@porulle/adapter-local-storage 0.10.3 → 0.10.7

package/README.md

@@ -39,7 +39,7 @@ Every key passes through `resolveSafePath()` which:
 - Verifies the result stays inside `basePath`
 - Rejects `..`, NUL bytes, absolute paths, and any input that would escape the storage root
 
-This closed a CVE-class arbitrary-file-write surface (a key like `../../../../etc/passwd` would otherwise write outside the storage root). See `packages/core/test/` for the regression tests.
+This closed a CVE-class arbitrary-file-write surface (a key that walks up out of the root would otherwise write outside it). See `packages/core/test/` for the regression tests.
 
 ## What it implements
 
@@ -47,5 +47,5 @@ This closed a CVE-class arbitrary-file-write surface (a key like `../../../../et
 
 ## See also
 
-- [`SECURITY.md`](../../../SECURITY.md) — storage hardening
+- [`SECURITY.md`](https://github.com/asyncdotengineering/porulle/blob/main/SECURITY.md) — storage hardening
 - `@porulle/adapter-s3`, `@porulle/adapter-r2` — production storage adapters

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAEA,OAAO,EAAwB,KAAK,cAAc,EAAE,MAAM,eAAe,CAAC;AAS1E,MAAM,WAAW,0BAA0B;IACzC,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAiCD,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,0BAA0B,GAAG,cAAc,CA6EvF"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAEA,OAAO,EAAwB,KAAK,cAAc,EAAE,MAAM,eAAe,CAAC;AAS1E,MAAM,WAAW,0BAA0B;IACzC,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAiCD,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,0BAA0B,GAAG,cAAc,CAiFvF"}

package/dist/index.js

@@ -1,13 +1,13 @@
-import { mkdir, readdir, readFile, rm, stat, writeFile } from "node:fs/promises";
+import { mkdir, readdir, stat, unlink, writeFile } from "node:fs/promises";
 import { dirname, join, resolve, sep } from "node:path";
 import { Err, Ok } from "@porulle/core";
 /**
  * Resolves a key against basePath and verifies the result stays inside
- * basePath. Rejects path-traversal payloads like `../../etc/passwd`,
- * absolute paths, and any other input that would escape the storage root.
+ * basePath. Rejects parent-directory traversal, absolute paths, and any
+ * other input that would escape the storage root.
  *
- * Without this guard an upload with key `../../something` would write
- * outside the storage root (CVE-class: arbitrary file write).
+ * Without this guard an upload whose key walks up out of the root would
+ * write outside it (CVE-class: arbitrary file write).
  */
 function resolveSafePath(basePath, key) {
     if (typeof key !== "string" || key.length === 0) {
@@ -67,7 +67,14 @@ export function localStorageAdapter(options) {
         },
         async delete(key) {
             const path = resolveSafePath(options.basePath, key);
-            await rm(path, { force: true });
+            try {
+                await unlink(path);
+            }
+            catch (error) {
+                // Deleting an absent key stays a no-op, as it was under rm({ force: true }).
+                if (error.code !== "ENOENT")
+                    throw error;
+            }
             return Ok(undefined);
         },
         async list(prefix) {
@@ -80,12 +87,11 @@ export function localStorageAdapter(options) {
                     const info = await stat(filePath);
                     if (info.isDirectory())
                         continue;
-                    const content = await readFile(filePath);
                     output.push({
                         key: file,
                         url: `${baseUrl}/${prefix}/${file}`,
                         contentType: "application/octet-stream",
-                        size: content.byteLength,
+                        size: info.size,
                     });
                 }
                 return Ok(output);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@porulle/adapter-local-storage",
-  "version": "0.10.3",
+  "version": "0.10.7",
   "license": "MIT",
   "type": "module",
   "exports": {
@@ -11,15 +11,15 @@
     }
   },
   "dependencies": {
-    "@porulle/core": "0.10.3"
+    "@porulle/core": "0.10.8"
   },
   "devDependencies": {
     "@types/node": "^24.5.2",
     "eslint": "^9.39.1",
     "typescript": "5.9.2",
     "vitest": "^3.2.4",
-    "@porulle/eslint-config": "0.1.0",
-    "@porulle/typescript-config": "0.1.0"
+    "@porulle/typescript-config": "0.1.0",
+    "@porulle/eslint-config": "0.1.0"
   },
   "publishConfig": {
     "access": "public"

package/src/index.ts

@@ -1,4 +1,4 @@
-import { mkdir, readdir, readFile, rm, stat, writeFile } from "node:fs/promises";
+import { mkdir, readdir, stat, unlink, writeFile } from "node:fs/promises";
 import { dirname, join, resolve, sep } from "node:path";
 import { Err, Ok, type Result, type StorageAdapter } from "@porulle/core";
 
@@ -16,11 +16,11 @@ export interface LocalStorageAdapterOptions {
 
 /**
  * Resolves a key against basePath and verifies the result stays inside
- * basePath. Rejects path-traversal payloads like `../../etc/passwd`,
- * absolute paths, and any other input that would escape the storage root.
+ * basePath. Rejects parent-directory traversal, absolute paths, and any
+ * other input that would escape the storage root.
  *
- * Without this guard an upload with key `../../something` would write
- * outside the storage root (CVE-class: arbitrary file write).
+ * Without this guard an upload whose key walks up out of the root would
+ * write outside it (CVE-class: arbitrary file write).
  */
 function resolveSafePath(basePath: string, key: string): string {
   if (typeof key !== "string" || key.length === 0) {
@@ -89,7 +89,12 @@ export function localStorageAdapter(options: LocalStorageAdapterOptions): Storag
 
     async delete(key: string): Promise<Result<void>> {
       const path = resolveSafePath(options.basePath, key);
-      await rm(path, { force: true });
+      try {
+        await unlink(path);
+      } catch (error) {
+        // Deleting an absent key stays a no-op, as it was under rm({ force: true }).
+        if ((error as NodeJS.ErrnoException).code !== "ENOENT") throw error;
+      }
       return Ok(undefined);
     },
 
@@ -104,12 +109,11 @@ export function localStorageAdapter(options: LocalStorageAdapterOptions): Storag
           const info = await stat(filePath);
           if (info.isDirectory()) continue;
 
-          const content = await readFile(filePath);
           output.push({
             key: file,
             url: `${baseUrl}/${prefix}/${file}`,
             contentType: "application/octet-stream",
-            size: content.byteLength,
+            size: info.size,
           });
         }