@ya-accelerators/nextjs-framework 0.0.103 → 0.0.104
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/constants.d.ts +7 -0
- package/dist/constants.js +55 -0
- package/dist/constants.js.map +1 -1
- package/dist/lib/uploads/index.js +22 -0
- package/dist/lib/uploads/index.js.map +1 -1
- package/dist/tsconfig.tsbuildinfo +1 -1
- package/dist/ui/composite/form/index.jsx +13 -3
- package/dist/ui/composite/form/index.jsx.map +1 -1
- package/dist/util/index.js +8 -32
- package/dist/util/index.js.map +1 -1
- package/package.json +1 -1
package/dist/constants.d.ts
CHANGED
|
@@ -5,3 +5,10 @@ export declare const uiConstants: {
|
|
|
5
5
|
export declare const authConstants: {
|
|
6
6
|
REFRESH_LEEWAY_SEC: number;
|
|
7
7
|
};
|
|
8
|
+
export declare const uploadConstants: {
|
|
9
|
+
UPLOAD_FILENAME_MAX_LENGTH: number;
|
|
10
|
+
};
|
|
11
|
+
export declare const sanitizeConstants: {
|
|
12
|
+
SUBSTRING_KEYWORDS: readonly ['authorization', 'proxy-authorization', 'cookie', 'set-cookie', 'x-api-key', 'apikey', 'api_key', 'api-key', 'token', 'secret', 'password', 'passwd', 'signature', 'private', 'session', 'jwt', 'bearer', 'email', 'fullname', 'isikukood', 'dateofbirth', 'phone', 'wage', 'screenedname', 'familyname', 'givenname', 'middlename', 'holdername', 'namekana', 'nickname', 'fax', 'workplaceaddress', 'complainantcontact', 'affiliatedorganization', 'nationalid', 'zipcode', 'taxnumber', 'corporateid', 'useragent', 'hostcountry', 'residencycountry', 'jobtitle', 'department', 'authenticationkey'];
|
|
13
|
+
EXACT_KEYS: readonly ['ip'];
|
|
14
|
+
};
|
package/dist/constants.js
CHANGED
|
@@ -7,4 +7,59 @@ export const authConstants = {
|
|
|
7
7
|
// downstream calls never race the expiry window on long-running requests.
|
|
8
8
|
REFRESH_LEEWAY_SEC: 300,
|
|
9
9
|
};
|
|
10
|
+
export const uploadConstants = {
|
|
11
|
+
UPLOAD_FILENAME_MAX_LENGTH: 255,
|
|
12
|
+
};
|
|
13
|
+
export const sanitizeConstants = {
|
|
14
|
+
SUBSTRING_KEYWORDS: [
|
|
15
|
+
'authorization',
|
|
16
|
+
'proxy-authorization',
|
|
17
|
+
'cookie',
|
|
18
|
+
'set-cookie',
|
|
19
|
+
'x-api-key',
|
|
20
|
+
'apikey',
|
|
21
|
+
'api_key',
|
|
22
|
+
'api-key',
|
|
23
|
+
'token',
|
|
24
|
+
'secret',
|
|
25
|
+
'password',
|
|
26
|
+
'passwd',
|
|
27
|
+
'signature',
|
|
28
|
+
'private',
|
|
29
|
+
'session',
|
|
30
|
+
'jwt',
|
|
31
|
+
'bearer',
|
|
32
|
+
// PII keys — masked so a thrown error's logged input/result never emits subject data to the log stream.
|
|
33
|
+
// Only low-false-positive keys (substring match): bare 'name' (a direct identifier, db-schema.md) is
|
|
34
|
+
// redacted separately in `walk` on EXACT match — a substring entry here would mask serviceName/fileName/….
