cloudcmd 17.3.3 → 17.4.0

package/ChangeLog

@@ -1,3 +1,11 @@
+2024.04.17, v17.4.0
+
+fix:
+- 6fb21020 server: route: path traversal
+
+feature:
+- 37ab7068 publish container image to GHCR (#409)
+
 2024.04.03, v17.3.3
 
 feature:

package/HELP.md

@@ -1,4 +1,4 @@
-# Cloud Commander v17.3.3
+# Cloud Commander v17.4.0
 
 ### [Main][MainURL] [Blog][BlogURL] [Support][SupportURL] [Demo][DemoURL]
 
@@ -1095,6 +1095,7 @@ There are a lot of ways to be involved in `Cloud Commander` development:
 
 ## Version history
 
+- *2024.04.17*, **[v17.4.0](//github.com/coderaiser/cloudcmd/releases/tag/v17.4.0)**
 - *2024.04.03*, **[v17.3.3](//github.com/coderaiser/cloudcmd/releases/tag/v17.3.3)**
 - *2024.03.29*, **[v17.3.2](//github.com/coderaiser/cloudcmd/releases/tag/v17.3.2)**
 - *2024.03.29*, **[v17.3.1](//github.com/coderaiser/cloudcmd/releases/tag/v17.3.1)**

package/README.md

@@ -1,4 +1,4 @@
-# Cloud Commander v17.3.3 [![Build Status][BuildStatusIMGURL]][BuildStatusURL] [![Codacy][CodacyIMG]][CodacyURL] [![Gitter][GitterIMGURL]][GitterURL]
+# Cloud Commander v17.4.0 [![Build Status][BuildStatusIMGURL]][BuildStatusURL] [![Codacy][CodacyIMG]][CodacyURL] [![Gitter][GitterIMGURL]][GitterURL]
 
 ### [Main][MainURL] [Blog][BlogURL] [Support][SupportURL] [Demo][DemoURL]
 

package/dist/sw.js

@@ -7,5 +7,5 @@ var serviceWorkerOption = {
   ]
 };
         
