@opengis/fastify-table 2.5.46 → 2.5.48

package/dist/server/plugins/file/uploadMultiPart.d.ts

@@ -12,6 +12,8 @@ export interface IFile {
     fields?: Record<string, any>;
     error?: string;
     code?: number;
+    isValid?: boolean;
+    confidence?: string;
 }
 export declare function rotateFilenameFS(filename: string, dirpath: string): Promise<string>;
 export declare function rotateFilenameS3({ Name: filename, Bucket, Prefix, }: {

package/dist/server/plugins/file/uploadMultiPart.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"uploadMultiPart.d.ts","sourceRoot":"","sources":["../../../../server/plugins/file/uploadMultiPart.ts"],"names":[],"mappings":"AA8BA,MAAM,WAAW,KAAK;IACpB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAC7B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AA2CD,wBAAsB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,mBAkBvE;AAED,wBAAsB,gBAAgB,CACpC,EACE,IAAI,EAAE,QAAQ,EACd,MAA2C,EAC3C,MAAM,GACP,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,EACpD,MAAM,MAAW,mBA+BlB;AAED,wBAAsB,eAAe,CACnC,GAAG,EAAE,GAAG,EACR,EACE,UAAU,EACV,GAAG,EACH,MAAM,EACN,gBAAwB,GACzB,GAAE;IACD,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,gBAAgB,CAAC,EAAE,OAAO,CAAC;CACvB,GACL,OAAO,CAAC,KAAK,CAAC,CA0HhB;AAED,eAAe,eAAe,CAAC"}
+{"version":3,"file":"uploadMultiPart.d.ts","sourceRoot":"","sources":["../../../../server/plugins/file/uploadMultiPart.ts"],"names":[],"mappings":"AA8BA,MAAM,WAAW,KAAK;IACpB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAC7B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AA2CD,wBAAsB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,mBAkBvE;AAED,wBAAsB,gBAAgB,CACpC,EACE,IAAI,EAAE,QAAQ,EACd,MAA2C,EAC3C,MAAM,GACP,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,EACpD,MAAM,MAAW,mBA+BlB;AAED,wBAAsB,eAAe,CACnC,GAAG,EAAE,GAAG,EACR,EACE,UAAU,EACV,GAAG,EACH,MAAM,EACN,gBAAwB,GACzB,GAAE;IACD,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,gBAAgB,CAAC,EAAE,OAAO,CAAC;CACvB,GACL,OAAO,CAAC,KAAK,CAAC,CA4HhB;AAED,eAAe,eAAe,CAAC"}

package/dist/server/plugins/file/uploadMultiPart.js

@@ -112,7 +112,7 @@ export async function uploadMultiPart(req, { extensions, raw, subdir, originalFi
         throw new BadRequestError("file buffer is empty");
     }
     const nameExt = ext.substring(1);
-    const { isValid } = await inspectContent(fileBuffer, nameExt);
+    const { isValid, confidence } = await inspectContent(fileBuffer, nameExt);
     // return buffer for custom upload
     if (raw) {
         return {
@@ -121,6 +121,8 @@ export async function uploadMultiPart(req, { extensions, raw, subdir, originalFi
             extension: ext.substring(1),
             mimetype: value.mimetype,
             fields: value.fields,
+            isValid,
+            confidence,
         };
     }
     if (!isValid) {

package/dist/server/plugins/file/utils/inspectContent.d.ts

@@ -1,6 +1,12 @@
-export default function inspectContent(buffer: Buffer, expectedExtension: string): Promise<{
+export default function inspectContent(input: Buffer | ReadableStream, expectedExtension: string): Promise<{
     ext: any;
     mime: any;
     isValid: boolean;
+    confidence: any;
+} | {
+    ext: string | undefined;
+    mime: string | undefined;
+    isValid: boolean;
+    confidence?: undefined;
 }>;
 //# sourceMappingURL=inspectContent.d.ts.map

package/dist/server/plugins/file/utils/inspectContent.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"inspectContent.d.ts","sourceRoot":"","sources":["../../../../../server/plugins/file/utils/inspectContent.ts"],"names":[],"mappings":"AA+CA,wBAA8B,cAAc,CAC1C,MAAM,EAAE,MAAM,EACd,iBAAiB,EAAE,MAAM;;;;GAgD1B"}
+{"version":3,"file":"inspectContent.d.ts","sourceRoot":"","sources":["../../../../../server/plugins/file/utils/inspectContent.ts"],"names":[],"mappings":"AAuGA,wBAA8B,cAAc,CAC1C,KAAK,EAAE,MAAM,GAAG,cAAc,EAC9B,iBAAiB,EAAE,MAAM;;;;;;;;;;GA4E1B"}

