@remotion/studio-server 4.0.514 → 4.0.515

package/dist/helpers/open-file-for-writing-without-symlinks.d.ts

@@ -0,0 +1,4 @@
+export declare const openFileForWritingWithoutSymlinks: ({ rootDirectory, absolutePath, }: {
+    rootDirectory: string;
+    absolutePath: string;
+}) => number;

package/dist/helpers/open-file-for-writing-without-symlinks.js

@@ -0,0 +1,52 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.openFileForWritingWithoutSymlinks = void 0;
+const node_fs_1 = __importDefault(require("node:fs"));
+const node_path_1 = __importDefault(require("node:path"));
+const assertNoSymlinks = ({ rootDirectory, absolutePath, }) => {
+    const relativePath = node_path_1.default.relative(rootDirectory, absolutePath);
+    if (relativePath === '..' ||
+        relativePath.startsWith(`..${node_path_1.default.sep}`) ||
+        node_path_1.default.isAbsolute(relativePath)) {
+        throw new Error(`Not allowed to write to ${relativePath}`);
+    }
+    let pathToCheck = rootDirectory;
+    for (const segment of relativePath.split(node_path_1.default.sep)) {
+        pathToCheck = node_path_1.default.join(pathToCheck, segment);
+        try {
+            if (node_fs_1.default.lstatSync(pathToCheck).isSymbolicLink()) {
+                throw new Error(`Not allowed to write through symbolic link ${pathToCheck}`);
+            }
+        }
+        catch (error) {
+            if (error.code === 'ENOENT') {
+                break;
+            }
+            throw error;
+        }
+    }
+};
+const openFileForWritingWithoutSymlinks = ({ rootDirectory, absolutePath, }) => {
+    const resolvedRootDirectory = node_path_1.default.resolve(rootDirectory);
+    const resolvedAbsolutePath = node_path_1.default.resolve(absolutePath);
+    assertNoSymlinks({
+        rootDirectory: resolvedRootDirectory,
+        absolutePath: resolvedAbsolutePath,
+    });
+    node_fs_1.default.mkdirSync(node_path_1.default.dirname(resolvedAbsolutePath), { recursive: true });
+    assertNoSymlinks({
+        rootDirectory: resolvedRootDirectory,
+        absolutePath: resolvedAbsolutePath,
+    });
+    const flags = process.platform === 'win32'
+        ? 'w'
+        : node_fs_1.default.constants.O_CREAT |
+            node_fs_1.default.constants.O_WRONLY |
+            node_fs_1.default.constants.O_TRUNC |
+            node_fs_1.default.constants.O_NOFOLLOW;
+    return node_fs_1.default.openSync(resolvedAbsolutePath, flags);
+};
+exports.openFileForWritingWithoutSymlinks = openFileForWritingWithoutSymlinks;

package/dist/helpers/video-config-values.js

@@ -36,15 +36,21 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.getVideoConfigIdentifierValues = void 0;
 const recast = __importStar(require("recast"));
 const getVideoConfigIdentifierValues = ({ ast, videoConfigValues, }) => {
-    if (videoConfigValues === null) {
-        return {};
-    }
     const candidates = new Map();
     const otherDeclarations = new Set();
+    const addCandidate = (identifier, value) => {
+        if (candidates.has(identifier) || otherDeclarations.has(identifier)) {
+            candidates.delete(identifier);
+            otherDeclarations.add(identifier);
+            return;
+        }
+        candidates.set(identifier, value);
+    };
     recast.types.visit(ast, {
         visitVariableDeclarator(path) {
             const { id, init } = path.node;
-            const isVideoConfigDeclaration = id.type === 'ObjectPattern' &&
+            const isVideoConfigDeclaration = videoConfigValues !== null &&
+                id.type === 'ObjectPattern' &&
                 (init === null || init === void 0 ? void 0 : init.type) === 'CallExpression' &&
                 init.callee.type === 'Identifier' &&
                 init.callee.name === 'useVideoConfig' &&
@@ -66,12 +72,25 @@ const getVideoConfigIdentifierValues = ({ ast, videoConfigValues, }) => {
                     }
                     const value = videoConfigValues[configKey];
                     if (Number.isFinite(value)) {
-                        candidates.set(property.value.name, value);
+                        addCandidate(property.value.name, value);
                     }
                 }
             }
             else if (id.type === 'Identifier') {
-                otherDeclarations.add(id.name);
+                const declaration = path.parentPath.node;
+                const numericConstant = declaration.type === 'VariableDeclaration' &&
+                    declaration.kind === 'const' &&
+                    (init === null || init === void 0 ? void 0 : init.type) === 'NumericLiteral' &&
+                    Number.isFinite(init.value)
+                    ? init.value
+                    : null;
+                if (numericConstant !== null) {
+                    addCandidate(id.name, numericConstant);
+                }
+                else {
+                    candidates.delete(id.name);
+                    otherDeclarations.add(id.name);
+                }
             }
             this.traverse(path);
         },

