create-ampless 1.0.0-alpha.68 → 1.0.0-alpha.70
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
|
@@ -289,7 +289,7 @@ trusted processor は次の場所に書き込みます:
|
|
|
289
289
|
public/plugins/<instanceId ?? name>/<key>
|
|
290
290
|
```
|
|
291
291
|
|
|
292
|
-
`key`
|
|
292
|
+
`key` は allowlist `[A-Za-z0-9._/-]+` に一致する必要があります。それ以外（スペース、URL 予約文字 `#` `?` `&` `=` `+`、非 ASCII 文字 (`日本語.xml` 等)、空文字、絶対パス（`/` 始まり）、`.` / `..` path segment、backslash、制御文字、256 文字超）は S3 呼び出し前に拒否されます。`indexes/posts.json` のような nested path や `feed.v2.xml` のような複数 dot は許可されます。allowlist を厳しく絞っているのは、返却 URL と実 S3 key を byte 等しい文字列に保つため — URL 予約文字は S3 では生バイトとして通るが、URL を consumer が parse すると別 object を指す状態になる。user 由来の文字を key に入れたい場合は事前に sanitize (hash、slugify 等) してから `ctx.writePublicAsset()` を呼んでください。戻り値は書き込まれた object の public URL です。
|
|
293
293
|
|
|
294
294
|
移行期間中、`capabilities` フィールドが無い plugin はそのまま動きます。`capabilities` を宣言しているのに `writePublicAsset` を省いた plugin は、実際に `ctx.writePublicAsset()` を呼んだ時に 1 回だけ warn します。
|
|
295
295
|
|
|
@@ -351,11 +351,19 @@ The trusted processor writes under:
|
|
|
351
351
|
public/plugins/<instanceId ?? name>/<key>
|
|
352
352
|
```
|
|
353
353
|
|
|
354
|
-
`key` must
|
|
355
|
-
|
|
356
|
-
|
|
357
|
-
|
|
358
|
-
|
|
354
|
+
`key` must match the allowlist `[A-Za-z0-9._/-]+`. Anything outside
|
|
355
|
+
that — spaces, URL-reserved characters (`#`, `?`, `&`, `=`, `+`),
|
|
356
|
+
non-ASCII (`日本語.xml`), empty strings, absolute paths (leading `/`),
|
|
357
|
+
`.` / `..` path segments, backslashes, control characters, or keys
|
|
358
|
+
over 256 characters — is rejected before S3 is called. Nested paths
|
|
359
|
+
such as `indexes/posts.json` and dotted extensions such as
|
|
360
|
+
`feed.v2.xml` are allowed. The allowlist is deliberately tight so
|
|
361
|
+
the returned public URL and the underlying S3 key are byte-identical
|
|
362
|
+
strings; URL-reserved characters would survive S3 but reshape the URL
|
|
363
|
+
when a consumer parses it. If you need to include user-supplied
|
|
364
|
+
characters in a key, sanitize first (e.g. hash, slugify) before
|
|
365
|
+
calling `ctx.writePublicAsset()`. The return value is the public URL
|
|
366
|
+
for the written object.
|
|
359
367
|
|
|
360
368
|
During the migration period, plugins with no `capabilities` field
|
|
361
369
|
keep working. Plugins that do declare `capabilities` but omit
|
|
@@ -25,18 +25,18 @@
|
|
|
25
25
|
"@tiptap/pm": "^3.23.6",
|
|
26
26
|
"@tiptap/react": "^3.23.6",
|
|
27
27
|
"@tiptap/starter-kit": "^3.23.6",
|
|
28
|
-
"@ampless/plugin-analytics-ga4": "^0.2.0-alpha.
|
|
29
|
-
"@ampless/plugin-gtm": "^0.1.1-alpha.
|
|
30
|
-
"@ampless/plugin-og-image": "^0.2.0-alpha.
|
|
31
|
-
"@ampless/plugin-plausible": "^0.1.1-alpha.
|
|
32
|
-
"@ampless/plugin-rss": "^0.2.0-alpha.
|
|
33
|
-
"@ampless/plugin-seo": "^0.2.0-alpha.
|
|
34
|
-
"@ampless/plugin-webhook": "^0.2.0-alpha.
|
|
35
|
-
"@ampless/admin": "^1.0.0-alpha.
|
|
36
|
-
"@ampless/backend": "^1.0.0-alpha.
|
|
37
|
-
"@ampless/runtime": "^1.0.0-alpha.
|
|
28
|
+
"@ampless/plugin-analytics-ga4": "^0.2.0-alpha.3",
|
|
29
|
+
"@ampless/plugin-gtm": "^0.1.1-alpha.2",
|
|
30
|
+
"@ampless/plugin-og-image": "^0.2.0-alpha.20",
|
|
31
|
+
"@ampless/plugin-plausible": "^0.1.1-alpha.2",
|
|
32
|
+
"@ampless/plugin-rss": "^0.2.0-alpha.20",
|
|
33
|
+
"@ampless/plugin-seo": "^0.2.0-alpha.20",
|
|
34
|
+
"@ampless/plugin-webhook": "^0.2.0-alpha.20",
|
|
35
|
+
"@ampless/admin": "^1.0.0-alpha.45",
|
|
36
|
+
"@ampless/backend": "^1.0.0-alpha.36",
|
|
37
|
+
"@ampless/runtime": "^1.0.0-alpha.26",
|
|
38
38
|
"@digital-go-jp/tailwind-theme-plugin": "^0.3.4",
|
|
39
|
-
"ampless": "^1.0.0-alpha.
|
|
39
|
+
"ampless": "^1.0.0-alpha.20",
|
|
40
40
|
"aws-amplify": "^6.17.0",
|
|
41
41
|
"class-variance-authority": "^0.7.1",
|
|
42
42
|
"clsx": "^2.1.1",
|