package/dist/server/plugins/file/utils/inspectContent.js

@@ -1,4 +1,4 @@
-import { fileTypeFromBuffer } from "file-type";
+import { fileTypeFromBuffer, fileTypeFromStream } from "file-type";
 import { BadRequestError } from "../../../../errors.js";
 import applyHook from "../../hook/applyHook.js";
 // Office 97–2003 (.doc/.xls/.ppt) share CFB magic; file-type reports them as "cfb"
@@ -7,6 +7,25 @@ const cfbOfficeMimes = {
     xls: "application/vnd.ms-excel",
     ppt: "application/vnd.ms-powerpoint",
 };
+function countDelimiter(line, delimiter) {
+    let count = 0;
+    let quoted = false;
+    for (let i = 0; i < line.length; i++) {
+        const char = line[i];
+        if (char === '"') {
+            if (quoted && line[i + 1] === '"') {
+                i++;
+            }
+            else {
+                quoted = !quoted;
+            }
+        }
+        else if (char === delimiter && !quoted) {
+            count++;
+        }
+    }
+    return count;
+}
 const handlers = {
     pdf: (buffer) => {
         const head = buffer.subarray(0, 1024).toString("latin1");
@@ -14,6 +33,7 @@ const handlers = {
             return {
                 ext: "pdf",
                 mime: "application/pdf",
+                confidence: "heuristic",
             };
         }
     },
@@ -23,6 +43,7 @@ const handlers = {
             return {
                 ext: "json",
                 mime: "application/json",
+                confidence: "heuristic",
             };
         }
     },
@@ -34,30 +55,75 @@ const handlers = {
             return {
                 ext: "geojson",
                 mime: "application/geo+json",
+                confidence: "heuristic",
             };
         }
     },
+    csv: (buffer) => {
+        const text = buffer.subarray(0, 16 * 1024).toString("utf8");
+        const lines = text.split(/\r?\n/).filter((line) => line.trim());
+        if (lines.length < 2) {
+            return false;
+        }
+        const delimiters = [",", ";", "\t"];
+        return delimiters.reduce((acc, delimiter) => {
+            const counts = lines
+                .slice(0, 10)
+                .map((line) => countDelimiter(line, delimiter));
+            const first = counts[0];
+            if (first > 0 && counts.every((count) => count === first)) {
+                return {
+                    ...acc,
+                    ext: "csv",
+                    mime: "text/csv",
+                    confidence: "heuristic",
+                };
+            }
+            return acc;
+        }, {});
+    },
 };
-export default async function inspectContent(buffer, expectedExtension) {
+const isReadableStream = (stream) => stream && stream instanceof ReadableStream;
+export default async function inspectContent(input, expectedExtension) {
     if (!expectedExtension) {
-        throw new BadRequestError("not enough params: expectedExtension");
+        throw new Error("not enough params: expectedExtension");
+    }
+    const buffer = Buffer.isBuffer(input) ? input : undefined;
+    const stream = !buffer ? input : undefined;
+    if (buffer && !buffer.length) {
+        throw BadRequestError("Invalid buffer");
+    }
+    if (stream && !isReadableStream(stream)) {
+        throw BadRequestError("invalid params: input");
     }
-    if (!Buffer.isBuffer(buffer) || !buffer.length) {
-        throw new BadRequestError("Invalid buffer");
+    if (!buffer && !stream) {
+        throw new Error("not enough params: input");
     }
     // custom inspection of extensions like kml, svg etc
     const hookData = (await applyHook("onInspectContent", {
         buffer,
+        stream,
         expectedExtension,
     }));
     if (hookData) {
         return hookData;
     }
-    const { ext, mime } = (await fileTypeFromBuffer(buffer)) || {};
+    const inspectResult1 = buffer
+        ? await fileTypeFromBuffer(buffer)
+        : stream
+            ? await fileTypeFromStream(stream)
+            : undefined;
+    const inspectResult2 = stream ? await fileTypeFromStream(stream) : undefined;
+    const { ext, mime } = inspectResult1 || inspectResult2 || {};
     // ? geojson, signed pdf, kml, svg etc - not recognized - inspecting the content
-    if (!ext && handlers[expectedExtension]) {
-        const { ext: ext2, mime: mime2 } = (await handlers[expectedExtension](buffer)) || {};
-        return { ext: ext2, mime: mime2, isValid: ext2 === expectedExtension };
+    if (!ext && handlers[expectedExtension] && buffer) {
+        const { ext: ext2, mime: mime2, confidence, } = (await handlers[expectedExtension](buffer)) || {};
+        return {
+            ext: ext2,
+            mime: mime2,
+            isValid: ext2 === expectedExtension,
+            confidence,
+        };
     }
     // ? .doc/.xls/.ppt are CFB containers — file-type returns "cfb", not the office ext
     if (ext === "cfb" && cfbOfficeMimes[expectedExtension]) {

