directus 9.10.0 → 9.12.0

package/dist/utils/parse-json.js

@@ -0,0 +1,19 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.noproto = exports.parseJSON = void 0;
+/**
+ * Run JSON.parse, but ignore `__proto__` properties. This prevents prototype pollution attacks
+ */
+function parseJSON(input) {
+    if (String(input).includes('__proto__')) {
+        return JSON.parse(input, noproto);
+    }
+    return JSON.parse(input);
+}
+exports.parseJSON = parseJSON;
+function noproto(key, value) {
+    if (key !== '__proto__') {
+        return value;
+    }
+}
+exports.noproto = noproto;

package/dist/utils/sanitize-query.d.ts

@@ -1,3 +1,2 @@
-import { Query } from '@directus/shared/types';
-import { Accountability } from '@directus/shared/types';
+import { Accountability, Query } from '@directus/shared/types';
 export declare function sanitizeQuery(rawQuery: Record<string, any>, accountability?: Accountability | null): Query;

package/dist/utils/sanitize-query.js

@@ -4,10 +4,11 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.sanitizeQuery = void 0;
+const utils_1 = require("@directus/shared/utils");
 const lodash_1 = require("lodash");
 const logger_1 = __importDefault(require("../logger"));
 const types_1 = require("../types");
-const utils_1 = require("@directus/shared/utils");
+const parse_json_1 = require("./parse-json");
 function sanitizeQuery(rawQuery, accountability) {
     const query = {};
     if (rawQuery.limit !== undefined) {
@@ -82,7 +83,7 @@ function sanitizeAggregate(rawAggregate) {
     let aggregate = rawAggregate;
     if (typeof rawAggregate === 'string') {
         try {
-            aggregate = JSON.parse(rawAggregate);
+            aggregate = (0, parse_json_1.parseJSON)(rawAggregate);
         }
         catch {
             logger_1.default.warn('Invalid value passed for filter query parameter.');
@@ -100,7 +101,7 @@ function sanitizeFilter(rawFilter, accountability) {
     let filters = rawFilter;
     if (typeof rawFilter === 'string') {
         try {
-            filters = JSON.parse(rawFilter);
+            filters = (0, parse_json_1.parseJSON)(rawFilter);
         }
         catch {
             logger_1.default.warn('Invalid value passed for filter query parameter.');
@@ -135,7 +136,7 @@ function sanitizeDeep(deep, accountability) {
     const result = {};
     if (typeof deep === 'string') {
         try {
-            deep = JSON.parse(deep);
+            deep = (0, parse_json_1.parseJSON)(deep);
         }
         catch {
             logger_1.default.warn('Invalid value passed for deep query parameter.');
@@ -169,7 +170,7 @@ function sanitizeAlias(rawAlias) {
     let alias = rawAlias;
     if (typeof rawAlias === 'string') {
         try {
-            alias = JSON.parse(rawAlias);
+            alias = (0, parse_json_1.parseJSON)(rawAlias);
         }
         catch (err) {
             logger_1.default.warn('Invalid value passed for alias query parameter.');

package/dist/utils/validate-keys.d.ts

@@ -0,0 +1,6 @@
+import { SchemaOverview } from '@directus/shared/types';
+import { PrimaryKey } from '../types';
+/**
+ * Validate keys based on its type
+ */
+export declare function validateKeys(schema: SchemaOverview, collection: string, keyField: string, keys: PrimaryKey | PrimaryKey[]): void;

package/dist/utils/validate-keys.js

@@ -0,0 +1,28 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.validateKeys = void 0;
+const exceptions_1 = require("../exceptions");
+const uuid_validate_1 = __importDefault(require("uuid-validate"));
+/**
+ * Validate keys based on its type
+ */
+function validateKeys(schema, collection, keyField, keys) {
+    if (Array.isArray(keys)) {
+        for (const key of keys) {
+            validateKeys(schema, collection, keyField, key);
+        }
+    }
+    else {
+        const primaryKeyFieldType = schema.collections[collection].fields[keyField].type;
+        if (primaryKeyFieldType === 'uuid' && !(0, uuid_validate_1.default)(String(keys))) {
+            throw new exceptions_1.ForbiddenException();
+        }
+        else if (primaryKeyFieldType === 'integer' && !Number.isInteger(Number(keys))) {
+            throw new exceptions_1.ForbiddenException();
+        }
+    }
+}
+exports.validateKeys = validateKeys;

