAAoD,UAAU,QAAQ,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAC7F,CAAC;IACH,CAAC;IAED,OAAO,SAAS,CAAC;AAClB,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@n8n/backend-common",
-  "version": "0.12.1",
+  "version": "0.12.2",
   "main": "dist/index.js",
   "module": "src/index.ts",
   "types": "dist/index.d.ts",
@@ -15,10 +15,10 @@
     "reflect-metadata": "0.2.2",
     "winston": "3.14.2",
     "@n8n/config": "^1.45.0",
-    "@n8n/constants": "^0.9.0",
     "@n8n/decorators": "^0.12.1",
     "@n8n/di": "^0.8.0",
-    "n8n-workflow": "^1.99.1"
+    "n8n-workflow": "^1.99.1",
+    "@n8n/constants": "^0.9.0"
   },
   "devDependencies": {
     "@n8n/typescript-config": "1.3.0"