ghost 6.63.0 → 6.65.0

package/core/frontend/services/sitemap/site-map-manager.js

@@ -1,3 +1,5 @@
+const { performance } = require('node:perf_hooks');
+const { setImmediate: yieldToEventLoop } = require('node:timers/promises');
 const errors = require('@tryghost/errors');
 const urlUtils = require('../../../shared/url-utils').default;
 const IndexMapGenerator = require('./site-map-index-generator');
@@ -22,11 +24,22 @@ const SITEMAP_COLUMNS = [
   'canonical_url',
 ];
 
+const RESOURCE_TYPES = ['posts', 'pages', 'tags', 'authors'];
+
+// Longest stretch a build runs before yielding to the event loop.
+const DEFAULT_BUILD_SLICE_MS = 10;
+
+// Builds a reader will start before giving up on a site that keeps changing.
+const MAX_BUILD_ATTEMPTS = 3;
+
 class SiteMapManager {
   constructor(options) {
     options = options || {};
 
     options.maxPerPage = options.maxPerPage || 50000;
+    // Every build creates fresh generators from these.
+    this._options = options;
+    this._buildSliceMs = options.buildSliceMs ?? DEFAULT_BUILD_SLICE_MS;
 
     this.pages = options.pages || this.createPagesGenerator(options);
     this.posts = options.posts || this.createPostsGenerator(options);
@@ -54,7 +67,7 @@ class SiteMapManager {
     this._indexEpoch = 0;
     // Static/collection route entries only arrive via RouteRegistered,
     // which fires at boot and routes reload. They are recorded here so
-    // every rebuild can replay them after resetting the generators.
+    // every rebuild can replay them into its fresh generators.
     this._routerEntries = [];
 
     routingEvents.on('RouteRegistered', ({ path, type, id }) => {
@@ -66,7 +79,6 @@ class SiteMapManager {
         datum: { id, staticRoute: type === 'StaticRoutesRouter' },
       };
       this._routerEntries.push(entry);
-      this.pages.addUrl(entry.url, entry.datum);
       // A router registering after a build must not leave a
       // zero-router index marked built — the CDN would pin it.
       this._invalidateIndex();
@@ -90,13 +102,13 @@ class SiteMapManager {
     });
   }
 
-  createIndexGenerator(options) {
+  createIndexGenerator(options, types = this) {
     return new IndexMapGenerator({
       types: {
-        pages: this.pages,
-        posts: this.posts,
-        authors: this.authors,
-        tags: this.tags,
+        pages: types.pages,
+        posts: types.posts,
+        authors: types.authors,
+        tags: types.tags,
       },
       maxPerPage: options.maxPerPage,
     });
@@ -133,81 +145,108 @@ class SiteMapManager {
    * no caller can render from an unbuilt index. The index is built on first
    * read; the invalidation signals empty it and the next read rebuilds.
    *
-   * Concurrent readers share one build. A build whose result was
-   * invalidated while it ran is discarded and the read fails — the index
-   * must never serve pre-invalidation data (the CDN would pin it for the
-   * full cache maxAge), and a 503 is retried by crawlers and stored by
-   * nobody. Deliberately no retry; if SITEMAP_BUILD_SUPERSEDED shows up in
-   * the logs at any rate worth caring about, add one then.
+   * Reads wait for the rebuild rather than being served the previous index.
+   * site.changed is emitted by the same response that purges the CDN, so the
+   * first read after an invalidation is the one the CDN stores for the full
+   * cache maxAge: serving the previous index there would pin a sitemap
+   * missing the change on every publish.
+   *
+   * Concurrent readers share one build. A build invalidated while it runs is
+   * abandoned and a fresh one started; a site changing faster than the index
+   * can be built fails the read with a 503, which crawlers retry and nobody
+   * stores.
    */
   async _ensureIndexReady() {
-    if (this._indexBuilt) {
-      return;
-    }
-    if (!this._buildInFlight) {
-      this._buildInFlight = this._buildIndex().finally(() => {
-        this._buildInFlight = null;
-      });
+    for (let attempt = 0; attempt < MAX_BUILD_ATTEMPTS && !this._indexBuilt; attempt++) {
+      if (!this._buildInFlight) {
+        this._buildInFlight = this._buildIndex().finally(() => {
+          this._buildInFlight = null;
+        });
+      }
+      await this._buildInFlight;
     }
-    await this._buildInFlight;
 
