@nocobase/server 2.1.0-alpha.30 → 2.1.0-alpha.32

package/lib/gateway/index.d.ts

@@ -60,6 +60,8 @@ export declare class Gateway extends EventEmitter {
     private socketPath;
     private v2IndexTemplateCache;
     private terminating;
+    private getOriginalRequestUrl;
+    private proxyRequestToSubApp;
     private onTerminate;
     private constructor();
     static getInstance(options?: any): Gateway;

package/lib/gateway/index.js

@@ -103,6 +103,18 @@ const _Gateway = class _Gateway extends import_events.EventEmitter {
   socketPath = getSocketPath();
   v2IndexTemplateCache = null;
   terminating = false;
+  getOriginalRequestUrl(req) {
+    return req.originalUrl || req.url;
+  }
+  async proxyRequestToSubApp(supervisor, appName, req, res) {
+    const internalUrl = req.url;
+    req.url = this.getOriginalRequestUrl(req);
+    try {
+      return await supervisor.proxyWeb(appName, req, res);
+    } finally {
+      req.url = internalUrl;
+    }
+  }
   onTerminate = /* @__PURE__ */ __name(async (signal) => {
     var _a;
     if (this.terminating) {
@@ -340,7 +352,7 @@ const _Gateway = class _Gateway extends import_events.EventEmitter {
     }
     if (pathname.startsWith(APP_PUBLIC_PATH + "storage/uploads/")) {
       if (handleApp !== "main") {
-        const isProxy = await supervisor.proxyWeb(handleApp, req, res);
+        const isProxy = await this.proxyRequestToSubApp(supervisor, handleApp, req, res);
         if (isProxy) {
           return;
         }
@@ -354,7 +366,7 @@ const _Gateway = class _Gateway extends import_events.EventEmitter {
     }
     if (pathname.startsWith(PLUGIN_STATICS_PATH) && !pathname.includes("/server/")) {
       if (handleApp !== "main") {
-        const isProxy = await supervisor.proxyWeb(handleApp, req, res);
+        const isProxy = await this.proxyRequestToSubApp(supervisor, handleApp, req, res);
         if (isProxy) {
           return;
         }
@@ -376,7 +388,7 @@ const _Gateway = class _Gateway extends import_events.EventEmitter {
     if (!pathname.startsWith(import_node_process.default.env.API_BASE_PATH)) {
       if (this.isV2Request(pathname)) {
         if (handleApp !== "main") {
-          const isProxy = await supervisor.proxyWeb(handleApp, req, res);
+          const isProxy = await this.proxyRequestToSubApp(supervisor, handleApp, req, res);
           if (isProxy) {
             return;
           }
@@ -396,7 +408,7 @@ const _Gateway = class _Gateway extends import_events.EventEmitter {
         });
       }
       if (handleApp !== "main") {
-        const isProxy = await supervisor.proxyWeb(handleApp, req, res);
+        const isProxy = await this.proxyRequestToSubApp(supervisor, handleApp, req, res);
         if (isProxy) {
           return;
         }
@@ -409,7 +421,7 @@ const _Gateway = class _Gateway extends import_events.EventEmitter {
       });
     }
     if (handleApp !== "main") {
-      const isProxy = await supervisor.proxyWeb(handleApp, req, res);
+      const isProxy = await this.proxyRequestToSubApp(supervisor, handleApp, req, res);
       if (isProxy) {
         return;
       }

package/lib/main-data-source.js

@@ -96,6 +96,7 @@ const _MainDataSource = class _MainDataSource extends import_data_source_manager
         const results = await this.tables2Collections(toAddTables);
         const values = results.map((result) => ({
           ...result,
+          from: "dbsync",
           underscored: false
         }));
         await repo.create({ values, context: ctx });
@@ -115,10 +116,12 @@ const _MainDataSource = class _MainDataSource extends import_data_source_manager
         ...filter
       }
     });
-    const collections = loadedCollections.filter((collection) => {
-      var _a;
-      return ((_a = collection.options) == null ? void 0 : _a.from) !== "db2cm";
-    });
+    const collections = loadedCollections.filter(
+      (collection) => {
+        var _a;
+        return !["db2cm", "dbsync"].includes((_a = collection.options) == null ? void 0 : _a.from);
+      }
+    );
     const loadedData = {};
     for (const collection of collections) {
       const c = db.getCollection(collection.name);

