@nocobase/plugin-logger 1.8.16 → 1.8.17

package/dist/externalVersion.js

@@ -8,14 +8,14 @@
  */
 
 module.exports = {
-  "@nocobase/client": "1.8.16",
+  "@nocobase/client": "1.8.17",
   "react": "18.2.0",
   "antd": "5.24.2",
   "@ant-design/icons": "5.6.1",
   "ahooks": "3.7.8",
-  "@nocobase/server": "1.8.16",
+  "@nocobase/server": "1.8.17",
   "react-i18next": "11.18.6",
-  "@nocobase/actions": "1.8.16",
-  "@nocobase/logger": "1.8.16",
+  "@nocobase/actions": "1.8.17",
+  "@nocobase/logger": "1.8.17",
   "lodash": "4.17.21"
 };

package/dist/node_modules/tar-fs/package.json

@@ -1 +1 @@
-{"name":"tar-fs","version":"3.0.4","description":"filesystem bindings for tar-stream","dependencies":{"mkdirp-classic":"^0.5.2","pump":"^3.0.0","tar-stream":"^3.1.5"},"files":["index.js"],"standard":{"ignore":["test/fixtures/**"]},"keywords":["tar","fs","file","tarball","directory","stream"],"devDependencies":{"brittle":"^3.1.3","rimraf":"^2.6.3","standard":"^17.0.1"},"scripts":{"test":"standard && brittle test/index.js"},"bugs":{"url":"https://github.com/mafintosh/tar-fs/issues"},"homepage":"https://github.com/mafintosh/tar-fs","main":"index.js","directories":{"test":"test"},"author":"Mathias Buus","license":"MIT","repository":{"type":"git","url":"https://github.com/mafintosh/tar-fs.git"},"_lastModified":"2025-08-14T02:33:22.116Z"}
+{"name":"tar-fs","version":"3.0.4","description":"filesystem bindings for tar-stream","dependencies":{"mkdirp-classic":"^0.5.2","pump":"^3.0.0","tar-stream":"^3.1.5"},"files":["index.js"],"standard":{"ignore":["test/fixtures/**"]},"keywords":["tar","fs","file","tarball","directory","stream"],"devDependencies":{"brittle":"^3.1.3","rimraf":"^2.6.3","standard":"^17.0.1"},"scripts":{"test":"standard && brittle test/index.js"},"bugs":{"url":"https://github.com/mafintosh/tar-fs/issues"},"homepage":"https://github.com/mafintosh/tar-fs","main":"index.js","directories":{"test":"test"},"author":"Mathias Buus","license":"MIT","repository":{"type":"git","url":"https://github.com/mafintosh/tar-fs.git"},"_lastModified":"2025-08-15T14:03:26.104Z"}

package/dist/server/resourcer/logger.js

@@ -81,7 +81,7 @@ const getLastestLogs = async (path) => {
   return prefixes.map(getLatestLog).filter((file) => file);
 };
 const tarFiles = (path, files) => {
-  return new Promise((resolve, reject) => {
+  return new Promise((resolve2, reject) => {
     const passthrough = new import_stream.default.PassThrough();
     const gz = import_zlib.default.createGzip();
     (0, import_tar_fs.pack)(path, {
@@ -95,7 +95,7 @@ const tarFiles = (path, files) => {
       gz.write(chunk);
     }).on("end", () => {
       gz.end();
-      resolve(gz);
+      resolve2(gz);
     }).on("error", (err) => reject(err));
     gz.on("error", (err) => reject(err));
   });
@@ -135,20 +135,26 @@ var logger_default = {
     },
     download: async (ctx, next) => {
       const path = (0, import_logger.getLoggerFilePath)(ctx.app.name || "main");
-      let { files = [] } = ctx.action.params.values || {};
-      const invalid = files.some((file) => !file.endsWith(".log"));
-      if (invalid) {
-        ctx.throw(400, ctx.t("Invalid file type: ") + invalid);
+      const { files = [] } = ctx.action.params.values || {};
+      if (!files.length) {
+        ctx.throw(400, ctx.t("No files selected."));
       }
-      files = files.map((file) => {
-        if (file.startsWith("/")) {
-          return file.slice(1);
+      const safeFiles = files.map((f) => {
+        const name = f.startsWith("/") ? f.slice(1) : f;
+        const safeName = (0, import_path.normalize)(decodeURIComponent(name));
+        if (!safeName.endsWith(".log")) {
+          ctx.throw(400, ctx.t("Invalid file type."));
+        }
+        const fullPath = (0, import_path.resolve)(path, safeName);
+        const relativePath = (0, import_path.relative)(path, fullPath);
+        if (relativePath.startsWith("..") || (0, import_path.isAbsolute)(relativePath) || relativePath.includes("\0")) {
+          ctx.throw(400, ctx.t("Invalid file path."));
         }
-        return file;
+        return safeName;
       });
       try {
         ctx.attachment("logs.tar.gz");
-        ctx.body = await tarFiles(path, files);
+        ctx.body = await tarFiles(path, safeFiles);
       } catch (err) {
         ctx.log.error(`download error: ${err.message}`, { files, err: err.stack });
         ctx.throw(500, ctx.t("Download logs failed."));

package/package.json

@@ -4,7 +4,7 @@
   "displayName.zh-CN": "日志",
   "description": "Server-side logs, mainly including API request logs and system runtime logs, and allows to package and download log files.",
   "description.zh-CN": "服务端日志，主要包括接口请求日志和系统运行日志，并支持打包和下载日志文件。",
-  "version": "1.8.16",
+  "version": "1.8.17",
   "license": "AGPL-3.0",
   "main": "dist/server/index.js",
   "homepage": "https://docs.nocobase.com/handbook/logger",
@@ -19,7 +19,7 @@
     "@nocobase/server": "1.x",
     "@nocobase/test": "1.x"
   },
-  "gitHead": "3fc4fcf3f7205dece49356a4f1442c6707d509a1",
+  "gitHead": "ded4d65224fac2fdef2b69131530061347c5d84d",
   "keywords": [
     "Logging and monitoring"
   ]