     if (!this._indexBuilt) {
       throw new errors.MaintenanceError({
-        message: 'Sitemap index build was invalidated by a concurrent site change',
+        message: 'Sitemap index build was repeatedly invalidated by concurrent site changes',
         code: 'SITEMAP_BUILD_SUPERSEDED',
       });
     }
   }
 
+  /**
+   * Builds into fresh generators and swaps them in once complete, so the
+   * build can yield to the event loop without any reader seeing a partial
+   * index. The epoch is checked after every yield: an invalidation (including
+   * a RouteRegistered mid-build) abandons the build without swapping.
+   */
   async _buildIndex() {
     const epoch = this._indexEpoch;
     const urlService = this._getUrlService();
     const fetch = (type) => urlService.getRoutableResources(type, { columns: SITEMAP_COLUMNS });
 
-    const [posts, pages, tags, authors] = await Promise.all([
-      fetch('posts'),
-      fetch('pages'),
-      fetch('tags'),
-      fetch('authors'),
-    ]);
+    const [posts, pages, tags, authors] = await Promise.all(RESOURCE_TYPES.map(fetch));
     const resources = { posts, pages, tags, authors };
 
     if (epoch !== this._indexEpoch) {
-      // Invalidated while fetching: leave the generators alone and let
-      // _ensureIndexReady start over.
       return;
     }
-    // Everything from here on is synchronous, so no request can observe
-    // a half-applied index.
-    this.posts.reset();
-    this.pages.reset();
-    this.tags.reset();
-    this.users.reset();
+
+    const next = {
+      posts: this.createPostsGenerator(this._options),
+      pages: this.createPagesGenerator(this._options),
+      tags: this.createTagsGenerator(this._options),
+      authors: this.createUsersGenerator(this._options),
+    };
     for (const entry of this._routerEntries) {
-      this.pages.addUrl(entry.url, entry.datum);
+      next.pages.addUrl(entry.url, entry.datum);
     }
-    for (const type of ['posts', 'pages', 'tags', 'authors']) {
-      for (const datum of resources[type]) {
-        this._applyResource(type, datum);
+
+    let sliceStart = performance.now();
+    for (const type of RESOURCE_TYPES) {
+      const rows = resources[type];
+      for (let i = 0; i < rows.length; i++) {
+        this._applyResource(next, type, rows[i]);
+        // Release each row once applied, so rows and records are not both
+        // fully resident.
+        rows[i] = undefined;
+
+        if (performance.now() - sliceStart >= this._buildSliceMs) {
+          await yieldToEventLoop();
+          if (epoch !== this._indexEpoch) {
+            return;
+          }
+          sliceStart = performance.now();
+        }
       }
     }
+
+    this.posts = next.posts;
+    this.pages = next.pages;
+    this.tags = next.tags;
+    this.users = this.authors = next.authors;
+    // The index generator holds references to the generators it counts.
+    this.index = this.createIndexGenerator(this._options, next);
     this._indexBuilt = true;
   }
 
   _invalidateIndex() {
     this._indexBuilt = false;
     this._indexEpoch += 1;
+    // The index generator's cached xml is valid exactly while _indexBuilt
+    // is, so the two are dropped together.
+    this.index.reset();
   }
 