|
|
35
|
+
'email',
|
|
36
|
+
'fullname',
|
|
37
|
+
'isikukood',
|
|
38
|
+
'dateofbirth',
|
|
39
|
+
'phone',
|
|
40
|
+
'wage',
|
|
41
|
+
'screenedname',
|
|
42
|
+
'familyname',
|
|
43
|
+
'givenname',
|
|
44
|
+
'middlename',
|
|
45
|
+
'holdername',
|
|
46
|
+
'namekana',
|
|
47
|
+
'nickname',
|
|
48
|
+
'fax',
|
|
49
|
+
'workplaceaddress',
|
|
50
|
+
'complainantcontact',
|
|
51
|
+
'affiliatedorganization',
|
|
52
|
+
'nationalid',
|
|
53
|
+
'zipcode',
|
|
54
|
+
'taxnumber',
|
|
55
|
+
'corporateid',
|
|
56
|
+
'useragent',
|
|
57
|
+
'hostcountry',
|
|
58
|
+
'residencycountry',
|
|
59
|
+
'jobtitle',
|
|
60
|
+
'department',
|
|
61
|
+
'authenticationkey',
|
|
62
|
+
],
|
|
63
|
+
EXACT_KEYS: ['ip'],
|
|
64
|
+
};
|
|
10
65
|
//# sourceMappingURL=constants.js.map
|
package/dist/constants.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"constants.js","sourceRoot":"","sources":["../../src/constants.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,WAAW,GAAG;IACzB,gBAAgB,EAAE,CAAC;IACnB,gBAAgB,EAAE,IAAI;CACvB,CAAA;AAED,MAAM,CAAC,MAAM,aAAa,GAAG;IAC3B,4EAA4E;IAC5E,0EAA0E;IAC1E,kBAAkB,EAAE,GAAG;CACxB,CAAA"}
|
|
1
|
+
{"version":3,"file":"constants.js","sourceRoot":"","sources":["../../src/constants.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,WAAW,GAAG;IACzB,gBAAgB,EAAE,CAAC;IACnB,gBAAgB,EAAE,IAAI;CACvB,CAAA;AAED,MAAM,CAAC,MAAM,aAAa,GAAG;IAC3B,4EAA4E;IAC5E,0EAA0E;IAC1E,kBAAkB,EAAE,GAAG;CACxB,CAAA;AAED,MAAM,CAAC,MAAM,eAAe,GAAG;IAC7B,0BAA0B,EAAE,GAAG;CAChC,CAAA;AAED,MAAM,CAAC,MAAM,iBAAiB,GAAG;IAC/B,kBAAkB,EAAE;QAClB,eAAe;QACf,qBAAqB;QACrB,QAAQ;QACR,YAAY;QACZ,WAAW;QACX,QAAQ;QACR,SAAS;QACT,SAAS;QACT,OAAO;QACP,QAAQ;QACR,UAAU;QACV,QAAQ;QACR,WAAW;QACX,SAAS;QACT,SAAS;QACT,KAAK;QACL,QAAQ;QACR,wGAAwG;QACxG,qGAAqG;QACrG,2GAA2G;QAC3G,OAAO;QACP,UAAU;QACV,WAAW;QACX,aAAa;QACb,OAAO;QACP,MAAM;QACN,cAAc;QACd,YAAY;QACZ,WAAW;QACX,YAAY;QACZ,YAAY;QACZ,UAAU;QACV,UAAU;QACV,KAAK;QACL,kBAAkB;QAClB,oBAAoB;QACpB,wBAAwB;QACxB,YAAY;QACZ,SAAS;QACT,WAAW;QACX,aAAa;QACb,WAAW;QACX,aAAa;QACb,kBAAkB;QAClB,UAAU;QACV,YAAY;QACZ,mBAAmB;KACX;IACV,UAAU,EAAE,CAAC,IAAI,CAAU;CAC5B,CAAA"}
|
|
@@ -1,3 +1,4 @@
|
|
|
1
|
+
import { uploadConstants } from '../../constants';
|
|
1
2
|
import { logger } from '../../logger';
|
|
2
3
|
export const createUploadRoute = (uploadAction) => async (request) => {
|
|
3
4
|
const origin = request.headers.get('origin');
|
|
@@ -9,6 +10,27 @@ export const createUploadRoute = (uploadAction) => async (request) => {
|
|
|
9
10
|
});
|
|
10
11
|
}
|
|
11
12
|
const filename = request.headers.get('x-upload-filename');
|
|
13
|
+
if (filename !== null) {
|
|
14
|
+
let decodedFilename;
|
|
15
|
+
try {
|
|
16
|
+
decodedFilename = decodeURIComponent(filename);
|
|
17
|
+
}
|
|
18
|
+
catch {
|
|
19
|
+
return new Response(JSON.stringify({ error: 'invalid upload' }), {
|
|
20
|
+
status: 400,
|
|
21
|
+
headers: { 'content-type': 'application/json' },
|
|
22
|
+
});
|
|
23
|
+
}
|
|
24
|
+
if (decodedFilename.length > uploadConstants.UPLOAD_FILENAME_MAX_LENGTH ||
|
|
25
|
+
/[/\\]/.test(decodedFilename) ||
|
|
26
|
+
decodedFilename === '.' ||
