ghost 6.54.0 → 6.55.0

package/core/server/adapters/storage/LocalStorageBase.ts

@@ -0,0 +1,342 @@
+// # Local File Base Storage module
+// The (default) module for storing files using the local file system
+import fs from 'fs-extra';
+import path from 'path';
+import type {NextFunction, Request, RequestHandler, Response} from 'express';
+import type express from 'express';
+import tpl from '@tryghost/tpl';
+import errors from '@tryghost/errors';
+import {StorageBase, type ReadOptions, type StorageFile} from 'ghost-storage-base';
+import urlUtils from '../../../shared/url-utils';
+import {errify} from '../../../shared/errify';
+
+const serveStatic: typeof express.static = require('../../../shared/express').static;
+
+const messages = {
+    notFound: 'File not found',
+    notFoundWithRef: 'File not found: {file}',
+    cannotRead: 'Could not read file: {file}',
+    invalidUrlParameter: `The URL "{url}" is not a valid URL for this site.`,
+    invalidPathParameter: 'The path "{path}" is not valid for this storage.'
+};
+
+export interface LocalStorageBaseErrorMessages {
+    notFound: string;
+    notFoundWithRef: string;
+    cannotRead: string;
+}
+
+export interface LocalStorageBaseOptions {
+    storagePath: string;
+    siteUrl?: string;
+    staticFileURLPrefix?: string;
+    errorMessages?: LocalStorageBaseErrorMessages;
+}
+
+/**
+ * Errors thrown by `serve-static` carry an HTTP status alongside the standard
+ * Error fields.
+ */
+interface ServeStaticError extends Error {
+    statusCode?: number;
+    path?: string;
+}
+
+class LocalStorageBase extends StorageBase {
+    readonly staticFileURLPrefix: string | undefined;
+
+    readonly siteUrl: string | undefined;
+
+    readonly staticFileUrl: string;
+
+    readonly errorMessages: LocalStorageBaseErrorMessages;
+
+    constructor({storagePath, staticFileURLPrefix, siteUrl, errorMessages}: LocalStorageBaseOptions) {
+        super();
+
+        this.storagePath = storagePath;
+        this.staticFileURLPrefix = staticFileURLPrefix;
+        this.siteUrl = siteUrl;
+        this.staticFileUrl = `${siteUrl}${staticFileURLPrefix}`;
+        this.errorMessages = errorMessages || messages;
+    }
+
+    /**
+     * Normalizes a relative storage path and rejects traversal outside the storage root.
+     */
+    _normalizeStorageRelativePath(filePath?: string): string {
+        const normalized = path.posix.normalize(String(filePath || '')
+            .replaceAll('\\', '/')
+            .replace(/^\/+/, '')
+            .replace(/\/+$/, ''));
+
+        if (normalized === '.' || normalized === '..' || normalized.startsWith('../')) {
+            throw new errors.IncorrectUsageError({
+                message: tpl(messages.invalidPathParameter, {path: filePath})
+            });
+        }
+
+        return normalized;
+    }
+
+    /**
+     * Resolves a target directory and optional file name into a full path,
+     * validating the result is inside the storage root.
+     *
+     * Supports relative paths (preferred) and absolute paths (legacy).
+     * TODO: remove absolute path support once all callers pass relative paths
+     *
+     * @param targetDir absolute or relative directory
+     * @param fileName file name to normalize and append
+     * @returns resolved absolute path inside storagePath
+     */
+    _resolveAndValidateStoragePath(targetDir?: string, fileName?: string): string {
+        const resolvedRoot = path.resolve(this.storagePath);
+
+        // Resolve targetDir: if already inside storage root use as-is, otherwise treat as relative
+        let resolvedBase;
+        if (targetDir) {
+            const resolvedTargetDir = path.resolve(targetDir);
+            const relToRoot = path.relative(resolvedRoot, resolvedTargetDir);
+            if (relToRoot === '' || (!relToRoot.startsWith('..') && !path.isAbsolute(relToRoot))) {
+                resolvedBase = resolvedTargetDir;
+            } else {
+                resolvedBase = path.resolve(this.storagePath, targetDir);
+            }
+        } else {
+            resolvedBase = resolvedRoot;
+        }
+
+        // If fileName provided, normalize and resolve
