@nocobase/utils 2.3.0-alpha.1 → 3.0.0-alpha.2

package/lib/cors.js

@@ -71,11 +71,14 @@ function isSameOrigin(ctx, origin) {
 }
 __name(isSameOrigin, "isSameOrigin");
 function isTrustedOrigin(ctx, origin) {
-  var _a;
   if (isSameOrigin(ctx, origin)) {
     return true;
   }
-  return ((_a = getCorsWhitelist()) == null ? void 0 : _a.has(origin)) || false;
+  const whitelist = getCorsWhitelist();
+  if (!whitelist) {
+    return false;
+  }
+  return whitelist.has("*") || whitelist.has(origin);
 }
 __name(isTrustedOrigin, "isTrustedOrigin");
 // Annotate the CommonJS export names for ESM import in node:

package/lib/server-request.d.ts

@@ -30,7 +30,8 @@ export declare function checkUrlAgainstWhitelist(url?: string): void;
  * Drop-in replacement for `axios.request()` with built-in SSRF protection.
  *
  * Validates `config.url` against {@link checkUrlAgainstWhitelist} before
- * forwarding to axios. Use this instead of calling axios directly for all
+ * forwarding to axios. Every redirect destination is validated before the
+ * next request is sent. Use this instead of calling axios directly for all
  * server-initiated outbound HTTP requests.
  */
 export declare function serverRequest<T = any>(config: AxiosRequestConfig): Promise<AxiosResponse<T>>;

package/lib/server-request.js

@@ -207,7 +207,18 @@ __name(checkUrlAgainstWhitelist, "checkUrlAgainstWhitelist");
 async function serverRequest(config) {
   checkUrlAgainstWhitelist(config.url);
   await warnIfResolvedSsrfRiskTarget(config.url);
-  return import_axios.default.request(config);
+  return import_axios.default.request({
+    ...config,
+    // Axios request interceptors do not run again for redirects. In Node.js,
+    // beforeRedirect runs after Location is resolved and before the next hop
+    // is sent, so every redirect destination must be checked here.
+    beforeRedirect: /* @__PURE__ */ __name((options) => {
+      if (typeof options.href !== "string") {
+        throw new Error("Unable to validate redirect destination.");
+      }
+      checkUrlAgainstWhitelist(options.href);
+    }, "beforeRedirect")
+  });
 }
 __name(serverRequest, "serverRequest");
 // Annotate the CommonJS export names for ESM import in node:

package/lib/storage-path.js

@@ -43,12 +43,19 @@ __export(storage_path_exports, {
 });
 module.exports = __toCommonJS(storage_path_exports);
 var import_path = __toESM(require("path"));
+function resolveDefaultStorageRoot() {
+  if (import_path.default.basename(process.cwd()) === "source") {
+    return import_path.default.resolve(process.cwd(), "..", "storage");
+  }
+  return import_path.default.resolve(process.cwd(), "storage");
+}
+__name(resolveDefaultStorageRoot, "resolveDefaultStorageRoot");
 function resolveStorageRoot() {
   const raw = process.env.STORAGE_PATH;
   if (raw) {
     return import_path.default.isAbsolute(raw) ? raw : import_path.default.resolve(process.cwd(), raw);
   }
-  return import_path.default.resolve(process.cwd(), "storage");
+  return resolveDefaultStorageRoot();
 }
 __name(resolveStorageRoot, "resolveStorageRoot");
 function storagePathJoin(...segments) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nocobase/utils",
-  "version": "2.3.0-alpha.1",
+  "version": "3.0.0-alpha.2",
   "main": "lib/index.js",
   "types": "./lib/index.d.ts",
   "license": "Apache-2.0",
@@ -21,5 +21,5 @@
     "object-path": "^0.11.8",
     "ses": "^1.14.0"
   },
-  "gitHead": "2377df8ceb12549149017f7f14a61207bf6e49a2"
+  "gitHead": "a3faea21082b30989301de04591ee1b91fd4e6a5"
 }