package/lib/plugin-manager/deps.js

@@ -44,7 +44,7 @@ const deps = {
   mathjs: "15.x",
   winston: "3.x",
   "winston-daily-rotate-file": "4.x",
-  koa: "2.x",
+  koa: "3.x",
   "@koa/cors": "5.x",
   "@koa/router": "13.x",
   multer: "1.x",

package/lib/plugin-manager/utils.d.ts

@@ -17,6 +17,8 @@ import Application from '../application';
  * getTempDir() => '/tmp/nocobase'
  */
 export declare function getTempDir(): Promise<string>;
+export declare function assertSafePluginPackageName(packageName: string): void;
+export declare function resolveSafeChildPath(baseDir: string, child: string): string;
 export declare function getLocalPluginPackagesPathArr(): string[];
 export declare function getStoragePluginDir(packageName: string): string;
 export declare function getLocalPluginDir(packageDirBasename: string): string;

package/lib/plugin-manager/utils.js

@@ -37,6 +37,7 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
 var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
 var utils_exports = {};
 __export(utils_exports, {
+  assertSafePluginPackageName: () => assertSafePluginPackageName,
   checkAndGetCompatible: () => checkAndGetCompatible,
   checkCompatible: () => checkCompatible,
   copyTempPackageToStorageAndLinkToNodeModules: () => copyTempPackageToStorageAndLinkToNodeModules,
@@ -71,6 +72,7 @@ __export(utils_exports, {
   removeTmpDir: () => removeTmpDir,
   requireModule: () => requireModule,
   requireNoCache: () => requireNoCache,
+  resolveSafeChildPath: () => resolveSafeChildPath,
   updatePluginByCompressedFileUrl: () => updatePluginByCompressedFileUrl
 });
 module.exports = __toCommonJS(utils_exports);
@@ -96,6 +98,34 @@ async function getTempDir() {
   return import_path.default.join(temporaryDirectory, import_constants.APP_NAME);
 }
 __name(getTempDir, "getTempDir");
+function assertSafePluginPackageName(packageName) {
+  if (!packageName || typeof packageName !== "string") {
+    throw new Error("Invalid plugin package name");
+  }
+  if (packageName.includes("\0")) {
+    throw new Error("Invalid plugin package name");
+  }
+  if (import_path.default.isAbsolute(packageName)) {
+    throw new Error("Invalid plugin package name");
+  }
+  if (packageName.includes("..") || packageName.includes("\\")) {
+    throw new Error("Invalid plugin package name");
+  }
+  const valid = /^(?:@[a-z0-9][a-z0-9._-]*\/)?[a-z0-9][a-z0-9._-]*$/i.test(packageName);
+  if (!valid) {
+    throw new Error("Invalid plugin package name");
+  }
+}
+__name(assertSafePluginPackageName, "assertSafePluginPackageName");
+function resolveSafeChildPath(baseDir, child) {
+  const resolvedBase = import_path.default.resolve(baseDir);
+  const resolvedTarget = import_path.default.resolve(baseDir, child);
+  if (resolvedTarget !== resolvedBase && !resolvedTarget.startsWith(`${resolvedBase}${import_path.default.sep}`)) {
+    throw new Error("Path traversal detected");
+  }
+  return resolvedTarget;
+}
+__name(resolveSafeChildPath, "resolveSafeChildPath");
 function getLocalPluginPackagesPathArr() {
   const pluginPackagesPathArr = process.env.PLUGIN_PATH || import_constants.DEFAULT_PLUGIN_PATH;
   return pluginPackagesPathArr.split(",").map((pluginPackagesPath) => {
@@ -106,7 +136,8 @@ function getLocalPluginPackagesPathArr() {
 __name(getLocalPluginPackagesPathArr, "getLocalPluginPackagesPathArr");
 function getStoragePluginDir(packageName) {
   const pluginStoragePath = (0, import_utils.resolvePluginStoragePath)();