package/dist/server/plugins/policy/funcs/checkXSS.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"checkXSS.d.ts","sourceRoot":"","sources":["../../../../../server/plugins/policy/funcs/checkXSS.ts"],"names":[],"mappings":"AAGA,iBAAS,QAAQ,CAAC,EAAE,IAAI,EAAE,MAAW,EAAE,EAAE,GAAG;;;;;;EAyD3C;AAED,eAAe,QAAQ,CAAC"}
+{"version":3,"file":"checkXSS.d.ts","sourceRoot":"","sources":["../../../../../server/plugins/policy/funcs/checkXSS.ts"],"names":[],"mappings":"AAGA,iBAAS,QAAQ,CAAC,EAAE,IAAI,EAAE,MAAW,EAAE,EAAE,GAAG;;;;;;EA0D3C;AAED,eAAe,QAAQ,CAAC"}

package/dist/server/plugins/policy/funcs/checkXSS.js

@@ -14,6 +14,7 @@ function checkXSS({ body, schema = {} }) {
         "Tiny",
         "Ace",
         "Texteditor",
+        "RichText",
     ];
     Object.keys(body)
         .filter((key) => ["<", ">"].find((el) => body[key]?.includes?.(el)) &&

package/dist/server/plugins/upload/s3.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"s3.d.ts","sourceRoot":"","sources":["../../../../server/plugins/upload/s3.ts"],"names":[],"mappings":"AAiGA,wBAAsB,sBAAsB,CAAC,EAAE,MAAW,iBAwCzD;AAED,wBAAsB,cAAc,CAClC,EAAE,EAAE,MAAM,EACV,IAAI,EAAE,GAAG,EACT,GAAG,SAAqB,iBAazB;AAED,wBAAsB,gBAAgB,CACpC,EAAE,EAAE,MAAM,EACV,GAAG,SAAqB,EACxB,EAAE,MAAW,iBAsBd;AAED,wBAAsB,gBAAgB,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,MAAM,iBA2B9D;AAED,wBAAsB,aAAa,CAAC,EAAE,EAAE,MAAM,gBAQ7C;AAED,wBAAsB,oBAAoB,CAAC,GAAG,EAAE,MAAM,gBAMrD;AAED,wBAAsB,mBAAmB,CAAC,EAAE,MAAW,iBAyEtD;AAED,wBAAsB,UAAU,CAAC,EAAE,EAAE,EAAE,EAAE;IAAE,EAAE,EAAE,MAAM,CAAA;CAAE,EAAE,EAAE,MAAW;;;;;;;;GAsCrE;AAKD,wBAAsB,WAAW,CAC/B,EACE,MAAM,EACN,GAAG,EACH,WAAW,EACX,QAAQ,GACT,EAAE;IACD,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;CAClB,EACD,EAAE,MAAW;;;;;;;;;;;;;;;;GAsDd;AASD,wBAAsB,QAAQ,CAC5B,EAAE,EAAE,MAAM,EACV,IAAI,EAAE;IACJ,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;CACpB,iBAwBF;AAED,wBAAsB,cAAc,CAAC,EAAE,EAAE,MAAM,kBAY9C;AAED,wBAAsB,iBAAiB,CAAC,EAAE,EAAE,MAAM,iBAQjD;AAED,wBAAsB,WAAW,CAC/B,EACE,EAAE,EACF,KAAK,EACL,UAAU,GACX,EAAE;IACD,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,GAAG,CAAC;IACX,UAAU,EAAE,MAAM,CAAC;CACpB,EACD,EAAE,MAAW;;;;;;;;GA+Bd;AAED,wBAAsB,YAAY,CAChC,EACE,EAAE,GACH,EAAE;IACD,EAAE,EAAE,MAAM,CAAC;CACZ,EACD,EAAE,MAAW;;;;GA2Cd;AAED,wBAAsB,WAAW,CAC/B,EACE,EAAE,GACH,EAAE;IACD,EAAE,EAAE,MAAM,CAAC;CACZ,EACD,EAAE,MAAW;;GAwBd;AAED,wBAAsB,eAAe,CACnC,EACE,EAAE,EACF,GAAG,EACH,MAAM,GACP,EAAE;IACD,EAAE,EAAE,MAAM,CAAC;IACX,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,EACD,EAAE,MAAW;;;;;;;;;;;;;;GAqEd"}
