@opengis/fastify-table 2.5.46 → 2.5.47
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/server/plugins/file/utils/inspectContent.d.ts +1 -1
- package/dist/server/plugins/file/utils/inspectContent.d.ts.map +1 -1
- package/dist/server/plugins/file/utils/inspectContent.js +23 -7
- package/dist/server/plugins/policy/funcs/checkXSS.d.ts.map +1 -1
- package/dist/server/plugins/policy/funcs/checkXSS.js +1 -0
- package/dist/server/plugins/upload/s3.d.ts.map +1 -1
- package/dist/server/plugins/upload/s3.js +8 -0
- package/package.json +1 -1
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"inspectContent.d.ts","sourceRoot":"","sources":["../../../../../server/plugins/file/utils/inspectContent.ts"],"names":[],"mappings":"
|
|
1
|
+
{"version":3,"file":"inspectContent.d.ts","sourceRoot":"","sources":["../../../../../server/plugins/file/utils/inspectContent.ts"],"names":[],"mappings":"AAkDA,wBAA8B,cAAc,CAC1C,KAAK,EAAE,MAAM,GAAG,cAAc,EAC9B,iBAAiB,EAAE,MAAM;;;;GAoE1B"}
|
|
@@ -1,4 +1,4 @@
|
|
|
1
|
-
import { fileTypeFromBuffer } from "file-type";
|
|
1
|
+
import { fileTypeFromBuffer, fileTypeFromStream } from "file-type";
|
|
2
2
|
import { BadRequestError } from "../../../../errors.js";
|
|
3
3
|
import applyHook from "../../hook/applyHook.js";
|
|
4
4
|
// Office 97–2003 (.doc/.xls/.ppt) share CFB magic; file-type reports them as "cfb"
|
|
@@ -38,24 +38,40 @@ const handlers = {
|
|
|
38
38
|
}
|
|
39
39
|
},
|
|
40
40
|
};
|
|
41
|
-
|
|
41
|
+
const isReadableStream = (stream) => stream && stream instanceof ReadableStream;
|
|
42
|
+
export default async function inspectContent(input, expectedExtension) {
|
|
42
43
|
if (!expectedExtension) {
|
|
43
|
-
throw new
|
|
44
|
+
throw new Error("not enough params: expectedExtension");
|
|
44
45
|
}
|
|
45
|
-
|
|
46
|
-
|
|
46
|
+
const buffer = Buffer.isBuffer(input) ? input : undefined;
|
|
47
|
+
const stream = !buffer ? input : undefined;
|
|
48
|
+
if (buffer && !buffer.length) {
|
|
49
|
+
throw BadRequestError("Invalid buffer");
|
|
50
|
+
}
|
|
51
|
+
if (stream && !isReadableStream(stream)) {
|
|
52
|
+
throw BadRequestError("invalid params: input");
|
|
53
|
+
}
|
|
54
|
+
if (!buffer && !stream) {
|
|
55
|
+
throw new Error("not enough params: input");
|
|
47
56
|
}
|
|
48
57
|
// custom inspection of extensions like kml, svg etc
|
|
49
58
|
const hookData = (await applyHook("onInspectContent", {
|
|
50
59
|
buffer,
|
|
60
|
+
stream,
|
|
51
61
|
expectedExtension,
|
|
52
62
|
}));
|
|
53
63
|
if (hookData) {
|
|
54
64
|
return hookData;
|
|
55
65
|
}
|
|
56
|
-
const
|
|
66
|
+
const inspectResult1 = buffer
|
|
67
|
+
? await fileTypeFromBuffer(buffer)
|
|
68
|
+
: stream
|
|
69
|
+
? await fileTypeFromStream(stream)
|
|
70
|
+
: undefined;
|
|
71
|
+
const inspectResult2 = stream ? await fileTypeFromStream(stream) : undefined;
|
|
72
|
+
const { ext, mime } = inspectResult1 || inspectResult2 || {};
|
|
57
73
|
// ? geojson, signed pdf, kml, svg etc - not recognized - inspecting the content
|
|
58
|
-
if (!ext && handlers[expectedExtension]) {
|
|
74
|
+
if (!ext && handlers[expectedExtension] && buffer) {
|
|
59
75
|
const { ext: ext2, mime: mime2 } = (await handlers[expectedExtension](buffer)) || {};
|
|
60
76
|
return { ext: ext2, mime: mime2, isValid: ext2 === expectedExtension };
|
|
61
77
|