+        let resolvedPath;
+        if (fileName) {
+            const normalizedFileName = this._normalizeStorageRelativePath(fileName);
+            resolvedPath = path.resolve(resolvedBase, normalizedFileName);
+        } else {
+            resolvedPath = resolvedBase;
+        }
+
+        // Validate the resolved path is strictly inside the storage root (not equal to it)
+        const relative = path.relative(resolvedRoot, resolvedPath);
+        if (relative === '' || relative === '..' || relative.startsWith('..' + path.sep) || path.isAbsolute(relative)) {
+            throw new errors.IncorrectUsageError({
+                message: tpl(messages.invalidPathParameter, {path: fileName || targetDir || ''})
+            });
+        }
+
+        return resolvedPath;
+    }
+
+    /**
+     * Saves the file to storage (the file system)
+     * - returns a promise which ultimately returns the full url to the uploaded file
+     */
+    async save(file: StorageFile, targetDir?: string): Promise<string> {
+        let targetFilename;
+
+        targetDir = targetDir
+            ? this._resolveAndValidateStoragePath(targetDir)
+            : this.getTargetDir(this.storagePath);
+
+        const filename = await this.getUniqueFileName(file, targetDir);
+
+        targetFilename = filename;
+
+        // Verify that we are saving directly under `targetDir` and not outside of it.
+        const expectedPrefix = path.join(path.resolve(targetDir), '/');
+        if (!path.resolve(targetFilename).startsWith(expectedPrefix)) {
+            throw new errors.BadRequestError({message: 'Cannot save to the given filename'});
+        }
+
+        await fs.mkdirs(targetDir);
+
+        try {
+            await fs.copy(file.path, targetFilename);
+        } catch (err) {
+            if ((err as NodeJS.ErrnoException).code === 'ENAMETOOLONG') {
+                throw new errors.BadRequestError({err: errify(err)});
+            }
+
+            throw err;
+        }
+
+        // The src for the image must be in URI format, not a file system path, which in Windows uses \
+        // For local file system storage can use relative path so add a slash
+        const fullUrl = (
+            urlUtils.urlJoin('/',
+                urlUtils.getSubdir(),
+                this.staticFileURLPrefix as string,
+                path.relative(this.storagePath, targetFilename))
+        ).replace(new RegExp(`\\${path.sep}`, 'g'), '/');
+
+        return fullUrl;
+    }
+
+    /**
+     * Saves a buffer in the targetPath
+     *
+     * @param buffer is an instance of Buffer
+     * @param targetPath relative path NOT including storage path to which the buffer should be written
+     * @returns a URL to retrieve the data
+     */
+    async saveRaw(buffer: Buffer, targetPath: string): Promise<string> {
+        const storagePath = path.join(this.storagePath, this._normalizeStorageRelativePath(targetPath));
+        const targetDir = path.dirname(storagePath);
+
+        await fs.mkdirs(targetDir);
+        await fs.writeFile(storagePath, buffer);
+
+        // For local file system storage can use relative path so add a slash
+        const fullUrl = (
+            urlUtils.urlJoin('/', urlUtils.getSubdir(),
+                this.staticFileURLPrefix as string,
+                targetPath)
+        ).replace(new RegExp(`\\${path.sep}`, 'g'), '/');
+
+        return fullUrl;
+    }
+
+    /**
+     * @param url full url under which the stored content is served, result of save method
+     * @returns relative path under which the content is stored
+     */
+    urlToPath(url: string): string {
+        let relativePath;
+
+        const prefix = urlUtils.urlJoin('/',
+            urlUtils.getSubdir(),
+            this.staticFileURLPrefix as string
+        );
+
+        if (url.startsWith(this.staticFileUrl)) {
+            // CASE: full path that includes the site url
+            relativePath = url.replace(this.staticFileUrl, '');
+        } else if (url.startsWith(prefix)) {
+            // CASE: The result of the save method doesn't include the site url. So we need to handle this case.
+            relativePath = url.replace(prefix, '');