package/dist/utils/validate-query.js

@@ -104,7 +104,7 @@ function validateFilterPrimitive(value, key) {
         false) {
         throw new exceptions_1.InvalidQueryException(`The filter value for "${key}" has to be a string, number, or boolean`);
     }
-    if (typeof value === 'number' && (Number.isNaN(value) || !Number.isSafeInteger(value))) {
+    if (typeof value === 'number' && (Number.isNaN(value) || value > Number.MAX_SAFE_INTEGER)) {
         throw new exceptions_1.InvalidQueryException(`The filter value for "${key}" is not a valid number`);
     }
     if (typeof value === 'string' && value.length === 0) {

package/dist/webhooks.d.ts

@@ -1,2 +1,4 @@
+export declare function init(): Promise<void>;
+export declare function reload(): Promise<void>;
 export declare function register(): Promise<void>;
 export declare function unregister(): void;

package/dist/webhooks.js

@@ -3,16 +3,31 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.unregister = exports.register = void 0;
+exports.unregister = exports.register = exports.reload = exports.init = void 0;
 const axios_1 = __importDefault(require("axios"));
 const database_1 = __importDefault(require("./database"));
 const emitter_1 = __importDefault(require("./emitter"));
 const logger_1 = __importDefault(require("./logger"));
 const services_1 = require("./services");
 const get_schema_1 = require("./utils/get-schema");
+const messenger_1 = require("./messenger");
 let registered = [];
-async function register() {
+async function init() {
+    await register();
+    const messenger = (0, messenger_1.getMessenger)();
+    messenger.subscribe('webhooks', (event) => {
+        if (event.type === 'reload') {
+            reload();
+        }
+    });
+}
+exports.init = init;
+async function reload() {
     unregister();
+    await register();
+}
+exports.reload = reload;
+async function register() {
     const webhookService = new services_1.WebhooksService({ knex: (0, database_1.default)(), schema: await (0, get_schema_1.getSchema)() });
     const webhooks = await webhookService.readByQuery({ filter: { status: { _eq: 'active' } } });
     for (const webhook of webhooks) {

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "directus",
-	"version": "9.10.0",
+	"version": "9.12.0",
 	"license": "GPL-3.0-only",
 	"homepage": "https://github.com/directus/directus#readme",
 	"description": "Directus is a real-time API and App dashboard for managing SQL database content.",
@@ -73,21 +73,20 @@
 	"files": [
 		"dist",
 		"LICENSE",
-		"README.md",
-		"example.env"
+		"README.md"
 	],
 	"dependencies": {
 		"@aws-sdk/client-ses": "^3.40.0",
-		"@directus/app": "9.10.0",
-		"@directus/drive": "9.10.0",
-		"@directus/drive-azure": "9.10.0",
-		"@directus/drive-gcs": "9.10.0",
-		"@directus/drive-s3": "9.10.0",
-		"@directus/extensions-sdk": "9.10.0",
-		"@directus/format-title": "9.10.0",
-		"@directus/schema": "9.10.0",
-		"@directus/shared": "9.10.0",
-		"@directus/specs": "9.10.0",
+		"@directus/app": "9.12.0",
+		"@directus/drive": "9.12.0",
+		"@directus/drive-azure": "9.12.0",
+		"@directus/drive-gcs": "9.12.0",
+		"@directus/drive-s3": "9.12.0",
+		"@directus/extensions-sdk": "9.12.0",
+		"@directus/format-title": "9.12.0",
+		"@directus/schema": "9.12.0",
+		"@directus/shared": "9.12.0",
+		"@directus/specs": "9.12.0",
 		"@godaddy/terminus": "^4.9.0",
 		"@rollup/plugin-alias": "^3.1.9",
 		"@rollup/plugin-virtual": "^2.0.3",
@@ -112,8 +111,10 @@
 		"execa": "^5.1.1",
 		"exifr": "^7.1.2",
 		"express": "^4.17.1",
+		"fast-redact": "^3.1.1",
 		"flat": "^5.0.2",
 		"fs-extra": "^10.0.0",
+		"globby": "^11.0.4",
 		"graphql": "^15.5.0",
 		"graphql-compose": "^9.0.1",
 		"helmet": "^4.6.0",
@@ -131,6 +132,7 @@
 		"lodash": "^4.17.21",
 		"macos-release": "^2.4.1",
 		"marked": "^4.0.3",
+		"micromustache": "^8.0.3",
 		"mime-types": "^2.1.31",
 		"ms": "^2.1.3",
 		"nanoid": "^3.1.23",
@@ -171,7 +173,7 @@
 		"sqlite3": "^5.0.6",
 		"tedious": "^13.0.0"
 	},
-	"gitHead": "e3a7a7d8879fb7959fb15802734d830001108fbb",
+	"gitHead": "4d63fba50a7cf199e89423365a515e99cecf4ebf",
 	"devDependencies": {
 		"@types/async": "3.2.10",
 		"@types/body-parser": "1.19.2",
@@ -183,9 +185,11 @@
 		"@types/express": "4.17.13",
 		"@types/express-pino-logger": "4.0.3",
 		"@types/express-session": "1.17.4",
+		"@types/fast-redact": "^3.0.1",
 		"@types/flat": "5.0.2",
 		"@types/fs-extra": "9.0.13",
 		"@types/inquirer": "8.1.3",
+		"@types/ioredis": "^4.28.10",
 		"@types/jest": "27.4.1",
 		"@types/js-yaml": "4.0.5",
 		"@types/json2csv": "5.0.3",

