@nocobase/logger 2.2.23 → 2.2.24

package/lib/config.d.ts

@@ -7,6 +7,11 @@
  * For more information, please refer to: https://www.nocobase.com/agreement.
  */
 export declare const getLoggerLevel: () => string;
+/**
+ * Resolve a directory inside the log root. Callers pass app names, plugin names and record ids, so the result is
+ * checked to stay under the root: `path.resolve` silently adopts an absolute segment and happily walks out of the
+ * root on `..`, which would turn any caller that forwards untrusted input into an arbitrary-directory write.
+ */
 export declare const getLoggerFilePath: (...paths: string[]) => string;
 export declare const getLoggerTransport: () => ('console' | 'file' | 'dailyRotateFile')[];
 export declare const getLoggerFormat: () => 'logfmt' | 'json' | 'delimiter' | 'console';

package/lib/config.js

@@ -47,7 +47,12 @@ var import_path = __toESM(require("path"));
 var import_utils = require("@nocobase/utils");
 const getLoggerLevel = /* @__PURE__ */ __name(() => process.env.LOGGER_LEVEL || (process.env.APP_ENV === "development" ? "debug" : "info"), "getLoggerLevel");
 const getLoggerFilePath = /* @__PURE__ */ __name((...paths) => {
-  return import_path.default.resolve((0, import_utils.storagePathJoin)("logs"), ...paths);
+  const root = import_path.default.resolve((0, import_utils.storagePathJoin)("logs"));
+  const resolved = import_path.default.resolve(root, ...paths);
+  if (resolved !== root && !resolved.startsWith(root + import_path.default.sep)) {
+    throw new Error(`log path ${paths.join("/")} escapes the log directory`);
+  }
+  return resolved;
 }, "getLoggerFilePath");
 const getLoggerTransport = /* @__PURE__ */ __name(() => (process.env.LOGGER_TRANSPORT || "console,dailyRotateFile").split(","), "getLoggerTransport");
 const getLoggerFormat = /* @__PURE__ */ __name(() => process.env.LOGGER_FORMAT || (process.env.APP_ENV === "development" ? "console" : "json"), "getLoggerFormat");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nocobase/logger",
-  "version": "2.2.23",
+  "version": "2.2.24",
   "description": "nocobase logging library",
   "license": "Apache-2.0",
   "main": "./lib/index.js",
@@ -11,7 +11,7 @@
     "directory": "packages/logger"
   },
   "dependencies": {
-    "@nocobase/utils": "2.2.23",
+    "@nocobase/utils": "2.2.24",
     "chalk": "^4",
     "lodash": "^4.17.21",
     "triple-beam": "^1.4.1",
@@ -19,5 +19,5 @@
     "winston-daily-rotate-file": "^5.0.0",
     "winston-transport": "^4.7.0"
   },
-  "gitHead": "71852bf1353c21818600ffe7b2a38aa68b5e47e6"
+  "gitHead": "b067d4c18834112e59bb72b2084e872c59d64f9c"
 }