-        !function(t){var e={};function n(r){if(e[r])return e[r].exports;var o=e[r]={i:r,l:!1,exports:{}};return t[r].call(o.exports,o,o.exports,n),o.l=!0,o.exports}n.m=t,n.c=e,n.d=function(t,e,r){n.o(t,e)||Object.defineProperty(t,e,{enumerable:!0,get:r})},n.r=function(t){"undefined"!=typeof Symbol&&Symbol.toStringTag&&Object.defineProperty(t,Symbol.toStringTag,{value:"Module"}),Object.defineProperty(t,"__esModule",{value:!0})},n.t=function(t,e){if(1&e&&(t=n(t)),8&e)return t;if(4&e&&"object"==typeof t&&t&&t.__esModule)return t;var r=Object.create(null);if(n.r(r),Object.defineProperty(r,"default",{enumerable:!0,value:t}),2&e&&"string"!=typeof t)for(var o in t)n.d(r,o,function(e){return t[e]}.bind(null,o));return r},n.n=function(t){var e=t&&t.__esModule?function(){return t.default}:function(){return t};return n.d(e,"a",e),e},n.o=function(t,e){return Object.prototype.hasOwnProperty.call(t,e)},n.p="/dist/",n(n.s=0)}([function(t,e,n){"use strict";const r=n(1),o=n(2),i=n(3),u="development"===r.env.NODE_ENV,c=i((t,e)=>e.waitUntil(t())),s=i((t,e)=>{const{request:n}=e,{url:r}=n,o=a(r);r.endsWith("/")||/\^\/fs/.test(o)||"GET"===n.method&&(t=>"basic"===t.type)(n)&&(o.startsWith("/api")||/^socket.io/.test(o)||e.respondWith(t(e)))}),a=t=>new URL(t).pathname,f="cloudcmd: Wed Apr 03 2024 09:37:25 GMT+0300 (Eastern European Summer Time)",l=(t,e)=>"/"!==t?e:(t=>new Request(t,{credentials:"same-origin"}))("/");self.addEventListener("install",c((async function(){console.info("cloudcmd: sw: install: "+f),await self.skipWaiting()}))),self.addEventListener("fetch",s((async function(t){const{request:e}=t,{url:n}=e,r=a(n),i=l(r,t.request),c=await caches.open(f),s=await c.match(e);if(!u&&s)return s;const[d,h]=await o(fetch,i,{credentials:"same-origin"});return d?new Response(d.message):(await async function(t,e){return(await caches.open(f)).put(t,e)}(e,h.clone()),h)}))),self.addEventListener("activate",c((async function(){console.info("cloudcmd: sw: activate: "+f),await self.clients.claim();const t=await caches.keys(),e=caches.delete.bind(caches);await Promise.all(t.map(e))})))},function(t,e){var n,r,o=t.exports={};function i(){throw new Error("setTimeout has not been defined")}function u(){throw new Error("clearTimeout has not been defined")}function c(t){if(n===setTimeout)return setTimeout(t,0);if((n===i||!n)&&setTimeout)return n=setTimeout,setTimeout(t,0);try{return n(t,0)}catch(e){try{return n.call(null,t,0)}catch(e){return n.call(this,t,0)}}}!function(){try{n="function"==typeof setTimeout?setTimeout:i}catch(t){n=i}try{r="function"==typeof clearTimeout?clearTimeout:u}catch(t){r=u}}();var s,a=[],f=!1,l=-1;function d(){f&&s&&(f=!1,s.length?a=s.concat(a):l=-1,a.length&&h())}function h(){if(!f){var t=c(d);f=!0;for(var e=a.length;e;){for(s=a,a=[];++l<e;)s&&s[l].run();l=-1,e=a.length}s=null,f=!1,function(t){if(r===clearTimeout)return clearTimeout(t);if((r===u||!r)&&clearTimeout)return r=clearTimeout,clearTimeout(t);try{r(t)}catch(e){try{return r.call(null,t)}catch(e){return r.call(this,t)}}}(t)}}function p(t,e){this.fun=t,this.array=e}function m(){}o.nextTick=function(t){var e=new Array(arguments.length-1);if(arguments.length>1)for(var n=1;n<arguments.length;n++)e[n-1]=arguments[n];a.push(new p(t,e)),1!