+        } else {
+            throw new errors.IncorrectUsageError({
+                message: tpl(messages.invalidUrlParameter, {url})
+            });
+        }
+
+        try {
+            return this._normalizeStorageRelativePath(relativePath);
+        } catch (err) {
+            throw new errors.IncorrectUsageError({
+                message: tpl(messages.invalidUrlParameter, {url})
+            });
+        }
+    }
+
+    async exists(fileName: string, targetDir?: string): Promise<boolean> {
+        let filePath;
+
+        try {
+            filePath = this._resolveAndValidateStoragePath(targetDir, fileName);
+        } catch (err) {
+            if (err instanceof errors.IncorrectUsageError) {
+                return false;
+            }
+
+            throw err;
+        }
+
+        try {
+            await fs.stat(filePath);
+            return true;
+        } catch {
+            return false;
+        }
+    }
+
+    /**
+     * For some reason send divides the max age number by 1000
+     * Fallthrough: false ensures that if an image isn't found, it automatically 404s
+     * Wrap server static errors
+     */
+    serve(): RequestHandler {
+        const {storagePath, errorMessages} = this;
+
+        return function serveStaticContent(req: Request, res: Response, next: NextFunction) {
+            return serveStatic(
+                storagePath,
+                {
+                    maxAge: (365 * 24 * 60 * 60 * 1000), // 1 year in ms
+                    fallthrough: false
+                }
+            )(req, res, (err?: ServeStaticError) => {
+                if (err) {
+                    if (err.statusCode === 404) {
+                        return next(new errors.NotFoundError({
+                            message: tpl(errorMessages.notFound),
+                            code: 'STATIC_FILE_NOT_FOUND',
+                            property: err.path
+                        }));
+                    }
+
+                    if (err.statusCode === 400) {
+                        return next(new errors.BadRequestError({err: err}));
+                    }
+
+                    if (err.statusCode === 403) {
+                        return next(new errors.NoPermissionError({err: err}));
+                    }
+
+                    if (err.name === 'RangeNotSatisfiableError') {
+                        return next(new errors.RangeNotSatisfiableError({err}));
+                    }
+
+                    return next(new errors.InternalServerError({err: err}));
+                }
+
+                next();
+            });
+        };
+    }
+
+    async delete(fileName: string, targetDir?: string): Promise<void> {
+        const filePath = this._resolveAndValidateStoragePath(targetDir, fileName);
+        return await fs.remove(filePath);
+    }
+
+    /**
+     * Reads bytes from disk for a target file
+     * - path of target file (without content path!)
+     */
+    async read(options?: Partial<ReadOptions>): Promise<Buffer> {
+        options = options || {};
+
+        const normalizedPath = this._normalizeStorageRelativePath(options.path);
+        const targetPath = path.join(this.storagePath, normalizedPath);
+
+        try {
+            return await fs.readFile(targetPath);
+        } catch (rawError) {
+            const err = errify(rawError);
+            const code = (rawError as NodeJS.ErrnoException).code;
+
+            if (code === 'ENOENT' || code === 'ENOTDIR') {
+                throw new errors.NotFoundError({
+                    err: err,
+                    message: tpl(this.errorMessages.notFoundWithRef, {file: options.path})
+                });
+            }
+
+            if (code === 'ENAMETOOLONG') {
+                throw new errors.BadRequestError({err: err});
+            }
+
+            if (code === 'EACCES') {
+                throw new errors.NoPermissionError({err: err});
+            }
+
+            throw new errors.InternalServerError({
+                err: err,
+                message: tpl(this.errorMessages.cannotRead, {file: options.path})
+            });
+        }
+    }
+}
+
+export default LocalStorageBase;