+{"version":3,"file":"s3.d.ts","sourceRoot":"","sources":["../../../../server/plugins/upload/s3.ts"],"names":[],"mappings":"AAmGA,wBAAsB,sBAAsB,CAAC,EAAE,MAAW,iBAwCzD;AAED,wBAAsB,cAAc,CAClC,EAAE,EAAE,MAAM,EACV,IAAI,EAAE,GAAG,EACT,GAAG,SAAqB,iBAazB;AAED,wBAAsB,gBAAgB,CACpC,EAAE,EAAE,MAAM,EACV,GAAG,SAAqB,EACxB,EAAE,MAAW,iBAsBd;AAED,wBAAsB,gBAAgB,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,MAAM,iBA2B9D;AAED,wBAAsB,aAAa,CAAC,EAAE,EAAE,MAAM,gBAQ7C;AAED,wBAAsB,oBAAoB,CAAC,GAAG,EAAE,MAAM,gBAMrD;AAED,wBAAsB,mBAAmB,CAAC,EAAE,MAAW,iBAyEtD;AAED,wBAAsB,UAAU,CAAC,EAAE,EAAE,EAAE,EAAE;IAAE,EAAE,EAAE,MAAM,CAAA;CAAE,EAAE,EAAE,MAAW;;;;;;;;GAsCrE;AAKD,wBAAsB,WAAW,CAC/B,EACE,MAAM,EACN,GAAG,EACH,WAAW,EACX,QAAQ,GACT,EAAE;IACD,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;CAClB,EACD,EAAE,MAAW;;;;;;;;;;;;;;;;GAsDd;AASD,wBAAsB,QAAQ,CAC5B,EAAE,EAAE,MAAM,EACV,IAAI,EAAE;IACJ,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;CACpB,iBAwBF;AAED,wBAAsB,cAAc,CAAC,EAAE,EAAE,MAAM,kBAY9C;AAED,wBAAsB,iBAAiB,CAAC,EAAE,EAAE,MAAM,iBAQjD;AAED,wBAAsB,WAAW,CAC/B,EACE,EAAE,EACF,KAAK,EACL,UAAU,GACX,EAAE;IACD,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,GAAG,CAAC;IACX,UAAU,EAAE,MAAM,CAAC;CACpB,EACD,EAAE,MAAW;;;;;;;;GAyCd;AAED,wBAAsB,YAAY,CAChC,EACE,EAAE,GACH,EAAE;IACD,EAAE,EAAE,MAAM,CAAC;CACZ,EACD,EAAE,MAAW;;;;GA2Cd;AAED,wBAAsB,WAAW,CAC/B,EACE,EAAE,GACH,EAAE;IACD,EAAE,EAAE,MAAM,CAAC;CACZ,EACD,EAAE,MAAW;;GAwBd;AAED,wBAAsB,eAAe,CACnC,EACE,EAAE,EACF,GAAG,EACH,MAAM,GACP,EAAE;IACD,EAAE,EAAE,MAAM,CAAC;IACX,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,EACD,EAAE,MAAW;;;;;;;;;;;;;;GAqEd"}

package/dist/server/plugins/upload/s3.js

@@ -4,6 +4,8 @@ import config from "../../../config.js";
 import s3Client from "../file/providers/s3/client.js";
 import rclient from "../redis/client.js";
 import logger from "../logger/getLogger.js";
+import inspectContent from "../file/utils/inspectContent.js";
+import { ConflictError } from "../../../errors.js";
 const uploads = new Map();
 const resumableUploads = new Map();
 // non-redis upload timeout handlers
@@ -339,6 +341,12 @@ export async function uploadChunk({ id, chunk, partNumber, }, s3 = s3Client) {
     if (upload.parts.some((p) => p.PartNumber === partNumber)) {
         throw new Error(`Part ${partNumber} already uploaded`);
     }
+    if (partNumber === 1) {
+        const { isValid } = await inspectContent(chunk, path.extname(upload.Key).substring(1));
+        if (!isValid) {
+            throw ConflictError("file type spoofing attempt detected");
+        }
+    }
     const res = await s3.send(new UploadPartCommand({
         Bucket: upload.Bucket,
         Key: upload.Key,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@opengis/fastify-table",
-  "version": "2.5.46",
+  "version": "2.5.48",
   "type": "module",
   "description": "core-plugins",
   "keywords": [