package/dist/types/activity.d.ts

@@ -1,9 +0,0 @@
-export declare enum Action {
-    CREATE = "create",
-    UPDATE = "update",
-    DELETE = "delete",
-    REVERT = "revert",
-    COMMENT = "comment",
-    UPLOAD = "upload",
-    LOGIN = "login"
-}

package/dist/types/activity.js

@@ -1,13 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.Action = void 0;
-var Action;
-(function (Action) {
-    Action["CREATE"] = "create";
-    Action["UPDATE"] = "update";
-    Action["DELETE"] = "delete";
-    Action["REVERT"] = "revert";
-    Action["COMMENT"] = "comment";
-    Action["UPLOAD"] = "upload";
-    Action["LOGIN"] = "login";
-})(Action = exports.Action || (exports.Action = {}));

package/example.env

@@ -1,202 +0,0 @@
-####################################################################################################
-# General
-
-HOST="0.0.0.0"
-PORT=8055
-PUBLIC_URL="http://localhost:8055"
-LOG_LEVEL="info"
-LOG_STYLE="pretty"
-
-####################################################################################################
-# Database
-
-## These match the databases defined in the docker-compose file in the root of this repo
-
-## Postgres
-DB_CLIENT="pg"
-DB_HOST="localhost"
-DB_PORT=5100
-DB_DATABASE="directus"
-DB_USER="postgres"
-DB_PASSWORD="secret"
-
-## CockroachDB
-# DB_CLIENT="cockroachdb"
-# DB_HOST="localhost"
-# DB_PORT=5113
-# DB_DATABASE="directus"
-# DB_USER="root"
-# DB_PASSWORD=""
-
-## MySQL 8
-# DB_CLIENT="mysql"
-# DB_HOST="localhost"
-# DB_PORT=5101
-# DB_DATABASE="directus"
-# DB_USER="root"
-# DB_PASSWORD="secret"
-
-## MariaDB
-# DB_CLIENT="mysql"
-# DB_HOST="localhost"
-# DB_PORT=5102
-# DB_DATABASE="directus"
-# DB_USER="root"
-# DB_PASSWORD="secret"
-
-## MS SQL
-# DB_CLIENT="mssql"
-# DB_HOST="localhost"
-# DB_PORT=5103
-# DB_DATABASE="directus"
-# DB_USER="sa"
-# DB_PASSWORD="Test@123"
-
-## OracleDB
-# DB_CLIENT="oracledb"
-# DB_CONNECT_STRING="localhost:5104/XE"
-# DB_USER="secretsysuser"
-# DB_PASSWORD="secretpassword"
-
-## SQLite Example
-# DB_CLIENT="sqlite3"
-# DB_FILENAME="./data.db"
-
-## MySQL 5.7
-# DB_CLIENT="mysql"
-# DB_HOST="localhost"
-# DB_PORT=5102
-# DB_DATABASE="directus"
-# DB_USER="root"
-# DB_PASSWORD="secret"
-
-####################################################################################################
-# Rate Limiting
-
-RATE_LIMITER_ENABLED=true
-
-RATE_LIMITER_POINTS=50
-RATE_LIMITER_DURATION=1
-
-RATE_LIMITER_STORE=memory
-# memory | redis | memcache
-
-# RATE_LIMITER_REDIS="redis://@127.0.0.1:5105"
-
-# RATE_LIMITER_MEMCACHE="localhost:5109"
-####################################################################################################
-# Caching
-
-CACHE_ENABLED=true
-CACHE_TTL="30m"
-CACHE_NAMESPACE="directus-cache"
-CACHE_AUTO_PURGE=true
-
-# memory | redis | memcache
-CACHE_STORE=memory
-
-ASSETS_CACHE_TTL="30m"
-
-# CACHE_REDIS="redis://@127.0.0.1:5105"
-
-# CACHE_MEMCACHE="localhost:5109"
-
-####################################################################################################