package/dist/preview-server/routes/delete-effect-keyframe.d.ts

@@ -0,0 +1,3 @@
+import type { DeleteEffectKeyframeRequest, DeleteEffectKeyframeResponse } from '@remotion/studio-shared';
+import type { ApiHandler } from '../api-types';
+export declare const deleteEffectKeyframeHandler: ApiHandler<DeleteEffectKeyframeRequest, DeleteEffectKeyframeResponse>;

package/dist/preview-server/routes/delete-effect-keyframe.js

@@ -0,0 +1,89 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.deleteEffectKeyframeHandler = void 0;
+const node_fs_1 = require("node:fs");
+const renderer_1 = require("@remotion/renderer");
+const studio_shared_1 = require("@remotion/studio-shared");
+const parse_ast_1 = require("../../codemods/parse-ast");
+const update_keyframes_1 = require("../../codemods/update-keyframes/update-keyframes");
+const file_watcher_1 = require("../../file-watcher");
+const resolve_file_inside_project_1 = require("../../helpers/resolve-file-inside-project");
+const undo_stack_1 = require("../undo-stack");
+const watch_ignore_next_change_1 = require("../watch-ignore-next-change");
+const can_update_effect_props_1 = require("./can-update-effect-props");
+const can_update_sequence_props_1 = require("./can-update-sequence-props");
+const log_effect_update_1 = require("./log-updates/log-effect-update");
+const save_props_mutex_1 = require("./save-props-mutex");
+const deleteEffectKeyframeHandler = ({ input: { fileName, sequenceNodePath, effectIndex, key, frame, schema, clientId, }, remotionRoot, logLevel, }) => (0, save_props_mutex_1.withSavePropsLock)(async () => {
+    renderer_1.RenderInternals.Log.trace({ indent: false, logLevel }, `[delete-effect-keyframe] Received request for fileName="${fileName}" effectIndex=${effectIndex} key="${key}" frame=${frame}`);
+    const { absolutePath, fileRelativeToRoot } = (0, resolve_file_inside_project_1.resolveFileInsideProject)({
+        remotionRoot,
+        fileName,
+        action: 'modify',
+    });
+    const fileContents = (0, node_fs_1.readFileSync)(absolutePath, 'utf-8');
+    const { output, oldValueStrings, newValueStrings, formatted, logLine, effectCallee, } = await (0, update_keyframes_1.updateEffectKeyframes)({
+        input: fileContents,
+        sequenceNodePath: sequenceNodePath.nodePath,
+        effectIndex,
+        updates: [
+            {
+                key,
+                operation: {
+                    type: 'remove',
+                    frame,
+                },
+            },
+        ],
+    });
+    const oldValueString = oldValueStrings[0];
+    const newValueString = newValueStrings[0];
+    const undoPropChange = `${key} keyframe restored at frame ${frame}`;
+    const redoPropChange = `${key} keyframe deleted at frame ${frame}`;
+    (0, undo_stack_1.pushToUndoStack)({
+        filePath: absolutePath,
+        oldContents: fileContents,
+        newContents: null,
+        logLevel,
+        remotionRoot,
+        logLine,
+        description: {
+            undoMessage: `↩️  ${undoPropChange}`,
+            redoMessage: `↪️  ${redoPropChange}`,
+        },
+        entryType: 'effect-props',
+        suppressHmrOnFileRestore: true,
+    });
+    (0, undo_stack_1.suppressUndoStackInvalidation)(absolutePath);
+    (0, watch_ignore_next_change_1.suppressBundlerUpdateForFile)(absolutePath);
+    (0, file_watcher_1.writeFileAndNotifyFileWatchers)(absolutePath, output, clientId);
+    (0, log_effect_update_1.logEffectUpdate)({
+        fileRelativeToRoot,
+        line: logLine,
+        effectName: effectCallee,
+        propKey: key,
+        oldValueString,
+        newValueString,
+        defaultValueString: null,
+        formatted,
+        logLevel,
+        removedProps: [],
+        addedProps: [],
+    });
+    (0, undo_stack_1.printUndoHint)(logLevel);
+    const ast = (0, parse_ast_1.parseAst)((0, node_fs_1.readFileSync)(absolutePath, 'utf-8'));
+    const jsx = (0, can_update_sequence_props_1.findJsxElementAtNodePath)(ast, sequenceNodePath.nodePath);
+    if (!jsx) {
+        return {
+            canUpdate: false,
+            effectIndex,
+            reason: 'not-found',
+        };
+    }
+    return (0, can_update_effect_props_1.computeEffectPropStatus)({
+        jsx,
+        effectIndex,
+        keys: (0, studio_shared_1.getAllSchemaKeys)(schema),
+    });
+});
+exports.deleteEffectKeyframeHandler = deleteEffectKeyframeHandler;