   /**
-   * Add a single resource to the index.
+   * Add a single resource to a set of generators being built.
    */
-  _applyResource(type, datum) {
+  _applyResource(generators, type, datum) {
     const url = this._getUrlService().getUrlForResource({ ...datum, type }, { absolute: true });
     // Exact match on the not-found sentinel: a real resource can carry
     // a slug like "404" (/tag/404/) and must stay in the sitemap.
     if (url && url !== this._notFoundUrl()) {
-      this[type].addUrl(url, datum);
+      generators[type].addUrl(url, datum);
     }
   }
 

package/core/frontend/services/sitemap/sitemap-xml.js

@@ -0,0 +1,72 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.escapeXml = escapeXml;
+exports.getDeclarations = getDeclarations;
+exports.renderUrlSet = renderUrlSet;
+exports.renderSiteMapIndex = renderSiteMapIndex;
+const node_path_1 = __importDefault(require("node:path"));
+const url_utils_1 = __importDefault(require("../../../shared/url-utils"));
+// Ghost renders exactly two sitemap documents, both with a shape the
+// sitemaps.org schema fixes: a <urlset> per resource type, and the
+// <sitemapindex> that lists them. They are emitted here directly rather than
+// through a generic xml library — for a shape this fixed a library spends
+// several times as long walking an object tree as writing the tags costs, and
+// keeping both documents in one module keeps escaping in one auditable place.
+const URLSET_OPEN = '<urlset xmlns="http://www.sitemaps.org/schemas/sitemap/0.9"' +
+    ' xmlns:image="http://www.google.com/schemas/sitemap-image/1.1">';
+const URLSET_CLOSE = '</urlset>';
+const SITEMAPINDEX_OPEN = '<sitemapindex xmlns="http://www.sitemaps.org/schemas/sitemap/0.9">';
+const SITEMAPINDEX_CLOSE = '</sitemapindex>';
+// The characters the xml package escaped in text content, kept character for
+// character so the rendered sitemaps do not change.
+const XML_ESCAPES = {
+    '&': '&amp;',
+    '"': '&quot;',
+    "'": '&apos;',
+    '<': '&lt;',
+    '>': '&gt;',
+};
+function escapeXml(value) {
+    return value.replace(/[&"'<>]/g, (char) => XML_ESCAPES[char]);
+}
+function getDeclarations() {
+    const baseUrl = url_utils_1.default.urlFor('sitemap_xsl', true).replace(/^(http:|https:)/, '');
+    return ('<?xml version="1.0" encoding="UTF-8"?>' +
+        '<?xml-stylesheet type="text/xsl" href="' +
+        baseUrl +
+        '"?>');
+}
+/**
+ * The <urlset> document for one page of one resource type.
+ *
+ * @param entries in the order they should appear
+ */
+function renderUrlSet(entries) {
+    // Joined rather than concatenated: join returns a flat string, where
+    // repeated concatenation leaves a rope whose fragments are held for as long
+    // as the cached sitemap is.
+    const parts = [getDeclarations(), URLSET_OPEN];
+    for (const entry of entries) {
+        parts.push('<url><loc>', escapeXml(entry.loc), '</loc><lastmod>', new Date(entry.ts).toISOString(), '</lastmod>');
+        if (entry.imageLoc) {
+            parts.push('<image:image><image:loc>', escapeXml(entry.imageLoc), '</image:loc><image:caption>', escapeXml(node_path_1.default.basename(entry.imageLoc)), '</image:caption></image:image>');
+        }
+        parts.push('</url>');
+    }
+    parts.push(URLSET_CLOSE);
+    return parts.join('');
+}
+/**
+ * The <sitemapindex> document listing every page of every resource type.
+ */
+function renderSiteMapIndex(entries) {
+    const parts = [getDeclarations(), SITEMAPINDEX_OPEN];
+    for (const entry of entries) {
+        parts.push('<sitemap><loc>', escapeXml(entry.loc), '</loc><lastmod>', new Date(entry.ts).toISOString(), '</lastmod></sitemap>');
+    }
+    parts.push(SITEMAPINDEX_CLOSE);
+    return parts.join('');
+}

