@opengis/fastify-table 2.5.20 → 2.5.21

package/dist/server/plugins/auth/funcs/getQuery.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"getQuery.d.ts","sourceRoot":"","sources":["../../../../../server/plugins/auth/funcs/getQuery.ts"],"names":[],"mappings":"AA6BA,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAGpD,wBAA8B,QAAQ,CAAC,EACrC,EAAE,EACF,IAAI,GACL,EAAE;IACD,EAAE,EAAE,UAAU,CAAC;IACf,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;CAC3B,gBAkIA"}
+{"version":3,"file":"getQuery.d.ts","sourceRoot":"","sources":["../../../../../server/plugins/auth/funcs/getQuery.ts"],"names":[],"mappings":"AA6BA,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAGpD,wBAA8B,QAAQ,CAAC,EACrC,EAAE,EACF,IAAI,GACL,EAAE;IACD,EAAE,EAAE,UAAU,CAAC;IACf,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;CAC3B,gBAoIA"}

package/dist/server/plugins/auth/funcs/getQuery.js

@@ -124,5 +124,5 @@ export default async function getQuery({ pg, data, }) {
         .query(`select * from admin.users where uid =(select uid from admin.users_social_auth 
   where ${id ? "social_auth_id=$1" : "email=$1"} limit 1)`, [id || email])
         .then((el) => el.rows?.[0] || {});
-    return result;
+    return { ...result, isNewUser: !(userId || socialUserId) };
 }

package/dist/server/plugins/file/uploadMultiPart.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"uploadMultiPart.d.ts","sourceRoot":"","sources":["../../../../server/plugins/file/uploadMultiPart.ts"],"names":[],"mappings":"AA6BA,MAAM,WAAW,KAAK;IACpB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAC7B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AA2CD,wBAAsB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,mBAkBvE;AAED,wBAAsB,gBAAgB,CACpC,EACE,IAAI,EAAE,QAAQ,EACd,MAA2C,EAC3C,MAAM,GACP,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,EACpD,MAAM,MAAW,mBA+BlB;AAED,wBAAsB,eAAe,CACnC,GAAG,EAAE,GAAG,EACR,EACE,UAAU,EACV,GAAG,EACH,MAAM,EACN,gBAAwB,GACzB,GAAE;IACD,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,gBAAgB,CAAC,EAAE,OAAO,CAAC;CACvB,GACL,OAAO,CAAC,KAAK,CAAC,CAmHhB;AAED,eAAe,eAAe,CAAC"}
+{"version":3,"file":"uploadMultiPart.d.ts","sourceRoot":"","sources":["../../../../server/plugins/file/uploadMultiPart.ts"],"names":[],"mappings":"AA6BA,MAAM,WAAW,KAAK;IACpB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAC7B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AA2CD,wBAAsB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,mBAkBvE;AAED,wBAAsB,gBAAgB,CACpC,EACE,IAAI,EAAE,QAAQ,EACd,MAA2C,EAC3C,MAAM,GACP,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,EACpD,MAAM,MAAW,mBA+BlB;AAED,wBAAsB,eAAe,CACnC,GAAG,EAAE,GAAG,EACR,EACE,UAAU,EACV,GAAG,EACH,MAAM,EACN,gBAAwB,GACzB,GAAE;IACD,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,gBAAgB,CAAC,EAAE,OAAO,CAAC;CACvB,GACL,OAAO,CAAC,KAAK,CAAC,CAwHhB;AAED,eAAe,eAAe,CAAC"}

package/dist/server/plugins/file/uploadMultiPart.js

@@ -90,6 +90,10 @@ export async function uploadMultiPart(req, { extensions, raw, subdir, originalFi
     if (extensions && !extensions.includes(ext)) {
         throw new BadRequestError("file extension is not allowed");
     }
+    const dir = subdir != null ? subdir : req.params?.["*"] || "uploads";
+    if (dir.replace(/%2e/g, ".").replace(/%2E/g, ".").includes("..")) {
+        throw new ConflictError("path traversal is not allowed");
+    }
     // ! check extension by core list if custom not provided - from filename
     if (!extensions && !allowedExtensions.includes(ext.substring(1))) {
         throw new BadRequestError("file extension is not allowed");
@@ -119,7 +123,6 @@ export async function uploadMultiPart(req, { extensions, raw, subdir, originalFi
     if (fileExtension !== nameExt) {
         throw new ConflictError("file type spoofing attempt detected");
     }
-    const dir = subdir != null ? subdir : req.params?.["*"] || "uploads";
     const yearMonthDay = subdir != null ? "" : new Date().toISOString().split("T")[0];
     const dbname = req.pg?.options?.database || req.pg?.database || config.pg?.database; // request / config params / default config params
     const rootDir = config.root || `/data/local/${dbname || ""}`;