package/dist/preview-server/routes/delete-sequence-keyframe.d.ts

@@ -0,0 +1,3 @@
+import type { DeleteSequenceKeyframeRequest, DeleteSequenceKeyframeResponse } from '@remotion/studio-shared';
+import type { ApiHandler } from '../api-types';
+export declare const deleteSequenceKeyframeHandler: ApiHandler<DeleteSequenceKeyframeRequest, DeleteSequenceKeyframeResponse>;

package/dist/preview-server/routes/delete-sequence-keyframe.js

@@ -0,0 +1,82 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.deleteSequenceKeyframeHandler = void 0;
+const node_fs_1 = require("node:fs");
+const renderer_1 = require("@remotion/renderer");
+const studio_shared_1 = require("@remotion/studio-shared");
+const update_keyframes_1 = require("../../codemods/update-keyframes/update-keyframes");
+const file_watcher_1 = require("../../file-watcher");
+const resolve_file_inside_project_1 = require("../../helpers/resolve-file-inside-project");
+const undo_stack_1 = require("../undo-stack");
+const watch_ignore_next_change_1 = require("../watch-ignore-next-change");
+const can_update_sequence_props_1 = require("./can-update-sequence-props");
+const log_update_1 = require("./log-updates/log-update");
+const save_props_mutex_1 = require("./save-props-mutex");
+const deleteSequenceKeyframeHandler = ({ input: { fileName, nodePath, key, frame, schema, clientId }, remotionRoot, logLevel, }) => (0, save_props_mutex_1.withSavePropsLock)(async () => {
+    renderer_1.RenderInternals.Log.trace({ indent: false, logLevel }, `[delete-sequence-keyframe] Received request for fileName="${fileName}" key="${key}" frame=${frame}`);
+    const { absolutePath, fileRelativeToRoot } = (0, resolve_file_inside_project_1.resolveFileInsideProject)({
+        remotionRoot,
+        fileName,
+        action: 'modify',
+    });
+    const fileContents = (0, node_fs_1.readFileSync)(absolutePath, 'utf-8');
+    const { output, oldValueStrings, newValueStrings, formatted, logLine } = await (0, update_keyframes_1.updateSequenceKeyframes)({
+        input: fileContents,
+        nodePath: nodePath.nodePath,
+        updates: [
+            {
+                key,
+                operation: {
+                    type: 'remove',
+                    frame,
+                },
+            },
+        ],
+    });
+    const oldValueString = oldValueStrings[0];
+    const newValueString = newValueStrings[0];
+    const undoPropChange = `${key} keyframe restored at frame ${frame}`;
+    const redoPropChange = `${key} keyframe deleted at frame ${frame}`;
+    (0, undo_stack_1.pushToUndoStack)({
+        filePath: absolutePath,
+        oldContents: fileContents,
+        newContents: null,
+        logLevel,
+        remotionRoot,
+        logLine,
+        description: {
+            undoMessage: `↩️  ${undoPropChange}`,
+            redoMessage: `↪️  ${redoPropChange}`,
+        },
+        entryType: 'sequence-props',
+        suppressHmrOnFileRestore: true,
+    });
+    (0, undo_stack_1.suppressUndoStackInvalidation)(absolutePath);
+    (0, watch_ignore_next_change_1.suppressBundlerUpdateForFile)(absolutePath);
+    (0, file_watcher_1.writeFileAndNotifyFileWatchers)(absolutePath, output, clientId);
+    (0, log_update_1.logUpdate)({
+        fileRelativeToRoot,
+        line: logLine,
+        key,
+        oldValueString,
+        newValueString,
+        defaultValueString: null,
+        formatted,
+        logLevel,
+        removedProps: [],
+        addedProps: [],
+    });
+    (0, undo_stack_1.printUndoHint)(logLevel);
+    const status = (0, can_update_sequence_props_1.computeSequencePropsStatusFromContent)({
+        fileContents: output,
+        keys: (0, studio_shared_1.getAllSchemaKeys)(schema),
+        nodePath: nodePath.nodePath,
+        effects: [],
+    });
+    return {
+        canUpdate: true,
+        props: status.props,
+        results: [{ fileName, nodePath, props: status.props }],
+    };
+});
+exports.deleteSequenceKeyframeHandler = deleteSequenceKeyframeHandler;