-# File Storage
-
-STORAGE_LOCATIONS="local"
-# CSV of names
-
-STORAGE_LOCAL_DRIVER="local"
-STORAGE_LOCAL_ROOT="./uploads"
-
-## S3 Example (location name: DigitalOcean)
-# STORAGE_DIGITALOCEAN_DRIVER="s3"
-# STORAGE_DIGITALOCEAN_KEY="abcdef"
-# STORAGE_DIGITALOCEAN_SECRET="ghijkl"
-# STORAGE_DIGITALOCEAN_ENDPOINT="ams3.digitaloceanspaces.com"
-# STORAGE_DIGITALOCEAN_BUCKET="my-files"
-# STORAGE_DIGITALOCEAN_REGION="ams3"
-
-## Google Cloud Storage Example (location name: Google)
-# STORAGE_GOOGLE_DRIVER="gcs"
-# STORAGE_GOOGLE_KEY_FILENAME="abcdef"
-# STORAGE_GOOGLE_BUCKET="my-files"
-
-
-## CSV of additional metadata keys
-# FILE_METADATA_ALLOW_LIST=
-
-####################################################################################################
-# Security
-
-KEY="xxxxxxx-xxxxxx-xxxxxxxx-xxxxxxxxxx"
-SECRET="abcdef"
-ACCESS_TOKEN_TTL="15m"
-REFRESH_TOKEN_TTL="7d"
-REFRESH_TOKEN_COOKIE_SECURE="false"
-REFRESH_TOKEN_COOKIE_SAME_SITE="lax"
-REFRESH_TOKEN_COOKIE_NAME="directus_refresh_token"
-
-CORS_ENABLED="true"
-CORS_ORIGIN="true"
-CORS_METHODS=GET,POST,PATCH,DELETE
-CORS_ALLOWED_HEADERS=Content-Type,Authorization
-CORS_EXPOSED_HEADERS=Content-Range
-CORS_CREDENTIALS="true"
-CORS_MAX_AGE=18000
-
-####################################################################################################
-# Argon2
-
-# HASH_MEMORY_COST=81920
-# HASH_HASH_LENGTH=32
-# HASH_TIME_COST=10
-# HASH_PARALLELISM=2
-# HASH_TYPE=2
-# HASH_ASSOCIATED_DATA=foo
-
-####################################################################################################
-# Auth Providers
-
-# AUTH_PROVIDERS="github"
-
-# AUTH_GITHUB_DRIVER="oauth2"
-# AUTH_GITHUB_CLIENT_ID="73e...4b"
-# AUTH_GITHUB_CLIENT_SECRET="b9...98"
-# AUTH_GITHUB_AUTHORIZE_URL="https://github.com/login/oauth/authorize"
-# AUTH_GITHUB_ACCESS_URL="https://github.com/login/oauth/access_token"
-# AUTH_GITHUB_PROFILE_URL="https://api.github.com/user"
-# AUTH_GITHUB_ALLOW_PUBLIC_REGISTRATION="false"
-# AUTH_GITHUB_DEFAULT_ROLE_ID="82424427-c9d4-4289-8bc5-ed1bf8422c90"
-# AUTH_GITHUB_ICON="github"
-# AUTH_GITHUB_EMAIL_KEY="false"
-# AUTH_GITHUB_IDENTIFIER_KEY="login"
-
-####################################################################################################
-# Extensions
-
-EXTENSIONS_PATH="./extensions"
-
-####################################################################################################
-# Email
-
-EMAIL_FROM="no-reply@directus.io"
-EMAIL_TRANSPORT="sendmail"
-
-## Email (Sendmail Transport)
-EMAIL_SENDMAIL_NEW_LINE="unix"
-EMAIL_SENDMAIL_PATH="/usr/sbin/sendmail"
-
-## Email (SMTP Transport)
-# EMAIL_SMTP_POOL=true
-# EMAIL_SMTP_HOST="localhost"
-# EMAIL_SMTP_PORT=465
-# EMAIL_SMTP_SECURE=false # Use TLS
-# EMAIL_SMTP_IGNORE_TLS=false
-# EMAIL_SMTP_USER="username"
-# EMAIL_SMTP_PASSWORD="password"
-
-## Email (Mailgun Transport)
-# EMAIL_MAILGUN_API_KEY="key-1234123412341234"
-# EMAIL_MAILGUN_DOMAIN="a domain name from https://app.mailgun.com/app/sending/domains"