@newrelic/preflight 1.4.12 → 1.4.13
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
|
@@ -1,14 +1,18 @@
|
|
|
1
1
|
import { IncomingMessage, ServerResponse } from 'node:http';
|
|
2
2
|
/**
|
|
3
|
-
* True if `target` resolves to a path inside `root`.
|
|
4
|
-
*
|
|
5
|
-
*
|
|
6
|
-
*
|
|
7
|
-
*
|
|
8
|
-
* resolve()/join() produce backslash-joined paths
|
|
9
|
-
*
|
|
10
|
-
*
|
|
3
|
+
* True if `target` resolves to a path inside `root`. Both branches are
|
|
4
|
+
* literal string checks ('/' and '\\') and must stay that way — never
|
|
5
|
+
* replace either with a `path.sep`-derived value.
|
|
6
|
+
*
|
|
7
|
+
* Dropping the backslash branch breaks static asset serving on Windows,
|
|
8
|
+
* where resolve()/join() produce backslash-joined paths that a '/'-only
|
|
9
|
+
* check never matches. Making either branch non-literal (e.g. concatenating
|
|
10
|
+
* a runtime `sep` variable instead of a quoted character) breaks static
|
|
11
|
+
* analysis: CodeQL cannot statically prove that a runtime separator value
|
|
12
|
+
* equals '/', so it stops recognising this as the standard
|
|
13
|
+
* path-containment sanitizer pattern and flags the file reads below as
|
|
14
|
+
* path injection.
|
|
11
15
|
*/
|
|
12
|
-
export declare function isWithinRoot(root: string, target: string
|
|
16
|
+
export declare function isWithinRoot(root: string, target: string): boolean;
|
|
13
17
|
export declare function createStaticHandler(rootDir: string): (req: IncomingMessage, res: ServerResponse) => Promise<void>;
|
|
14
18
|
//# sourceMappingURL=static-handler.d.ts.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"static-handler.d.ts","sourceRoot":"","sources":["../../../src/dashboard/routes/static-handler.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAuB5D
|
|
1
|
+
{"version":3,"file":"static-handler.d.ts","sourceRoot":"","sources":["../../../src/dashboard/routes/static-handler.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAuB5D;;;;;;;;;;;;;GAaG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAElE;AAqBD,wBAAgB,mBAAmB,CACjC,OAAO,EAAE,MAAM,GACd,CAAC,GAAG,EAAE,eAAe,EAAE,GAAG,EAAE,cAAc,KAAK,OAAO,CAAC,IAAI,CAAC,CA+E9D"}
|
|
@@ -21,17 +21,21 @@ const MIME = {
|
|
|
21
21
|
'.txt': 'text/plain; charset=utf-8',
|
|
22
22
|
};
|
|
23
23
|
/**
|
|
24
|
-
* True if `target` resolves to a path inside `root`.
|
|
25
|
-
*
|
|
26
|
-
*
|
|
27
|
-
*
|
|
28
|
-
*
|
|
29
|
-
* resolve()/join() produce backslash-joined paths
|
|
30
|
-
*
|
|
31
|
-
*
|
|
24
|
+
* True if `target` resolves to a path inside `root`. Both branches are
|
|
25
|
+
* literal string checks ('/' and '\\') and must stay that way — never
|
|
26
|
+
* replace either with a `path.sep`-derived value.
|
|
27
|
+
*
|
|
28
|
+
* Dropping the backslash branch breaks static asset serving on Windows,
|
|
29
|
+
* where resolve()/join() produce backslash-joined paths that a '/'-only
|
|
30
|
+
* check never matches. Making either branch non-literal (e.g. concatenating
|
|
31
|
+
* a runtime `sep` variable instead of a quoted character) breaks static
|
|
32
|
+
* analysis: CodeQL cannot statically prove that a runtime separator value
|
|
33
|
+
* equals '/', so it stops recognising this as the standard
|
|
34
|
+
* path-containment sanitizer pattern and flags the file reads below as
|
|
35
|
+
* path injection.
