@nocobase/server 2.1.24 → 2.1.26

package/lib/gateway/index.js

@@ -362,14 +362,17 @@ const _Gateway = class _Gateway extends import_events.EventEmitter {
         }
       }
       const headers = (0, import_static_file_security.getStorageUploadSecurityHeaders)(pathname);
-      for (const [key, value] of Object.entries(headers)) {
-        res.setHeader(key, value);
-      }
       req.url = req.url.substring(APP_PUBLIC_PATH.length + "storage".length);
       await compress(req, res);
       return (0, import_serve_handler.default)(req, res, {
         public: (0, import_utils.resolveStorageRoot)(),
-        directoryListing: false
+        directoryListing: false,
+        headers: [
+          {
+            source: "**/*",
+            headers: Object.entries(headers).map(([key, value]) => ({ key, value }))
+          }
+        ]
       });
     }
     if (pathname.startsWith(APP_PUBLIC_PATH + "dist/")) {

package/lib/gateway/static-file-security.js

@@ -42,7 +42,18 @@ __export(static_file_security_exports, {
 });
 module.exports = __toCommonJS(static_file_security_exports);
 var import_node_path = __toESM(require("node:path"));
-const ACTIVE_CONTENT_EXTENSIONS = /* @__PURE__ */ new Set([".htm", ".html", ".pdf", ".svg", ".svgz", ".xhtml"]);
+const ACTIVE_CONTENT_EXTENSIONS = /* @__PURE__ */ new Set([
+  ".htm",
+  ".html",
+  ".pdf",
+  ".svg",
+  ".svgz",
+  ".xht",
+  ".xhtml",
+  ".xml",
+  ".xsl",
+  ".xslt"
+]);
 function stripQueryAndHash(pathname = "") {
   return pathname.split("?")[0].split("#")[0];
 }
@@ -54,6 +65,7 @@ function hasActiveContentExtension(pathname = "") {
 __name(hasActiveContentExtension, "hasActiveContentExtension");
 function getStorageUploadSecurityHeaders(pathname = "") {
   const headers = {
+    "Content-Security-Policy": "sandbox",
     "X-Content-Type-Options": "nosniff"
   };
   if (hasActiveContentExtension(pathname)) {

package/lib/index.d.ts

@@ -13,6 +13,7 @@ export * from './gateway/ws-server';
 export { Application as default } from './application';
 export * from './audit-manager';
 export * from './gateway';
+export * from './gateway/static-file-security';
 export * as middlewares from './middlewares';
 export * from './migration';
 export * from './plugin';

package/lib/index.js

@@ -55,6 +55,7 @@ __reExport(src_exports, require("./gateway/ws-server"), module.exports);
 var import_application = require("./application");
 __reExport(src_exports, require("./audit-manager"), module.exports);
 __reExport(src_exports, require("./gateway"), module.exports);
+__reExport(src_exports, require("./gateway/static-file-security"), module.exports);
 var middlewares = __toESM(require("./middlewares"));
 __reExport(src_exports, require("./migration"), module.exports);
 __reExport(src_exports, require("./plugin"), module.exports);
@@ -85,6 +86,7 @@ var import_helper = require("./helper");
   ...require("./gateway/ws-server"),
   ...require("./audit-manager"),
   ...require("./gateway"),
+  ...require("./gateway/static-file-security"),
   ...require("./migration"),
   ...require("./plugin"),
   ...require("./plugin-manager"),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nocobase/server",
-  "version": "2.1.24",
+  "version": "2.1.26",
   "main": "lib/index.js",
   "types": "./lib/index.d.ts",
   "license": "Apache-2.0",
@@ -10,21 +10,21 @@
     "@koa/cors": "^5.0.0",
     "@koa/multer": "^3.1.0",
     "@koa/router": "^13.1.0",
-    "@nocobase/acl": "2.1.24",
-    "@nocobase/actions": "2.1.24",
-    "@nocobase/ai": "2.1.24",
-    "@nocobase/auth": "2.1.24",
-    "@nocobase/cache": "2.1.24",
-    "@nocobase/data-source-manager": "2.1.24",
-    "@nocobase/database": "2.1.24",
-    "@nocobase/evaluators": "2.1.24",
-    "@nocobase/lock-manager": "2.1.24",
-    "@nocobase/logger": "2.1.24",
-    "@nocobase/resourcer": "2.1.24",
-    "@nocobase/sdk": "2.1.24",
-    "@nocobase/snowflake-id": "2.1.24",
-    "@nocobase/telemetry": "2.1.24",
-    "@nocobase/utils": "2.1.24",
+    "@nocobase/acl": "2.1.26",
+    "@nocobase/actions": "2.1.26",
+    "@nocobase/ai": "2.1.26",
+    "@nocobase/auth": "2.1.26",
+    "@nocobase/cache": "2.1.26",
+    "@nocobase/data-source-manager": "2.1.26",
+    "@nocobase/database": "2.1.26",
+    "@nocobase/evaluators": "2.1.26",
+    "@nocobase/lock-manager": "2.1.26",
+    "@nocobase/logger": "2.1.26",
+    "@nocobase/resourcer": "2.1.26",
+    "@nocobase/sdk": "2.1.26",
+    "@nocobase/snowflake-id": "2.1.26",
+    "@nocobase/telemetry": "2.1.26",
+    "@nocobase/utils": "2.1.26",
     "@types/decompress": "4.2.7",
     "@types/ini": "^1.3.31",
     "@types/koa-send": "^4.1.3",
@@ -61,5 +61,5 @@
     "@types/serve-handler": "^6.1.1",
     "@types/ws": "^8.5.5"
   },
-  "gitHead": "5b5e5c5987d6e93dadf940e0605e830b09f84f79"
+  "gitHead": "b25700115794487b342ac33a63a1a988c75c112c"
 }