package/dist/preview-server/routes/install-dependency.js

@@ -46,13 +46,19 @@ const handleInstallPackage = async ({ logLevel, remotionRoot, input: { dependenc
         manager: manager.manager,
         packages: packagesWithVersions,
         version: '',
-        additionalArgs: [],
+        additionalArgs: manager.manager === 'yarn' ? [] : ['--ignore-scripts'],
     });
     renderer_1.RenderInternals.Log.info({ indent: false, logLevel }, renderer_1.RenderInternals.chalk.gray(`╭─  ${manager.manager} ${command.join(' ')}`));
     const time = Date.now();
     try {
         await new Promise((resolve, reject) => {
-            const cmd = (0, node_child_process_1.spawn)(manager.manager, command, (0, package_manager_spawn_options_1.getPackageManagerSpawnOptions)());
+            const cmd = (0, node_child_process_1.spawn)(manager.manager, command, {
+                ...(0, package_manager_spawn_options_1.getPackageManagerSpawnOptions)(),
+                env: {
+                    ...process.env,
+                    YARN_ENABLE_SCRIPTS: 'false',
+                },
+            });
             cmd.on('error', reject);
             cmd.stdout.on('data', (d) => d
                 .toString()

package/dist/preview-server/routes/save-props-mutex.d.ts

@@ -0,0 +1 @@
+export declare const withSavePropsLock: <T>(fn: () => Promise<T>) => Promise<T>;

package/dist/preview-server/routes/save-props-mutex.js

@@ -0,0 +1,11 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.withSavePropsLock = void 0;
+let chain = Promise.resolve();
+const withSavePropsLock = (fn) => {
+    const run = () => fn();
+    const next = chain.then(run, run);
+    chain = next.then(() => undefined, () => undefined);
+    return next;
+};
+exports.withSavePropsLock = withSavePropsLock;