package/core/frontend/services/theme-engine/active.js

@@ -16,7 +16,6 @@ const join = require('path').join;
 
 const _ = require('lodash');
 const themeConfig = require('./config');
-const config = require('../../../shared/config');
 const engine = require('./engine');
 const themeI18n = require('./i18n');
 const themeI18next = require('./i18next');
@@ -120,9 +119,8 @@ class ActiveTheme {
   }
 
   mount(siteApp) {
-    // Reset the global asset hash (used as fallback for non-theme assets)
-    config.set('assetHash', null);
-    // Clear the file-based asset hash cache (for theme assets)
+    // Clear the asset hash caches: the file-based cache for theme assets, and
+    // the global hash used as a fallback for everything else
     assetHash.clearCache();
     // clear the view cache
     siteApp.cache = {};

package/core/frontend/services/theme-engine/handlebars/utils.js

@@ -1,7 +1,7 @@
 const _ = require('lodash');
 
 module.exports.findKey = function findKey(key /* ...objects... */) {
-  let objects = Array.prototype.slice.call(arguments, 1);
+  const objects = Array.prototype.slice.call(arguments, 1);
 
   return _.reduceRight(
     objects,
@@ -40,8 +40,8 @@ function _urlParentMatch(href, location) {
   }
 
   let parent = false;
-  let locParts = _urlClean(location).split('/');
-  let hrefParts = _urlClean(href).split('/');
+  const locParts = _urlClean(location).split('/');
+  const hrefParts = _urlClean(href).split('/');
 
   if (locParts.length <= hrefParts.length) {
     return false;
@@ -55,11 +55,11 @@ function _urlParentMatch(href, location) {
 }
 
 module.exports.buildLinkClasses = function buildLinkClasses(siteUrl, href, options) {
-  let relativeHref = href.replace(siteUrl, '');
-  let location = options.data.root.relativeUrl;
-  let classes = options.hash.class ? options.hash.class.toString().split(' ') : [];
-  let activeClass = _.has(options.hash, 'activeClass') ? options.hash.activeClass : 'nav-current';
-  let parentActiveClass = _.has(options.hash, 'parentActiveClass')
+  const relativeHref = href.replace(siteUrl, '');
+  const location = options.data.root.relativeUrl;
+  const classes = options.hash.class ? options.hash.class.toString().split(' ') : [];
+  const activeClass = _.has(options.hash, 'activeClass') ? options.hash.activeClass : 'nav-current';
+  const parentActiveClass = _.has(options.hash, 'parentActiveClass')
     ? options.hash.parentActiveClass
     : `${activeClass || 'nav-current'}-parent`;
 

package/core/frontend/services/theme-engine/i18n/i18n.js

@@ -62,10 +62,9 @@ class I18n {
    * @returns {string}
    */
   t(translationPath, bindings) {
-    let string;
     let msg;
 
-    string = this._findString(translationPath);
+    const string = this._findString(translationPath);
 
     // If the path returns an array (as in the case with anything that has multiple paragraphs such as emails), then
     // loop through them and return an array of translated/formatted strings. Otherwise, just return the normal
@@ -153,7 +152,7 @@ class I18n {
    */
   _findString(msgPath, opts) {
     const options = merge({ log: true }, opts || {});
-    let candidateString;
+
     let matchingString;
 
     // no path? no string
@@ -167,7 +166,7 @@ class I18n {
       this._handleUninitialisedError(msgPath);
     }
 
-    candidateString = this._getCandidateString(msgPath);
+    const candidateString = this._getCandidateString(msgPath);
 
     matchingString = candidateString || {};
 
