box-node-sdk 1.32.0 → 1.33.0

package/CHANGELOG.md

@@ -1,9 +1,14 @@
 # Changelog
 
-## 1.32.0 [2020-03-30]
+## 1.33.0 [2020-06-25]
 
-- Temporarily removed Node 4 and Node 5 builds from Travis, due to tests not passing.  Will investigate, going forward.
-- Fixed an issue where an error is thrown during a retry when a response is not returned by the previous call ([#476](https://github.com/box/box-node-sdk/pull/76)).
+- Add path parameter sanitization ([#505](https://github.com/box/box-node-sdk/pull/505))
+- Add support for all streams for uploading files ([#519](https://github.com/box/box-node-sdk/pull/519))
+
+## 1.32.0 [2020-04-01]
+
+- Temporarily removed Node 4 and Node 5 builds from Travis, due to tests not passing.  Will investigate, going forward ([#495](https://github.com/box/box-node-sdk/pull/495)).
+- Fixed an issue where an error is thrown during a retry when a response is not returned by the previous call  ([#477](https://github.com/box/box-node-sdk/pull/477)).
 - Added the ability to [query](./docs/metadata.md#query) Box items based on their metadata ([#487](https://github.com/box/box-node-sdk/pull/487)).
 
 ## 1.31.0 [2020-02-13]

package/lib/managers/files.js

@@ -78,10 +78,11 @@ function createFileMetadataFormData(parentFolderID, filename, options) {
 /**
  * Returns the multipart form value for file upload content.
  * @param {string|Buffer|Stream} content - the content of the file being uploaded
+ * @param {Object} options - options for the content
  * @returns {Object} - the form value expected by the API for the 'content' key
  * @private
  */
-function createFileContentFormData(content) {
+function createFileContentFormData(content, options) {
 	// The upload API appears to look for a form field that contains a filename
 	// property and assume that this form field contains the file content. Thus,
 	// the value of name does not actually matter (as long as it does not conflict
@@ -90,7 +91,7 @@ function createFileContentFormData(content) {
 	// filename specified in the metadata form field instead.
 	return {
 		value: content,
-		options: { filename: 'unused' }
+		options: Object.assign({ filename: 'unused' }, options)
 	};
 }
 
@@ -601,6 +602,7 @@ Files.prototype.promoteVersion = function(fileID, versionID, callback) {
  * @param {Object} [options] - Optional parameters
  * @param {string} [options.content_created_at] - RFC 3339 timestamp when the file was created
  * @param {string} [options.content_modified_at] - RFC 3339 timestamp when the file was last modified
+ * @param {int} [options.content_length] - Optional length of the content. Required if content is a read stream of any type other than fs stream.
  * @param {Function} [callback] - called with data about the upload if successful, or an error if the
  * upload failed
  * @returns {Promise<Object>} A promise resolving to the uploaded file
@@ -613,10 +615,17 @@ Files.prototype.uploadFile = function(parentFolderID, filename, content, options
 		options = {};
 	}
 
+	var formOptions = {};
+	if (options && options.hasOwnProperty('content_length')) {
+		formOptions.knownLength = options.content_length;
+		// Delete content_length from options so it's not added to the attributes of the form
+		delete options.content_length;
+	}
+
 	var apiPath = urlPath(BASE_PATH, '/content'),
 		multipartFormData = {
 			attributes: createFileMetadataFormData(parentFolderID, filename, options),
-			content: createFileContentFormData(content)
+			content: createFileContentFormData(content, formOptions)
 		};
 
 	return this.client.wrapWithDefaultHandler(this.client.upload)(apiPath, null, multipartFormData, callback);
@@ -635,6 +644,7 @@ Files.prototype.uploadFile = function(parentFolderID, filename, content, options
  * @param {Object} [options] - Optional parameters
  * @param {string} [options.content_modified_at] - RFC 3339 timestamp when the file was last modified
  * @param {string} [options.name] - A new name for the file
+ * @param {int} [options.content_length] - Optional length of the content. Required if content is a read stream of any type other than fs stream.
  * @param {Function} [callback] - called with data about the upload if successful, or an error if the
  * upload failed
  * @returns {Promise<Object>} A promise resolving to the uploaded file
@@ -650,11 +660,18 @@ Files.prototype.uploadNewFileVersion = function(fileID, content, options, callba
 	var apiPath = urlPath(BASE_PATH, fileID, '/content'),
 		multipartFormData = {};
 
+
+	var formOptions = {};
 	if (options) {
+		if (options.hasOwnProperty('content_length')) {
+			formOptions.knownLength = options.content_length;
+			// Delete content_length from options so it's not added to the attributes of the form
+			delete options.content_length;
+		}
 		multipartFormData.attributes = JSON.stringify(options);
 	}
 
-	multipartFormData.content = createFileContentFormData(content);
+	multipartFormData.content = createFileContentFormData(content, formOptions);
 
 	return this.client.wrapWithDefaultHandler(this.client.upload)(apiPath, null, multipartFormData, callback);
 };

package/lib/util/url-path.js

@@ -8,6 +8,8 @@
 // Private
 // ------------------------------------------------------------------------------
 
+// Pattern to check for relative paths
+var PATTERN = /\/\.+/;
 /**
  * remove leading & trailing slashes from some string. This is useful for
  * removing slashes from the path segments that are actually a part of the
@@ -39,7 +41,14 @@ function trimSlashes(segment) {
  */
 module.exports = function urlPath(/* arguments*/) {
 	var args = Array.prototype.slice.call(arguments);
-	var path = args.map(x => String(x)).map(x => trimSlashes(x))
+	var path = args.map(x => String(x))
+		.map(x => {
+			var trimmedX = trimSlashes(x);
+			if (PATTERN.test(trimmedX)) {
+				throw new Error(`An invalid path parameter exists in ${trimmedX}. Relative path parameters cannot be passed.`);
+			}
+			return trimmedX;
+		})
 		.map(x => encodeURIComponent(x))
 		.join('/');
 	return `/${path}`;

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "box-node-sdk",
   "author": "Box <oss@box.com>",
-  "version": "1.32.0",
+  "version": "1.33.0",
   "description": "Official SDK for Box Plaform APIs",
   "license": "Apache-2.0",
   "repository": {
@@ -36,7 +36,6 @@
     "http-status": "^1.4.1",
     "jsonwebtoken": "^8.5.1",
     "merge-options": "^1.0.1",
-    "npm-upgrade": "^2.0.2",
     "promise-queue": "^2.2.3",
     "request": "^2.88.0",
     "url-template": "^2.0.8",
@@ -57,6 +56,7 @@
     "mockery": "^2.1.0",
     "nock": "^9.6.1",
     "np": "^5.1.3",
+    "npm-upgrade": "^2.0.3",
     "nyc": "^11.9.0",
     "shelljs": "^0.8.3",
     "shelljs-nodecli": "^0.1.1",