package/dist/server/plugins/policy/funcs/checkPolicy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"checkPolicy.d.ts","sourceRoot":"","sources":["../../../../../server/plugins/policy/funcs/checkPolicy.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAEV,eAAe,EAEhB,MAAM,wBAAwB,CAAC;AAKhC,MAAM,CAAC,OAAO,UAAU,WAAW,CAAC,GAAG,EAAE,eAAe,EAAE,GAAG,CAAC,EAAE,GAAG,QAmJlE"}
+{"version":3,"file":"checkPolicy.d.ts","sourceRoot":"","sources":["../../../../../server/plugins/policy/funcs/checkPolicy.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAEV,eAAe,EAEhB,MAAM,wBAAwB,CAAC;AAKhC,MAAM,CAAC,OAAO,UAAU,WAAW,CAAC,GAAG,EAAE,eAAe,EAAE,GAAG,CAAC,EAAE,GAAG,QAkIlE"}

package/dist/server/plugins/policy/funcs/checkPolicy.js

@@ -1,5 +1,5 @@
 import { config, logger } from "../../../../utils.js";
-import { ConflictError, ForbiddenError } from "../../../../errors.js";
+import { ForbiddenError } from "../../../../errors.js";
 export default function checkPolicy(req, jwt) {
     const { originalUrl: path, hostname, query, params, headers, method, routeOptions, } = req;
     const user = req.user || req.session?.passport?.user;
@@ -12,7 +12,7 @@ export default function checkPolicy(req, jwt) {
         hostname.startsWith("admin");
     const { role, referer, policy = [], } = (routeOptions?.config || {});
     // role=admin|regular
-    const isRole = (role && (!user?.user_type || !role?.includes?.(user?.user_type))) ||
+    const isRole = (role && (!user?.user_type || !user?.user_type?.includes?.(role))) ||
         (policy.includes("admin") && !user?.user_type?.includes?.("admin"));
     const allowExtPublic = [".png", ".jpg", ".svg"];
     const ext = path.toLowerCase().substr(-4);
@@ -47,20 +47,6 @@ export default function checkPolicy(req, jwt) {
         });
         throw ForbiddenError("access restricted: 0");
     }
-    // ! file injection
-    if (JSON.stringify(params || {})?.includes("../") ||
-        JSON.stringify(query || {})?.includes("../") ||
-        path?.includes("../")) {
-        logger.file("injection/file", {
-            path,
-            method,
-            params,
-            query,
-            body,
-            uid: user?.uid,
-        });
-        throw ConflictError("access restricted: 1");
-    }
     // ! invalid file extension
     if (path.includes("files/") && allowExtPublic.includes(ext)) {
         return null;

package/dist/server/plugins/policy/funcs/checkTraversal.d.ts

@@ -0,0 +1,2 @@
+export default function checkTraversal(request: any): void;
+//# sourceMappingURL=checkTraversal.d.ts.map

package/dist/server/plugins/policy/funcs/checkTraversal.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"checkTraversal.d.ts","sourceRoot":"","sources":["../../../../../server/plugins/policy/funcs/checkTraversal.ts"],"names":[],"mappings":"AAUA,MAAM,CAAC,OAAO,UAAU,cAAc,CAAC,OAAO,EAAE,GAAG,QAgBlD"}

package/dist/server/plugins/policy/funcs/checkTraversal.js

@@ -0,0 +1,22 @@
+import { logger } from "../../../../utils.js";
+import { ConflictError } from "../../../../errors.js";
+const decodeTraversal = (str) => str
+    .replace(/%2e/g, ".")
+    .replace(/%2E/g, ".")
+    .replace(/%2f/g, "/")
+    .replace(/%2F/g, "/");
+export default function checkTraversal(request) {
+    const { method, originalUrl, query, params, user } = request;
+    if (decodeTraversal(JSON.stringify(params || {})).includes("../") ||
+        decodeTraversal(JSON.stringify(query || {})).includes("../") ||
+        decodeTraversal(originalUrl).includes("../")) {
+        logger.file("injection/file", {
+            path: originalUrl,
+            method,
+            params,
+            query,
+            uid: user?.uid,
+        });
+        throw ConflictError("path traversal detected");
+    }
+}