@@ -198,7 +197,17 @@ class I18n {
    * @param  {string} locale
    */
   _readTranslationsFile(locale) {
-    const filePath = path.join(...this._translationFileDirs(), this._translationFileName(locale));
+    const directory = path.resolve(path.join(...this._translationFileDirs()));
+    const filePath = path.resolve(directory, this._translationFileName(locale));
+
+    // A locale names one file directly inside the translations directory.
+    if (path.dirname(filePath) !== directory) {
+      throw new errors.NotFoundError({
+        message: `i18n was unable to find ${locale}.json.`,
+        code: 'ENOENT',
+      });
+    }
+
     const content = fs.readFileSync(filePath, 'utf8');
     return JSON.parse(content);
   }
@@ -209,7 +218,7 @@ class I18n {
    * @param {Object} bindings
    */
   _formatMessage(string, bindings) {
-    let currentLocale = this.locale();
+    const currentLocale = this.locale();
     let msg = new MessageFormat(string, currentLocale);
 
     try {

package/core/frontend/services/theme-engine/i18next/theme-i18n.js

@@ -1,5 +1,5 @@
 const errors = require('@tryghost/errors');
-const i18nLib = require('@tryghost/i18n');
+const i18nLib = require('@tryghost/i18n').default;
 const path = require('path');
 const fs = require('fs-extra');
 

package/core/frontend/services/theme-engine/middleware/update-global-template-options.js

@@ -6,7 +6,7 @@ const labs = require('../../../../shared/labs');
 const activeTheme = require('../active');
 
 function getSiteData() {
-  let siteData = settingsCache.getPublic();
+  const siteData = settingsCache.getPublic();
 
   // theme-only computed property added to @site
   if (settingsCache.get('members_signup_access') === 'none') {

package/core/frontend/services/theme-engine/preview.js

@@ -27,7 +27,7 @@ function getPreviewData(previewHeader, customThemeSettingKeys = []) {
     hf: 'heading_font',
   };
 
-  let opts = new URLSearchParams(previewHeader);
+  const opts = new URLSearchParams(previewHeader);
 
   const previewData = {};
 

package/core/frontend/utils/member-count.js

@@ -11,9 +11,9 @@ const { api } = require('../services/proxy');
  * }>}
  */
 async function getMemberStats() {
-  let memberStats = this.data || (await api.stats.memberCountHistory.query());
+  const memberStats = this.data || (await api.stats.memberCountHistory.query());
   const { free, paid, comped, gift } = memberStats.meta.totals;
-  let total = free + paid + comped + gift;
+  const total = free + paid + comped + gift;
   return { free, paid, comped, gift, total };
 }
 

package/core/frontend/web/middleware/llms-discovery.js

@@ -1,48 +1,39 @@
-const onHeaders = require('on-headers');
-
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createLlmsDiscovery = createLlmsDiscovery;
+const on_headers_1 = __importDefault(require("on-headers"));
 function appendHeaderValue(existingValue, newValue) {
-  if (!existingValue) {
-    return newValue;
-  }
-
-  const raw = Array.isArray(existingValue) ? existingValue : [existingValue];
-  const values = raw.flatMap((v) => v.split(',').map((s) => s.trim()));
-
-  if (values.includes(newValue)) {
-    return raw.join(', ');
-  }
-
-  return raw.concat(newValue).join(', ');
+    if (!existingValue) {
+        return newValue;
+    }
+    const raw = Array.isArray(existingValue) ? existingValue : [String(existingValue)];
+    const values = raw.flatMap((value) => value.split(',').map((part) => part.trim()));
+    if (values.includes(newValue)) {
+        return raw.join(', ');
+    }
+    return raw.concat(newValue).join(', ');
 }
-
 function createLlmsDiscovery({ settingsCache }) {
-  function isDiscoveryEnabled() {
-    return !settingsCache.get('is_private') && settingsCache.get('llms_enabled') !== false;
-  }
-
-  return function llmsDiscovery(req, res, next) {
-    if (!isDiscoveryEnabled()) {
-      return next();
+    function isDiscoveryEnabled() {
+        return !settingsCache.get('is_private') && settingsCache.get('llms_enabled') !== false;
     }
-
-    onHeaders(res, function addLlmsDiscoveryHeaders() {
-      if (!isDiscoveryEnabled()) {
-        return;
-      }
-
-      const linkHeader = appendHeaderValue(this.getHeader('Link'), '</llms.txt>; rel="llms-txt"');
-      this.setHeader(
-        'Link',
-        appendHeaderValue(linkHeader, '</llms-full.txt>; rel="llms-full-txt"'),
-      );
-
-      if (!this.getHeader('X-Llms-Txt')) {
-        this.setHeader('X-Llms-Txt', '/llms.txt');
-      }
-    });
-
-    next();
-  };
+    return function llmsDiscovery(req, res, next) {
+        if (!isDiscoveryEnabled()) {
+            return next();
+        }
+        (0, on_headers_1.default)(res, function addLlmsDiscoveryHeaders() {
+            if (!isDiscoveryEnabled()) {
+                return;
+            }
+            const linkHeader = appendHeaderValue(this.getHeader('Link'), '</llms.txt>; rel="llms-txt"');
+            this.setHeader('Link', appendHeaderValue(linkHeader, '</llms-full.txt>; rel="llms-full-txt"'));
+            if (!this.getHeader('X-Llms-Txt')) {
+                this.setHeader('X-Llms-Txt', '/llms.txt');
+            }
+        });
+        next();
+    };
 }
-
-module.exports = { createLlmsDiscovery };