|
|
32
36
|
*/
|
|
33
|
-
export function isWithinRoot(root, target
|
|
34
|
-
return target.startsWith(root + '/') || target.startsWith(root +
|
|
37
|
+
export function isWithinRoot(root, target) {
|
|
38
|
+
return target.startsWith(root + '/') || target.startsWith(root + '\\');
|
|
35
39
|
}
|
|
36
40
|
async function serveIndexFallback(root, res) {
|
|
37
41
|
try {
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"static-handler.js","sourceRoot":"","sources":["../../../src/dashboard/routes/static-handler.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AAGxD,MAAM,IAAI,GAA2B;IACnC,OAAO,EAAE,0BAA0B;IACnC,KAAK,EAAE,uCAAuC;IAC9C,MAAM,EAAE,uCAAuC;IAC/C,MAAM,EAAE,yBAAyB;IACjC,OAAO,EAAE,iCAAiC;IAC1C,MAAM,EAAE,eAAe;IACvB,MAAM,EAAE,WAAW;IACnB,MAAM,EAAE,YAAY;IACpB,OAAO,EAAE,YAAY;IACrB,MAAM,EAAE,WAAW;IACnB,MAAM,EAAE,cAAc;IACtB,OAAO,EAAE,WAAW;IACpB,QAAQ,EAAE,YAAY;IACtB,MAAM,EAAE,iCAAiC;IACzC,OAAO,EAAE,kBAAkB;IAC3B,OAAO,EAAE,YAAY;IACrB,OAAO,EAAE,YAAY;IACrB,MAAM,EAAE,2BAA2B;CACpC,CAAC;AAEF
|
|
1
|
+
{"version":3,"file":"static-handler.js","sourceRoot":"","sources":["../../../src/dashboard/routes/static-handler.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AAGxD,MAAM,IAAI,GAA2B;IACnC,OAAO,EAAE,0BAA0B;IACnC,KAAK,EAAE,uCAAuC;IAC9C,MAAM,EAAE,uCAAuC;IAC/C,MAAM,EAAE,yBAAyB;IACjC,OAAO,EAAE,iCAAiC;IAC1C,MAAM,EAAE,eAAe;IACvB,MAAM,EAAE,WAAW;IACnB,MAAM,EAAE,YAAY;IACpB,OAAO,EAAE,YAAY;IACrB,MAAM,EAAE,WAAW;IACnB,MAAM,EAAE,cAAc;IACtB,OAAO,EAAE,WAAW;IACpB,QAAQ,EAAE,YAAY;IACtB,MAAM,EAAE,iCAAiC;IACzC,OAAO,EAAE,kBAAkB;IAC3B,OAAO,EAAE,YAAY;IACrB,OAAO,EAAE,YAAY;IACrB,MAAM,EAAE,2BAA2B;CACpC,CAAC;AAEF;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,YAAY,CAAC,IAAY,EAAE,MAAc;IACvD,OAAO,MAAM,CAAC,UAAU,CAAC,IAAI,GAAG,GAAG,CAAC,IAAI,MAAM,CAAC,UAAU,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC;AACzE,CAAC;AAED,KAAK,UAAU,kBAAkB,CAAC,IAAY,EAAE,GAAmB;IACjE,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;QAC3C,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,SAAS,CAAC,CAAC;QACvC,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE;YACjB,cAAc,EAAE,0BAA0B;YAC1C,gBAAgB,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC;YACrC,mEAAmE;YACnE,gEAAgE;YAChE,gBAAgB;YAChB,eAAe,EAAE,UAAU;SAC5B,CAAC,CAAC;QACH,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAChB,CAAC;IAAC,MAAM,CAAC;QACP,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QACnB,GAAG,CAAC,GAAG,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,MAAM,UAAU,mBAAmB,CACjC,OAAe;IAEf,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC9B,OAAO,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACxB,MAAM,GAAG,GAAG,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC;QAC3B,MAAM,OAAO,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC;QACzC,MAAM,QAAQ,GAAG,OAAO,KAAK,GAAG,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QAE9E,8EAA8E;QAC9E,6EAA6E;QAC7E,sEAAsE;QACtE,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,EAAE,CAAC;YAC3E,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;YACnB,GAAG,CAAC,GAAG,EAAE,CAAC;YACV,OAAO;QACT,CAAC;QAED,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC;QAC7C,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC;YAChC,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;YACnB,GAAG,CAAC,GAAG,EAAE,CAAC;YACV,OAAO;QACT,CAAC;QACD,MAAM,GAAG,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,CAAC;QAC1C,MAAM,gBAAgB,GAAG,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC;QAExC,4EAA4E;QAC5E,2EAA2E;QAC3E,uEAAuE;QACvE,IAAI,gBAAgB,IAAI,CAAC,CAAC,GAAG,IAAI,IAAI,CAAC,EAAE,CAAC;YACvC,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;YACnB,GAAG,CAAC,GAAG,EAAE,CAAC;YACV,OAAO;QACT,CAAC;QAED,IAAI,CAAC;YACH,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,CAAC;YAC9B,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC;gBACjB,wDAAwD;gBACxD,mEAAmE;gBACnE,+DAA+D;gBAC/D,gEAAgE;gBAChE,2BAA2B;gBAC3B,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;gBACnB,GAAG,CAAC,GAAG,EAAE,CAAC;gBACV,OAAO;YACT,CAAC;YACD,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,0BAA0B,CAAC;YACrD,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,CAAC;YACpC,0DAA0D;YAC1D,iEAAiE;YACjE,iEAAiE;YACjE,+DAA+D;YAC/D,gEAAgE;YAChE,iDAAiD;YACjD,sEAAsE;YACtE,4EAA4E;YAC5E,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YAC1C,MAAM,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,GAAG,GAAG,SAAS,GAAG,EAAE,CAAC,CAAC;YACvD,MAAM,WAAW,GAAG,QAAQ,KAAK,YAAY,CAAC;YAC9C,MAAM,YAAY,GAAG,WAAW;gBAC9B,CAAC,CAAC,UAAU;gBACZ,CAAC,CAAC,OAAO;oBACP,CAAC,CAAC,qCAAqC;oBACvC,CAAC,CAAC,qBAAqB,CAAC;YAC5B,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE;gBACjB,cAAc,EAAE,IAAI;gBACpB,gBAAgB,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC;gBACrC,eAAe,EAAE,YAAY;aAC9B,CAAC,CAAC;YACH,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAChB,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,gBAAgB,EAAE,CAAC;gBACrB,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;gBACnB,GAAG,CAAC,GAAG,EAAE,CAAC;gBACV,OAAO;YACT,CAAC;YACD,OAAO,MAAM,kBAAkB,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QAC7C,CAAC;IACH,CAAC,CAAC;AACJ,CAAC"}
|