==a.length||f||c(h)},p.prototype.run=function(){this.fun.apply(null,this.array)},o.title="browser",o.browser=!0,o.env={},o.argv=[],o.version="",o.versions={},o.on=m,o.addListener=m,o.once=m,o.off=m,o.removeListener=m,o.removeAllListeners=m,o.emit=m,o.prependListener=m,o.prependOnceListener=m,o.listeners=function(t){return[]},o.binding=function(t){throw new Error("process.binding is not supported")},o.cwd=function(){return"/"},o.chdir=function(t){throw new Error("process.chdir is not supported")},o.umask=function(){return 0}},function(t,e,n){"use strict";t.exports=async(t,...e)=>{!function(t){if("function"!=typeof t)throw Error("fn should be a function!")}(t);try{return[null,await t(...e)]}catch(t){return[t]}}},function(t,e,n){"use strict";const r=(t,...e)=>{if(function(t){if("function"!=typeof t)throw Error("fn should be function!")}(t),e.length>=t.length)return t(...e);const n=(...n)=>r(t,...e,...n),o=t.length-e.length-1;return(t=>[function(e){return t(...arguments)},function(e,n){return t(...arguments)},function(e,n,r){return t(...arguments)},function(e,n,r,o){return t(...arguments)},function(e,n,r,o,i){return t(...arguments)}])(n)[o]||n};t.exports=r}]);
+        !function(t){var e={};function n(r){if(e[r])return e[r].exports;var o=e[r]={i:r,l:!1,exports:{}};return t[r].call(o.exports,o,o.exports,n),o.l=!0,o.exports}n.m=t,n.c=e,n.d=function(t,e,r){n.o(t,e)||Object.defineProperty(t,e,{enumerable:!0,get:r})},n.r=function(t){"undefined"!=typeof Symbol&&Symbol.toStringTag&&Object.defineProperty(t,Symbol.toStringTag,{value:"Module"}),Object.defineProperty(t,"__esModule",{value:!0})},n.t=function(t,e){if(1&e&&(t=n(t)),8&e)return t;if(4&e&&"object"==typeof t&&t&&t.__esModule)return t;var r=Object.create(null);if(n.r(r),Object.defineProperty(r,"default",{enumerable:!0,value:t}),2&e&&"string"!=typeof t)for(var o in t)n.d(r,o,function(e){return t[e]}.bind(null,o));return r},n.n=function(t){var e=t&&t.__esModule?function(){return t.default}:function(){return t};return n.d(e,"a",e),e},n.o=function(t,e){return Object.prototype.hasOwnProperty.call(t,e)},n.p="/dist/",n(n.s=0)}([function(t,e,n){"use strict";const r=n(1),o=n(2),i=n(3),u="development"===r.env.NODE_ENV,c=i((t,e)=>e.waitUntil(t())),s=i((t,e)=>{const{request:n}=e,{url:r}=n,o=a(r);r.endsWith("/")||/\^\/fs/.test(o)||"GET"===n.method&&(t=>"basic"===t.type)(n)&&(o.startsWith("/api")||/^socket.io/.test(o)||e.respondWith(t(e)))}),a=t=>new URL(t).pathname,f="cloudcmd: Wed Apr 17 2024 00:04:43 GMT+0300 (Eastern European Summer Time)",l=(t,e)=>"/"!