}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"checkXSS.d.ts","sourceRoot":"","sources":["../../../../../server/plugins/policy/funcs/checkXSS.ts"],"names":[],"mappings":"AAGA,iBAAS,QAAQ,CAAC,EAAE,IAAI,EAAE,MAAW,EAAE,EAAE,GAAG;;;;;;
|
|
1
|
+
{"version":3,"file":"checkXSS.d.ts","sourceRoot":"","sources":["../../../../../server/plugins/policy/funcs/checkXSS.ts"],"names":[],"mappings":"AAGA,iBAAS,QAAQ,CAAC,EAAE,IAAI,EAAE,MAAW,EAAE,EAAE,GAAG;;;;;;EA0D3C;AAED,eAAe,QAAQ,CAAC"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"s3.d.ts","sourceRoot":"","sources":["../../../../server/plugins/upload/s3.ts"],"names":[],"mappings":"
|
|
1
|
+
{"version":3,"file":"s3.d.ts","sourceRoot":"","sources":["../../../../server/plugins/upload/s3.ts"],"names":[],"mappings":"AAmGA,wBAAsB,sBAAsB,CAAC,EAAE,MAAW,iBAwCzD;AAED,wBAAsB,cAAc,CAClC,EAAE,EAAE,MAAM,EACV,IAAI,EAAE,GAAG,EACT,GAAG,SAAqB,iBAazB;AAED,wBAAsB,gBAAgB,CACpC,EAAE,EAAE,MAAM,EACV,GAAG,SAAqB,EACxB,EAAE,MAAW,iBAsBd;AAED,wBAAsB,gBAAgB,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,MAAM,iBA2B9D;AAED,wBAAsB,aAAa,CAAC,EAAE,EAAE,MAAM,gBAQ7C;AAED,wBAAsB,oBAAoB,CAAC,GAAG,EAAE,MAAM,gBAMrD;AAED,wBAAsB,mBAAmB,CAAC,EAAE,MAAW,iBAyEtD;AAED,wBAAsB,UAAU,CAAC,EAAE,EAAE,EAAE,EAAE;IAAE,EAAE,EAAE,MAAM,CAAA;CAAE,EAAE,EAAE,MAAW;;;;;;;;GAsCrE;AAKD,wBAAsB,WAAW,CAC/B,EACE,MAAM,EACN,GAAG,EACH,WAAW,EACX,QAAQ,GACT,EAAE;IACD,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;CAClB,EACD,EAAE,MAAW;;;;;;;;;;;;;;;;GAsDd;AASD,wBAAsB,QAAQ,CAC5B,EAAE,EAAE,MAAM,EACV,IAAI,EAAE;IACJ,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;CACpB,iBAwBF;AAED,wBAAsB,cAAc,CAAC,EAAE,EAAE,MAAM,kBAY9C;AAED,wBAAsB,iBAAiB,CAAC,EAAE,EAAE,MAAM,iBAQjD;AAED,wBAAsB,WAAW,CAC/B,EACE,EAAE,EACF,KAAK,EACL,UAAU,GACX,EAAE;IACD,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,GAAG,CAAC;IACX,UAAU,EAAE,MAAM,CAAC;CACpB,EACD,EAAE,MAAW;;;;;;;;GAyCd;AAED,wBAAsB,YAAY,CAChC,EACE,EAAE,GACH,EAAE;IACD,EAAE,EAAE,MAAM,CAAC;CACZ,EACD,EAAE,MAAW;;;;GA2Cd;AAED,wBAAsB,WAAW,CAC/B,EACE,EAAE,GACH,EAAE;IACD,EAAE,EAAE,MAAM,CAAC;CACZ,EACD,EAAE,MAAW;;GAwBd;AAED,wBAAsB,eAAe,CACnC,EACE,EAAE,EACF,GAAG,EACH,MAAM,GACP,EAAE;IACD,EAAE,EAAE,MAAM,CAAC;IACX,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,EACD,EAAE,MAAW;;;;;;;;;;;;;;GAqEd"}
|
|
@@ -4,6 +4,8 @@ import config from "../../../config.js";
|
|
|
4
4
|
import s3Client from "../file/providers/s3/client.js";
|
|
5
5
|
import rclient from "../redis/client.js";
|
|
6
6
|
import logger from "../logger/getLogger.js";
|
|
7
|
+
import inspectContent from "../file/utils/inspectContent.js";
|
|
8
|
+
import { ConflictError } from "../../../errors.js";
|
|
7
9
|
const uploads = new Map();
|
|
8
10
|
const resumableUploads = new Map();
|
|
9
11
|
// non-redis upload timeout handlers
|
|
@@ -339,6 +341,12 @@ export async function uploadChunk({ id, chunk, partNumber, }, s3 = s3Client) {
|
|
|
339
341
|
if (upload.parts.some((p) => p.PartNumber === partNumber)) {
|
|
340
342
|
throw new Error(`Part ${partNumber} already uploaded`);
|
|
341
343
|
}
|
|
344
|
+
if (partNumber === 1) {
|
|
345
|
+
const { isValid } = await inspectContent(chunk, path.extname(upload.Key).substring(1));
|
|
346
|
+
if (!isValid) {
|
|
347
|
+
throw ConflictError("file type spoofing attempt detected");
|
|
348
|
+
}
|
|
349
|
+
}
|
|
342
350
|
const res = await s3.send(new UploadPartCommand({
|
|
343
351
|
Bucket: upload.Bucket,
|
|
344
352
|
Key: upload.Key,
|