-  return import_path.default.join(pluginStoragePath, packageName);
+  assertSafePluginPackageName(packageName);
+  return resolveSafeChildPath(pluginStoragePath, packageName);
 }
 __name(getStoragePluginDir, "getStoragePluginDir");
 function getLocalPluginDir(packageDirBasename) {
@@ -118,7 +149,8 @@ function getLocalPluginDir(packageDirBasename) {
 }
 __name(getLocalPluginDir, "getLocalPluginDir");
 function getNodeModulesPluginDir(packageName) {
-  return import_path.default.join(process.env.NODE_MODULES_PATH, packageName);
+  assertSafePluginPackageName(packageName);
+  return resolveSafeChildPath(process.env.NODE_MODULES_PATH, packageName);
 }
 __name(getNodeModulesPluginDir, "getNodeModulesPluginDir");
 function getAuthorizationHeaders(registry, authToken) {
@@ -551,6 +583,7 @@ async function pmListSummary(app) {
 __name(pmListSummary, "pmListSummary");
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
+  assertSafePluginPackageName,
   checkAndGetCompatible,
   checkCompatible,
   copyTempPackageToStorageAndLinkToNodeModules,
@@ -585,5 +618,6 @@ __name(pmListSummary, "pmListSummary");
   removeTmpDir,
   requireModule,
   requireNoCache,
+  resolveSafeChildPath,
   updatePluginByCompressedFileUrl
 });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nocobase/server",
-  "version": "2.1.0-alpha.30",
+  "version": "2.1.0-alpha.32",
   "main": "lib/index.js",
   "types": "./lib/index.d.ts",
   "license": "Apache-2.0",
@@ -10,21 +10,21 @@
     "@koa/cors": "^5.0.0",
     "@koa/multer": "^3.1.0",
     "@koa/router": "^13.1.0",
-    "@nocobase/acl": "2.1.0-alpha.30",
-    "@nocobase/actions": "2.1.0-alpha.30",
-    "@nocobase/ai": "2.1.0-alpha.30",
-    "@nocobase/auth": "2.1.0-alpha.30",
-    "@nocobase/cache": "2.1.0-alpha.30",
-    "@nocobase/data-source-manager": "2.1.0-alpha.30",
-    "@nocobase/database": "2.1.0-alpha.30",
-    "@nocobase/evaluators": "2.1.0-alpha.30",
-    "@nocobase/lock-manager": "2.1.0-alpha.30",
-    "@nocobase/logger": "2.1.0-alpha.30",
-    "@nocobase/resourcer": "2.1.0-alpha.30",
-    "@nocobase/sdk": "2.1.0-alpha.30",
-    "@nocobase/snowflake-id": "2.1.0-alpha.30",
-    "@nocobase/telemetry": "2.1.0-alpha.30",
-    "@nocobase/utils": "2.1.0-alpha.30",
+    "@nocobase/acl": "2.1.0-alpha.32",
+    "@nocobase/actions": "2.1.0-alpha.32",
+    "@nocobase/ai": "2.1.0-alpha.32",
+    "@nocobase/auth": "2.1.0-alpha.32",
+    "@nocobase/cache": "2.1.0-alpha.32",
+    "@nocobase/data-source-manager": "2.1.0-alpha.32",
+    "@nocobase/database": "2.1.0-alpha.32",
+    "@nocobase/evaluators": "2.1.0-alpha.32",
+    "@nocobase/lock-manager": "2.1.0-alpha.32",
+    "@nocobase/logger": "2.1.0-alpha.32",
+    "@nocobase/resourcer": "2.1.0-alpha.32",
+    "@nocobase/sdk": "2.1.0-alpha.32",
+    "@nocobase/snowflake-id": "2.1.0-alpha.32",
+    "@nocobase/telemetry": "2.1.0-alpha.32",
+    "@nocobase/utils": "2.1.0-alpha.32",
     "@types/decompress": "4.2.7",
     "@types/ini": "^1.3.31",
     "@types/koa-send": "^4.1.3",
@@ -42,7 +42,7 @@
     "fs-extra": "^11.1.1",
     "i18next": "^22.4.9",
     "ini": "^4.1.1",
-    "koa": "^2.15.4",
+    "koa": "^3.2.0",
     "koa-bodyparser": "^4.3.0",
     "koa-send": "^5.0.1",
     "koa-static": "^5.0.0",
@@ -61,5 +61,5 @@
     "@types/serve-handler": "^6.1.1",
     "@types/ws": "^8.5.5"
   },
-  "gitHead": "292ae0ad87f195ed201b274902d21ecd96f5ddd0"
+  "gitHead": "1ba7d717e156651db17c615f9b9c48edd669d19b"
 }