package/dist/routes.js

@@ -34,7 +34,6 @@ var __importStar = (this && this.__importStar) || (function () {
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.handleRoutes = void 0;
-const fs_1 = __importStar(require("fs"));
 const node_fs_1 = require("node:fs");
 const node_path_1 = __importStar(require("node:path"));
 const node_url_1 = require("node:url");
@@ -45,6 +44,7 @@ const better_opn_1 = require("./better-opn");
 const client_render_queue_1 = require("./client-render-queue");
 const get_file_source_1 = require("./helpers/get-file-source");
 const get_installed_installable_packages_1 = require("./helpers/get-installed-installable-packages");
+const open_file_for_writing_without_symlinks_1 = require("./helpers/open-file-for-writing-without-symlinks");
 const resolve_output_path_1 = require("./helpers/resolve-output-path");
 const api_routes_1 = require("./preview-server/api-routes");
 const get_package_manager_1 = require("./preview-server/get-package-manager");
@@ -61,6 +61,21 @@ const origin_policy_1 = require("./preview-server/studio-protocol/origin-policy"
 const validate_same_origin_1 = require("./preview-server/validate-same-origin");
 const watch_ignore_next_change_1 = require("./preview-server/watch-ignore-next-change");
 const loggedStaticFileHints = new Set();
+const clientRenderOutputExtensions = new Set([
+    'aac',
+    'flac',
+    'jpeg',
+    'jpg',
+    'mkv',
+    'mov',
+    'mp3',
+    'mp4',
+    'ogg',
+    'png',
+    'wav',
+    'webm',
+    'webp',
+]);
 const static404 = (response) => {
     response.writeHead(404);
     response.end('The static/ prefix has been changed, this URL is no longer valid.');
@@ -188,8 +203,14 @@ const handleAddAsset = ({ req, res, search, publicDir, }) => {
         if (relativeToPublicDir.startsWith('..')) {
             throw new Error(`Not allowed to write to ${relativeToPublicDir}`);
         }
-        fs_1.default.mkdirSync(node_path_1.default.dirname(absolutePath), { recursive: true });
-        const writeStream = (0, fs_1.createWriteStream)(absolutePath);
+        const fileDescriptor = (0, open_file_for_writing_without_symlinks_1.openFileForWritingWithoutSymlinks)({
+            rootDirectory: publicDir,
+            absolutePath,
+        });
+        const writeStream = (0, node_fs_1.createWriteStream)(absolutePath, {
+            fd: fileDescriptor,
+            autoClose: true,
+        });
         writeStream.on('close', () => {
             res.end(JSON.stringify({ success: true }));
         });
@@ -210,8 +231,18 @@ const handleUploadOutput = ({ req, res, search, remotionRoot, }) => {
             throw new Error('No `filePath` provided');
         }
         const absolutePath = (0, resolve_output_path_1.resolveOutputPath)(remotionRoot, filePath);
-        fs_1.default.mkdirSync(node_path_1.default.dirname(absolutePath), { recursive: true });
-        const writeStream = (0, fs_1.createWriteStream)(absolutePath);
+        const extension = node_path_1.default.extname(absolutePath).slice(1).toLowerCase();
+        if (!clientRenderOutputExtensions.has(extension)) {
+            throw new Error(`Not allowed to upload a .${extension || 'unknown'} file`);
+        }
+        const fileDescriptor = (0, open_file_for_writing_without_symlinks_1.openFileForWritingWithoutSymlinks)({
+            rootDirectory: remotionRoot,
+            absolutePath,
+        });
+        const writeStream = (0, node_fs_1.createWriteStream)(absolutePath, {
+            fd: fileDescriptor,
+            autoClose: true,
+        });
         writeStream.on('close', () => {
             res.end(JSON.stringify({ success: true }));
         });

package/package.json

@@ -3,7 +3,7 @@
 		"url": "https://github.com/remotion-dev/remotion/tree/main/packages/studio-server"
 	},
 	"name": "@remotion/studio-server",
-	"version": "4.0.514",
+	"version": "4.0.515",
 	"description": "Run a Remotion Studio with a server backend",
 	"main": "dist",
 	"scripts": {
@@ -23,7 +23,7 @@
 		"access": "public"
 	},
 	"dependencies": {
-		"@remotion/studio-protocol": "4.0.514",
+		"@remotion/studio-protocol": "4.0.515",
 		"@babel/types": "7.24.0",
 		"@babel/parser": "7.24.1",
 		"@svgr/core": "8.1.0",
@@ -32,12 +32,12 @@
 		"semver": "7.5.3",
 		"zod": "4.4.3",
 		"prettier": "3.8.1",
-		"remotion": "4.0.514",
+		"remotion": "4.0.515",
 		"recast": "0.23.11",
-		"@remotion/bundler": "4.0.514",
-		"@remotion/renderer": "4.0.514",
-		"@remotion/studio-codemods": "4.0.514",
-		"@remotion/studio-shared": "4.0.514",
+		"@remotion/bundler": "4.0.515",
+		"@remotion/renderer": "4.0.515",
+		"@remotion/studio-codemods": "4.0.515",
+		"@remotion/studio-shared": "4.0.515",
 		"memfs": "3.4.3",
 		"open": "8.4.2"
 	},
@@ -45,7 +45,7 @@
 		"ast-types": "0.16.1",
 		"react": "19.2.3",
 		"@types/semver": "7.5.3",
-		"@remotion/eslint-config-internal": "4.0.514",
+		"@remotion/eslint-config-internal": "4.0.515",
 		"eslint": "9.19.0",
 		"@types/node": "20.12.14",
 		"@typescript/native-preview": "7.0.0-dev.20260217.1"