|
|
27
|
+
decodedFilename === '..') {
|
|
28
|
+
return new Response(JSON.stringify({ error: 'invalid upload' }), {
|
|
29
|
+
status: 400,
|
|
30
|
+
headers: { 'content-type': 'application/json' },
|
|
31
|
+
});
|
|
32
|
+
}
|
|
33
|
+
}
|
|
12
34
|
const minted = await uploadAction().catch((error) => {
|
|
13
35
|
logger.error('upload', { error });
|
|
14
36
|
return undefined;
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/lib/uploads/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAA;AAErC,MAAM,CAAC,MAAM,iBAAiB,GAC5B,CAAC,YAA2D,EAAE,EAAE,CAAC,KAAK,EAAE,OAAgB,EAAE,EAAE;IAC1F,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;IAC5C,IACE,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,KAAK,aAAa;QACvD,CAAC,MAAM,KAAK,IAAI,IAAI,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,IAAI,KAAK,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,EAC5E,CAAC;QACD,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,8BAA8B,EAAE,CAAC,EAAE;YAC7E,MAAM,EAAE,GAAG;YACX,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;SAChD,CAAC,CAAA;IACJ,CAAC;IACD,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAA;IACzD,MAAM,MAAM,GAAG,MAAM,YAAY,EAAE,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;QAClD,MAAM,CAAC,KAAK,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,CAAC,CAAA;QACjC,OAAO,SAAS,CAAA;IAClB,CAAC,CAAC,CAAA;IACF,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,kCAAkC,EAAE,CAAC,EAAE;YACjF,MAAM,EAAE,GAAG;YACX,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;SAChD,CAAC,CAAA;IACJ,CAAC;IACD,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,MAAM,CAAA;IAC7B,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;QAChC,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,aAAa,EAAE,UAAU,KAAK,EAAE;YAChC,GAAG,CAAC,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,mBAAmB,EAAE,QAAQ,EAAE,CAAC;YAC/D,cAAc,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,0BAA0B;SAClF;QACD,IAAI,EAAE,MAAM,OAAO,CAAC,WAAW,EAAE;KAClC,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;QACjB,MAAM,CAAC,KAAK,CAAC,QAAQ,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAA;QACtC,OAAO,SAAS,CAAA;IAClB,CAAC,CAAC,CAAA;IACF,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,4BAA4B,EAAE,CAAC,EAAE;YAC3E,MAAM,EAAE,GAAG;YACX,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;SAChD,CAAC,CAAA;IACJ,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAA;IAClC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,iGAAiG;QACjG,oGAAoG;QACpG,oGAAoG;QACpG,mGAAmG;QACnG,kEAAkE;QAClE,IAAI,QAA8B,CAAA;QAClC,IAAI,CAAC;YACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;YACxC,QAAQ,GAAG,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;QAC5F,CAAC;QAAC,MAAM,CAAC;YACP,QAAQ,GAAG,SAAS,CAAA;QACtB,CAAC;QACD,MAAM,CAAC,KAAK,CAAC,QAAQ,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAA;IACxF,CAAC;IACD,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,EAAE,CAAC,CAAA;AACzG,CAAC,CAAA"}
|
|
1
|
+