package/core/frontend/web/routers/serve-public-file.js

@@ -36,7 +36,7 @@ function createPublicFileMiddleware(location, file, mime, maxAge, options = {})
   // These files are built on the fly, and must be saved in the content folder
   const builtFilePath = config.getContentPath('public');
 
-  let locationPath = location === 'static' ? staticFilePath : builtFilePath;
+  const locationPath = location === 'static' ? staticFilePath : builtFilePath;
 
   const filePath = file.match(/^public/)
     ? path.join(locationPath, file.replace(/^public/, ''))

package/core/server/adapters/route-settings/S3RouteSettingsStore.js

@@ -87,7 +87,7 @@ const configSchema = zod_1.z
     return !((hasAccessKey || hasSecretKey || hasSessionToken) && !hasCredentialPair);
 }, { error: (0, tpl_1.default)(messages.partialCredentials) });
 /**
- * Remote store for route settings backed by an S3-compatible bucket (MinIO in
+ * Remote store for route settings backed by an S3-compatible bucket (VersityGW in
  * tests, GCS in production). Reads and writes the operator's original
  * `routes.yaml` verbatim.
  */

package/core/server/adapters/scheduling/README.md

@@ -19,6 +19,10 @@ and `unschedule`, and inherit a registry of reschedulers from
   a job's fire time.
 - `build-signed-job.ts` — builds an adapter job whose callback URL carries
   that signed token, from an Admin API path and fire time.
+- `get-scheduler-idempotency-key.ts` — `getSchedulerIdempotencyKey`, which
+  derives the idempotency key a job carries from its consumer namespace, fire
+  time, and final callback URL, so a persistent queue can recognise a
+  re-registration of a job it already holds.
 - `signed-flush-scheduler.ts` — `SignedFlushScheduler`, a flush-queue
   primitive on top of the two above: arms one job per fire time (deduplicated
   in memory), skips already-due times in favour of the caller's own recovery

package/core/server/adapters/scheduling/get-scheduler-idempotency-key.js

@@ -0,0 +1,21 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getSchedulerIdempotencyKey = getSchedulerIdempotencyKey;
+const node_crypto_1 = __importDefault(require("node:crypto"));
+/**
+ * Builds the idempotency key a scheduling adapter sends alongside a job, so a
+ * queue with persistent storage can recognise a re-registration of a job it
+ * already holds instead of creating a duplicate.
+ *
+ * The key is a hash rather than the raw inputs so it stays well inside the
+ * scheduler's 255-character printable-ASCII limit whatever the URL length.
+ */
+function getSchedulerIdempotencyKey({ namespace, date, url, }) {
+    const hash = node_crypto_1.default.createHash('sha256');
+    hash.update(date.toISOString());
+    hash.update(url.href);
+    return `ghost-${namespace}-${hash.digest('hex')}`;
+}