==t?e:(t=>new Request(t,{credentials:"same-origin"}))("/");self.addEventListener("install",c((async function(){console.info("cloudcmd: sw: install: "+f),await self.skipWaiting()}))),self.addEventListener("fetch",s((async function(t){const{request:e}=t,{url:n}=e,r=a(n),i=l(r,t.request),c=await caches.open(f),s=await c.match(e);if(!u&&s)return s;const[d,h]=await o(fetch,i,{credentials:"same-origin"});return d?new Response(d.message):(await async function(t,e){return(await caches.open(f)).put(t,e)}(e,h.clone()),h)}))),self.addEventListener("activate",c((async function(){console.info("cloudcmd: sw: activate: "+f),await self.clients.claim();const t=await caches.keys(),e=caches.delete.bind(caches);await Promise.all(t.map(e))})))},function(t,e){var n,r,o=t.exports={};function i(){throw new Error("setTimeout has not been defined")}function u(){throw new Error("clearTimeout has not been defined")}function c(t){if(n===setTimeout)return setTimeout(t,0);if((n===i||!n)&&setTimeout)return n=setTimeout,setTimeout(t,0);try{return n(t,0)}catch(e){try{return n.call(null,t,0)}catch(e){return n.call(this,t,0)}}}!function(){try{n="function"==typeof setTimeout?setTimeout:i}catch(t){n=i}try{r="function"==typeof clearTimeout?clearTimeout:u}catch(t){r=u}}();var s,a=[],f=!1,l=-1;function d(){f&&s&&(f=!1,s.length?a=s.concat(a):l=-1,a.length&&h())}function h(){if(!f){var t=c(d);f=!0;for(var e=a.length;e;){for(s=a,a=[];++l<e;)s&&s[l].run();l=-1,e=a.length}s=null,f=!1,function(t){if(r===clearTimeout)return clearTimeout(t);if((r===u||!r)&&clearTimeout)return r=clearTimeout,clearTimeout(t);try{r(t)}catch(e){try{return r.call(null,t)}catch(e){return r.call(this,t)}}}(t)}}function p(t,e){this.fun=t,this.array=e}function m(){}o.nextTick=function(t){var e=new Array(arguments.length-1);if(arguments.length>1)for(var n=1;n<arguments.length;n++)e[n-1]=arguments[n];a.push(new p(t,e)),1!==a.length||f||c(h)},p.prototype.run=function(){this.fun.apply(null,this.array)},o.title="browser",o.browser=!0,o.env={},o.argv=[],o.version="",o.versions={},o.on=m,o.addListener=m,o.once=m,o.off=m,o.removeListener=m,o.removeAllListeners=m,o.emit=m,o.prependListener=m,o.prependOnceListener=m,o.listeners=function(t){return[]},o.binding=function(t){throw new Error("process.binding is not supported")},o.cwd=function(){return"/"},o.chdir=function(t){throw new Error("process.chdir is not supported")},o.umask=function(){return 0}},function(t,e,n){"use strict";t.exports=async(t,...e)=>{!function(t){if("function"!=typeof t)throw Error("fn should be a function!")}(t);try{return[null,await t(...e)]}catch(t){return[t]}}},function(t,e,n){"use strict";const r=(t,...e)=>{if(function(t){if("function"!=typeof t)throw Error("fn should be function!")}(t),e.length>=t.length)return t(...e);const n=(...n)=>r(t,...e,...n),o=t.length-e.length-1;return(t=>[function(e){return t(...arguments)},function(e,n){return t(...arguments)},function(e,n,r){return t(...arguments)},function(e,n,r,o){return t(...arguments)},function(e,n,r,o,i){return t(...arguments)}])(n)[o]||n};t.exports=r}]);
 //# sourceMappingURL=sw.js.map