package/core/server/adapters/storage/utils.js

@@ -1,68 +1,54 @@
-const config = require('../../../shared/config');
-const urlUtils = require('../../../shared/url-utils').default;
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getLocalImagesStoragePath = getLocalImagesStoragePath;
+exports.isLocalImage = isLocalImage;
+exports.isInternalImage = isInternalImage;
+const config_1 = __importDefault(require("../../../shared/config"));
+const url_utils_1 = __importDefault(require("../../../shared/url-utils"));
 /**
  * @TODO: move `events.js` to here - e.g. storageUtils.getStorage
  */
-
 /**
- * Sanitizes a given URL or path for an image to be readable by the local file storage
- * as storage needs the path without `/content/images/` prefix
- * Always returns {string} url
- * @param {string} imagePath
- * @returns {string} imagePath
- * @description Takes a url or filepath and returns a filepath with is readable
- * for the local file storage.
+ * Sanitizes a given URL or path for an image to be readable by the local file
+ * storage, as storage needs the path without the `/content/images/` prefix.
+ *
+ * Takes a url or filepath and returns a filepath which is readable for the
+ * local file storage.
  */
-exports.getLocalImagesStoragePath = function getLocalImagesStoragePath(imagePath) {
+function getLocalImagesStoragePath(imagePath) {
     // The '/' in urlJoin is necessary to add the '/' to `content/images`, if no subdirectory is setup
-    const urlRegExp = new RegExp(`^${urlUtils.urlJoin(
-        urlUtils.urlFor('home', true),
-        urlUtils.getSubdir(),
-        '/',
-        urlUtils.STATIC_IMAGE_URL_PREFIX)}`
-    );
-
-    const filePathRegExp = new RegExp(`^${urlUtils.urlJoin(
-        urlUtils.getSubdir(),
-        '/',
-        urlUtils.STATIC_IMAGE_URL_PREFIX)}`
-    );
-
+    const urlRegExp = new RegExp(`^${url_utils_1.default.urlJoin(url_utils_1.default.urlFor('home', true), url_utils_1.default.getSubdir(), '/', url_utils_1.default.STATIC_IMAGE_URL_PREFIX)}`);
+    const filePathRegExp = new RegExp(`^${url_utils_1.default.urlJoin(url_utils_1.default.getSubdir(), '/', url_utils_1.default.STATIC_IMAGE_URL_PREFIX)}`);
     if (imagePath.match(urlRegExp)) {
         return imagePath.replace(urlRegExp, '');
-    } else if (imagePath.match(filePathRegExp)) {
+    }
+    else if (imagePath.match(filePathRegExp)) {
         return imagePath.replace(filePathRegExp, '');
-    } else {
+    }
+    else {
         return imagePath;
     }
-};
-
+}
 /**
- * @description compares the imagePath with a regex that reflects our local file storage
- * @param {string} imagePath as URL or filepath
- * @returns {boolean}
+ * Compares the imagePath with a regex that reflects our local file storage
+ *
+ * @param imagePath as URL or filepath
  */
-
-exports.isLocalImage = function isLocalImage(imagePath) {
-    const localImagePath = this.getLocalImagesStoragePath(imagePath);
-
-    if (localImagePath !== imagePath) {
-        return true;
-    } else {
-        return false;
-    }
-};
-
+function isLocalImage(imagePath) {
+    return getLocalImagesStoragePath(imagePath) !== imagePath;
+}
 /**
- * @description Checks whether the image is managed by Ghost storage (local or CDN)
- * @param {string} imagePath as URL or filepath
- * @returns {boolean}
+ * Checks whether the image is managed by Ghost storage (local or CDN)
+ *
+ * @param imagePath as URL or filepath
  */
-exports.isInternalImage = function isInternalImage(imagePath) {
-    if (this.isLocalImage(imagePath)) {
+function isInternalImage(imagePath) {
+    if (isLocalImage(imagePath)) {
         return true;
     }
-
-    const imageBaseUrl = (config.get('urls:image') || '').replace(/\/+$/, '');
+    const imageBaseUrl = (config_1.default.get('urls:image') || '').replace(/\/+$/, '');
     return !!(imageBaseUrl && imagePath.startsWith(imageBaseUrl + '/'));
-};
+}