package/core/server/adapters/storage/LocalFilesStorage.js

@@ -3,10 +3,9 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-// # Local File System Storage module
-// The (default) module for storing media, using the local file system
 const config_1 = __importDefault(require("../../../shared/config"));
 const url_utils_1 = __importDefault(require("../../../shared/url-utils"));
+const file_type_utils_1 = require("../../services/files/file-type-utils");
 const LocalStorageBase_1 = __importDefault(require("./LocalStorageBase"));
 const messages = {
     notFound: 'File not found',
@@ -22,5 +21,16 @@ class LocalFilesStorage extends LocalStorageBase_1.default {
             errorMessages: messages,
         });
     }
+    /**
+     * The files upload endpoint resolves an inert content type for each file
+     * (e.g. .html -> text/plain, .svg -> application/octet-stream), which S3
+     * stores alongside the object. Local storage has nowhere to keep it, so
+     * resolve it again here instead of letting express.static derive a
+     * browser-executable type from the extension.
+     */
+    setServeHeaders(res, filePath) {
+        super.setServeHeaders(res, filePath);
+        res.setHeader('Content-Type', (0, file_type_utils_1.getStorageContentType)(filePath));
+    }
 }
 exports.default = LocalFilesStorage;

package/core/server/adapters/storage/LocalStorageBase.js

@@ -6,6 +6,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 // # Local File Base Storage module
 // The (default) module for storing files using the local file system
 const fs_extra_1 = __importDefault(require("fs-extra"));
+const os_1 = __importDefault(require("os"));
 const path_1 = __importDefault(require("path"));
 const tpl_1 = __importDefault(require("@tryghost/tpl"));
 const errors_1 = __importDefault(require("@tryghost/errors"));
@@ -27,7 +28,7 @@ class LocalStorageBase extends ghost_storage_base_1.StorageBase {
     errorMessages;
     constructor({ storagePath, staticFileURLPrefix, siteUrl, errorMessages, }) {
         super();
-        this.storagePath = storagePath;
+        this.storagePath = storagePath ?? os_1.default.tmpdir();
         this.staticFileURLPrefix = staticFileURLPrefix;
         this.siteUrl = siteUrl;
         this.staticFileUrl = `${siteUrl}${staticFileURLPrefix}`;
@@ -197,6 +198,17 @@ class LocalStorageBase extends ghost_storage_base_1.StorageBase {
             return false;
         }
     }
+    /**
+     * Sets response headers for a file about to be served from local storage.
+     * `send` only derives Content-Type from the extension when it hasn't been
+     * set yet, so subclasses can override this to enforce their own type.
+     *
+     * `nosniff` stops browsers from second-guessing the declared Content-Type
+     * based on the file's contents.
+     */
+    setServeHeaders(res, _filePath) {
+        res.setHeader('X-Content-Type-Options', 'nosniff');
+    }
     /**
      * For some reason send divides the max age number by 1000
      * Fallthrough: false ensures that if an image isn't found, it automatically 404s
@@ -204,10 +216,12 @@ class LocalStorageBase extends ghost_storage_base_1.StorageBase {
      */
     serve() {
         const { storagePath, errorMessages } = this;
+        const setHeaders = (res, filePath) => this.setServeHeaders(res, filePath);
         return function serveStaticContent(req, res, next) {
             return serveStatic(storagePath, {
                 maxAge: 365 * 24 * 60 * 60 * 1000, // 1 year in ms
                 fallthrough: false,
+                setHeaders,
             })(req, res, (err) => {
                 if (err) {
                     if (err.statusCode === 404) {