{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/lib/uploads/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAA;AACjD,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAA;AAErC,MAAM,CAAC,MAAM,iBAAiB,GAC5B,CAAC,YAA2D,EAAE,EAAE,CAAC,KAAK,EAAE,OAAgB,EAAE,EAAE;IAC1F,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;IAC5C,IACE,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,KAAK,aAAa;QACvD,CAAC,MAAM,KAAK,IAAI,IAAI,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,IAAI,KAAK,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,EAC5E,CAAC;QACD,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,8BAA8B,EAAE,CAAC,EAAE;YAC7E,MAAM,EAAE,GAAG;YACX,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;SAChD,CAAC,CAAA;IACJ,CAAC;IACD,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAA;IACzD,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACtB,IAAI,eAAuB,CAAA;QAC3B,IAAI,CAAC;YACH,eAAe,GAAG,kBAAkB,CAAC,QAAQ,CAAC,CAAA;QAChD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,EAAE;gBAC/D,MAAM,EAAE,GAAG;gBACX,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;aAChD,CAAC,CAAA;QACJ,CAAC;QACD,IACE,eAAe,CAAC,MAAM,GAAG,eAAe,CAAC,0BAA0B;YACnE,OAAO,CAAC,IAAI,CAAC,eAAe,CAAC;YAC7B,eAAe,KAAK,GAAG;YACvB,eAAe,KAAK,IAAI,EACxB,CAAC;YACD,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,EAAE;gBAC/D,MAAM,EAAE,GAAG;gBACX,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;aAChD,CAAC,CAAA;QACJ,CAAC;IACH,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,YAAY,EAAE,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;QAClD,MAAM,CAAC,KAAK,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,CAAC,CAAA;QACjC,OAAO,SAAS,CAAA;IAClB,CAAC,CAAC,CAAA;IACF,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,kCAAkC,EAAE,CAAC,EAAE;YACjF,MAAM,EAAE,GAAG;YACX,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;SAChD,CAAC,CAAA;IACJ,CAAC;IACD,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,MAAM,CAAA;IAC7B,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;QAChC,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,aAAa,EAAE,UAAU,KAAK,EAAE;YAChC,GAAG,CAAC,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,mBAAmB,EAAE,QAAQ,EAAE,CAAC;YAC/D,cAAc,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,0BAA0B;SAClF;QACD,IAAI,EAAE,MAAM,OAAO,CAAC,WAAW,EAAE;KAClC,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;QACjB,MAAM,CAAC,KAAK,CAAC,QAAQ,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAA;QACtC,OAAO,SAAS,CAAA;IAClB,CAAC,CAAC,CAAA;IACF,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,4BAA4B,EAAE,CAAC,EAAE;YAC3E,MAAM,EAAE,GAAG;YACX,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;SAChD,CAAC,CAAA;IACJ,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAA;IAClC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,iGAAiG;QACjG,oGAAoG;QACpG,oGAAoG;QACpG,mGAAmG;QACnG,kEAAkE;QAClE,IAAI,QAA8B,CAAA;QAClC,IAAI,CAAC;YACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;YACxC,QAAQ,GAAG,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;QAC5F,CAAC;QAAC,MAAM,CAAC;YACP,QAAQ,GAAG,SAAS,CAAA;QACtB,CAAC;QACD,MAAM,CAAC,KAAK,CAAC,QAAQ,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAA;IACxF,CAAC;IACD,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,EAAE,CAAC,CAAA;AACzG,CAAC,CAAA"}
|