package/dist/server/plugins/policy/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../server/plugins/policy/index.ts"],"names":[],"mappings":"AAMA,iBAAS,MAAM,CAAC,OAAO,EAAE,GAAG,QA6B3B;AAED,eAAe,MAAM,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../server/plugins/policy/index.ts"],"names":[],"mappings":"AAOA,iBAAS,MAAM,CAAC,OAAO,EAAE,GAAG,QA+B3B;AAED,eAAe,MAAM,CAAC"}

package/dist/server/plugins/policy/index.js

@@ -1,9 +1,11 @@
 import config from "../../../config.js";
 import checkPolicy from "./funcs/checkPolicy.js";
+import checkTraversal from "./funcs/checkTraversal.js";
 import checkPermissions from "./funcs/checkPermissions.js";
 import checkJWT from "./funcs/checkJWT.js";
 function plugin(fastify) {
-    fastify.addHook("preHandler", async (request, reply) => {
+    fastify.addHook("preHandler", async (request) => {
+        checkTraversal(request);
         // ! skip locally, skip tests
         if ((process.env.local === "true" || process.env.NODE_ENV === "test") &&
             !config.debugAuth &&

package/dist/server/plugins/upload/startUpload.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"startUpload.d.ts","sourceRoot":"","sources":["../../../../server/plugins/upload/startUpload.ts"],"names":[],"mappings":"AAoBA,wBAA8B,WAAW,CAAC,EACxC,IAAI,EACJ,EAAE,EACF,QAAQ,EACR,IAAI,EACJ,MAAM,EACN,gBAAwB,GACzB,EAAE;IACD,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,gBAAgB,CAAC,EAAE,OAAO,CAAC;CAC5B,gBA6FA"}
+{"version":3,"file":"startUpload.d.ts","sourceRoot":"","sources":["../../../../server/plugins/upload/startUpload.ts"],"names":[],"mappings":"AAyBA,wBAA8B,WAAW,CAAC,EACxC,IAAI,EACJ,EAAE,EACF,QAAQ,EACR,IAAI,EACJ,MAAM,EACN,gBAAwB,GACzB,EAAE;IACD,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,gBAAgB,CAAC,EAAE,OAAO,CAAC;CAC5B,gBA2GA"}

package/dist/server/plugins/upload/startUpload.js

@@ -4,20 +4,29 @@ import { mkdir, writeFile } from "node:fs/promises";
 import config from "../../../config.js";
 import getUploadStatus from "./getUploadStatus.js";
 import { prefix, fileDir, metaDir, uploadChunkDirectory, fetchTimeoutMs, } from "./index.js";
+import { all } from "../file/utils/allowedExtensions.js";
 import mimes from "../file/providers/mime/mimes.js";
 import { startUpload as startUploadS3 } from "./s3.js";
-import { BadRequestError, NotImplementedError } from "../../../errors.js";
+import { BadRequestError, ForbiddenError, NotImplementedError, } from "../../../errors.js";
 const { chunkSize = 5242880 } = config;
 export default async function startUpload({ host, id, fileName, size, subdir, originalFilename = false, }) {
-    if (subdir && (typeof subdir !== "string" || subdir.includes(".."))) {
+    if (subdir &&
+        (typeof subdir !== "string" ||
+            subdir.replace(/%2e/g, ".").replace(/%2E/g, ".").includes(".."))) {
         throw BadRequestError("invalid params: subdir");
     }
     if (originalFilename) {
         throw NotImplementedError("currently not supported");
     }
+    if (!fileName) {
+        throw BadRequestError("not enough params: fileName");
+    }
+    const extension = path.extname(fileName).substring(1);
+    if (!all.includes(extension)) {
+        throw ForbiddenError("file extension is not allowed");
+    }
     if (!host) {
         const id1 = id || randomUUID();
-        const extension = path.extname(fileName).substring(1);
         const yearMonthDay = subdir ? "" : new Date().toISOString().split("T")[0];
         const relativeDirpath = path
             .join(uploadChunkDirectory, subdir || "", yearMonthDay || "")

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@opengis/fastify-table",
-  "version": "2.5.20",
+  "version": "2.5.21",
   "type": "module",
   "description": "core-plugins",
   "keywords": [