package/core/server/adapters/storage/utils.ts

@@ -0,0 +1,60 @@
+import config from '../../../shared/config';
+import urlUtils from '../../../shared/url-utils';
+
+/**
+ * @TODO: move `events.js` to here - e.g. storageUtils.getStorage
+ */
+
+/**
+ * Sanitizes a given URL or path for an image to be readable by the local file
+ * storage, as storage needs the path without the `/content/images/` prefix.
+ *
+ * Takes a url or filepath and returns a filepath which is readable for the
+ * local file storage.
+ */
+export function getLocalImagesStoragePath(imagePath: string): string {
+    // The '/' in urlJoin is necessary to add the '/' to `content/images`, if no subdirectory is setup
+    const urlRegExp = new RegExp(`^${urlUtils.urlJoin(
+        urlUtils.urlFor('home', true),
+        urlUtils.getSubdir(),
+        '/',
+        urlUtils.STATIC_IMAGE_URL_PREFIX)}`
+    );
+
+    const filePathRegExp = new RegExp(`^${urlUtils.urlJoin(
+        urlUtils.getSubdir(),
+        '/',
+        urlUtils.STATIC_IMAGE_URL_PREFIX)}`
+    );
+
+    if (imagePath.match(urlRegExp)) {
+        return imagePath.replace(urlRegExp, '');
+    } else if (imagePath.match(filePathRegExp)) {
+        return imagePath.replace(filePathRegExp, '');
+    } else {
+        return imagePath;
+    }
+}
+
+/**
+ * Compares the imagePath with a regex that reflects our local file storage
+ *
+ * @param imagePath as URL or filepath
+ */
+export function isLocalImage(imagePath: string): boolean {
+    return getLocalImagesStoragePath(imagePath) !== imagePath;
+}
+
+/**
+ * Checks whether the image is managed by Ghost storage (local or CDN)
+ *
+ * @param imagePath as URL or filepath
+ */
+export function isInternalImage(imagePath: string): boolean {
+    if (isLocalImage(imagePath)) {
+        return true;
+    }
+
+    const imageBaseUrl = (config.get('urls:image') || '').replace(/\/+$/, '');
+    return !!(imageBaseUrl && imagePath.startsWith(imageBaseUrl + '/'));
+}

package/core/server/api/endpoints/automation-action-links.js

@@ -0,0 +1,68 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+const automationsApi = __importStar(require("../../services/automations/automations-api"));
+const controller = {
+    docName: 'automation_action_links',
+    browse: {
+        headers: {
+            cacheInvalidate: false
+        },
+        options: [
+            'automation_id',
+            'action_id'
+        ],
+        validation: {
+            options: {
+                automation_id: {
+                    required: true
+                },
+                action_id: {
+                    required: true
+                }
+            }
+        },
+        permissions: {
+            docName: 'automations',
+            method: 'read'
+        },
+        async query(frame) {
+            return {
+                data: await automationsApi.browseActionLinks(frame.options.automation_id, frame.options.action_id)
+            };
+        }
+    }
+};
+module.exports = controller;

package/core/server/api/endpoints/automation-action-links.ts

@@ -0,0 +1,46 @@
+import * as automationsApi from '../../services/automations/automations-api';
+
+type BrowseFrame = {
+    options: {
+        automation_id: string;
+        action_id: string;
+    };
+};
+
+const controller = {
+    docName: 'automation_action_links',
+
+    browse: {
+        headers: {
+            cacheInvalidate: false
+        },
+        options: [
+            'automation_id',
+            'action_id'
+        ],
+        validation: {
+            options: {
+                automation_id: {
+                    required: true
+                },
+                action_id: {
+                    required: true
+                }
+            }
+        },
+        permissions: {
+            docName: 'automations',
+            method: 'read'
+        },
+        async query(frame: BrowseFrame) {
+            return {
+                data: await automationsApi.browseActionLinks(
+                    frame.options.automation_id,
+                    frame.options.action_id
+                )
+            };
+        }
+    }
+};
+
+module.exports = controller;

package/core/server/api/endpoints/db.js

@@ -1,4 +1,5 @@
 const moment = require('moment-timezone');
+const path = require('path');
 const dbBackup = require('../../data/db/backup');
 const exporter = require('../../data/exporter');
 const importer = require('../../data/importer');
@@ -29,6 +30,11 @@ const controller = {
             }
         },
         query(frame) {
+            const filename = frame.options.filename;
+            if (filename && path.basename(filename) !== filename) {
+                throw new errors.ValidationError({message: 'Export filename must not contain path separators'});
+            }
+
             // NOTE: we need to have `include` property available as backupDatabase uses it internally
             Object.assign(frame.options, {include: frame.options.withRelated});
 

package/core/server/api/endpoints/index.js

@@ -11,6 +11,10 @@ module.exports = {
         return apiFramework.pipeline(require('./automations'), localUtils);
     },
 
+    get automationActionLinks() {
+        return apiFramework.pipeline(require('./automation-action-links'), localUtils);
+    },
+
     get automationEmailPreviews() {
         return apiFramework.pipeline(require('./automation-email-previews'), localUtils);
     },