package/dist-dev/sw.js

@@ -103,7 +103,7 @@ var serviceWorkerOption = {
 /***/ (function(module, exports, __webpack_require__) {
 
 "use strict";
-eval("\n\nconst process = __webpack_require__(/*! node:process */ \"./node_modules/process/browser.js\");\nconst tryToCatch = __webpack_require__(/*! try-to-catch */ \"./node_modules/try-to-catch/lib/try-to-catch.js\");\nconst currify = __webpack_require__(/*! currify */ \"./node_modules/currify/lib/currify.js\");\nconst isDev = process.env.NODE_ENV === 'development';\nconst isGet = a => a.method === 'GET';\nconst isBasic = a => a.type === 'basic';\nconst wait = currify((f, e) => e.waitUntil(f()));\nconst respondWith = currify((f, e) => {\n  const {\n    request\n  } = e;\n  const {\n    url\n  } = request;\n  const pathname = getPathName(url);\n  if (url.endsWith('/') || /\\^\\/fs/.test(pathname)) return;\n  if (!isGet(request)) return;\n  if (!isBasic(request)) return;\n  if (pathname.startsWith('/api')) return;\n  if (/^socket.io/.test(pathname)) return;\n  e.respondWith(f(e));\n});\nconst getPathName = url => new URL(url).pathname;\nconst date = \"Wed Apr 03 2024 09:37:36 GMT+0300 (Eastern European Summer Time)\";\nconst NAME = `cloudcmd: ${date}`;\nconst createRequest = a => new Request(a, {\n  credentials: 'same-origin'\n});\nconst getRequest = (a, request) => {\n  if (a !== '/') return request;\n  return createRequest('/');\n};\nself.addEventListener('install', wait(onInstall));\nself.addEventListener('fetch', respondWith(onFetch));\nself.addEventListener('activate', wait(onActivate));\nasync function onActivate() {\n  console.info(`cloudcmd: sw: activate: ${NAME}`);\n  await self.clients.claim();\n  const keys = await caches.keys();\n  const deleteCache = caches.delete.bind(caches);\n  await Promise.all(keys.map(deleteCache));\n}\nasync function onInstall() {\n  console.info(`cloudcmd: sw: install: ${NAME}`);\n  await self.skipWaiting();\n}\nasync function onFetch(event) {\n  const {\n    request\n  } = event;\n  const {\n    url\n  } = request;\n  const pathname = getPathName(url);\n  const newRequest = getRequest(pathname, event.request);\n  const cache = await caches.open(NAME);\n  const response = await cache.match(request);\n  if (!isDev && response) return response;\n  const [e, resp] = await tryToCatch(fetch, newRequest, {\n    credentials: 'same-origin'\n  });\n  if (e) return new Response(e.message);\n  await addToCache(request, resp.clone());\n  return resp;\n}\nasync function addToCache(request, response) {\n  const cache = await caches.open(NAME);\n  return cache.put(request, response);\n}\n\n//# sourceURL=file://cloudcmd/client/sw/sw.js");
+eval("\n\nconst process = __webpack_require__(/*! node:process */ \"./node_modules/process/browser.js\");\nconst tryToCatch = __webpack_require__(/*! try-to-catch */ \"./node_modules/try-to-catch/lib/try-to-catch.js\");\nconst currify = __webpack_require__(/*! currify */ \"./node_modules/currify/lib/currify.js\");\nconst isDev = process.env.NODE_ENV === 'development';\nconst isGet = a => a.method === 'GET';\nconst isBasic = a => a.type === 'basic';\nconst wait = currify((f, e) => e.waitUntil(f()));\nconst respondWith = currify((f, e) => {\n  const {\n    request\n  } = e;\n  const {\n    url\n  } = request;\n  const pathname = getPathName(url);\n  if (url.endsWith('/') || /\\^\\/fs/.test(pathname)) return;\n  if (!isGet(request)) return;\n  if (!isBasic(request)) return;\n  if (pathname.startsWith('/api')) return;\n  if (/^socket.io/.test(pathname)) return;\n  e.respondWith(f(e));\n});\nconst getPathName = url => new URL(url).pathname;\nconst date = \"Wed Apr 17 2024 00:04:52 GMT+0300 (Eastern European Summer Time)\";\nconst NAME = `cloudcmd: ${date}`;\nconst createRequest = a => new Request(a, {\n  credentials: 'same-origin'\n});\nconst getRequest = (a, request) => {\n  if (a !== '/') return request;\n  return createRequest('/');\n};\nself.addEventListener('install', wait(onInstall));\nself.addEventListener('fetch', respondWith(onFetch));\nself.addEventListener('activate', wait(onActivate));\nasync function onActivate() {\n  console.info(`cloudcmd: sw: activate: ${NAME}`);\n  await self.clients.claim();\n  const keys = await caches.keys();\n  const deleteCache = caches.delete.bind(caches);\n  await Promise.all(keys.map(deleteCache));\n}\nasync function onInstall() {\n  console.info(`cloudcmd: sw: install: ${NAME}`);\n  await self.skipWaiting();\n}\nasync function onFetch(event) {\n  const {\n    request\n  } = event;\n  const {\n    url\n  } = request;\n  const pathname = getPathName(url);\n  const newRequest = getRequest(pathname, event.request);\n  const cache = await caches.open(NAME);\n  const response = await cache.match(request);\n  if (!isDev && response) return response;\n  const [e, resp] = await tryToCatch(fetch, newRequest, {\n    credentials: 'same-origin'\n  });\n  if (e) return new Response(e.message);\n  await addToCache(request, resp.clone());\n  return resp;\n}\nasync function addToCache(request, response) {\n  const cache = await caches.open(NAME);\n  return cache.put(request, response);\n}\n\n//# sourceURL=file://cloudcmd/client/sw/sw.js");
 
 /***/ }),
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cloudcmd",
-  "version": "17.3.3",
+  "version": "17.4.0",
   "type": "commonjs",
   "author": "coderaiser <mnemonic.enemy@gmail.com> (https://github.com/coderaiser)",
   "description": "File manager for the web with console and editor",

package/server/config.js

@@ -242,8 +242,10 @@ function cryptoPass(manage, json) {
     
     const password = criton(json.password, algo);
     
-    return [manage, {
-        ...json,
-        password,
-    }];
+    return [
+        manage, {
+            ...json,
+            password,
+        },
+    ];
 }

package/server/route.mjs

@@ -77,7 +77,11 @@ async function route({config, options, request, response}) {
     const rootName = name.replace(CloudFunc.FS, '') || '/';
     const fullPath = root(rootName, config('root'));
     
+    if (fullPath.indexOf(config('root')))
+        return ponse.sendError(Error(`Path '${fullPath}' beyond root '${config('root')}'`), p);
+    
     const {html, win32} = options;
+    
     const read = getReadDir(config, {
         win32,
     });