kuzzle 2.52.0 → 2.53.0

package/dist/lib/api/request/kuzzleRequest.d.ts

@@ -121,7 +121,7 @@ export declare class KuzzleRequest {
         input: {
             action: string;
             args: JSONObject;
-            body: JSONObject;
+            body: any[] | JSONObject;
             controller: string;
             jwt: string;
             volatile: JSONObject;

package/dist/lib/api/request/requestInput.d.ts

@@ -155,8 +155,8 @@ export declare class RequestInput {
      *   body         <== that
      *  }
      */
-    get body(): JSONObject | null;
-    set body(obj: JSONObject);
+    get body(): JSONObject | Array<any> | null;
+    set body(obj: JSONObject | Array<any>);
     /**
      * Request headers (Http only).
      *

package/dist/lib/api/request/requestInput.js

@@ -254,7 +254,7 @@ class RequestInput {
         return this[_body];
     }
     set body(obj) {
-        this[_body] = assert.assertObject("body", obj);
+        this[_body] = assert.assertArrayOrObject("body", obj);
     }
     /**
      * Request headers (Http only).

package/dist/lib/kuzzle/dumpGenerator.js

@@ -28,6 +28,7 @@ const dumpme = require("dumpme");
 const zlib = require("zlib");
 const { Request } = require("../api/request");
 const kerror = require("../kerror");
+const { BadRequestError } = require("../kerror/errors");
 class DumpGenerator {
     constructor() {
         this._dump = false;
@@ -44,10 +45,15 @@ class DumpGenerator {
             throw kerror.get("api", "process", "action_locked", "dump");
         }
         this._dump = true;
-        const dumpPath = path.join(path.normalize(global.kuzzle.config.dump.path), moment()
+        const basePath = path.normalize(global.kuzzle.config.dump.path);
+        const dumpPath = path.join(basePath, moment()
             .format(global.kuzzle.config.dump.dateFormat)
             .concat(`-${suffix}`)
             .substring(0, 200));
+        const resolvedPath = path.resolve(dumpPath);
+        if (!resolvedPath.startsWith(path.resolve(basePath))) {
+            throw new BadRequestError(`Dump path '${dumpPath}' is outside of designated dump directory '${basePath}'`);
+        }
         this.logger.info("=".repeat(79));
         this.logger.info(`Generating dump in ${dumpPath}`);
         this._cleanUpHistory();

package/dist/lib/util/assertType.d.ts

@@ -9,6 +9,16 @@
  * @return {array}
  */
 export function assertArray(attr: string, data: any, type: any): any[];
+/**
+ * Throws if the provided data is not an object or an array.
+ * Returns the unmodified data if validated
+ *
+ * @throws
+ * @param {string} attr - tested attribute name
+ * @param {*} data
+ * @return {object|array}
+ */
+export function assertArrayOrObject(attr: string, data: any): object | any[];
 /**
  * Throws if the provided data is not an integer
  * Returns the unmodified data if validated

package/dist/lib/util/assertType.js

@@ -38,6 +38,24 @@ function assertObject(attr, data) {
     }
     return data;
 }
+/**
+ * Throws if the provided data is not an object or an array.
+ * Returns the unmodified data if validated
+ *
+ * @throws
+ * @param {string} attr - tested attribute name
+ * @param {*} data
+ * @return {object|array}
+ */
+function assertArrayOrObject(attr, data) {
+    if (data === null || data === undefined) {
+        return null;
+    }
+    if (typeof data !== "object") {
+        throw new BadRequestError(`Attribute ${attr} must be of type "object" or "array"`);
+    }
+    return data;
+}
 /**
  * Throws if the provided data is not an array containing exclusively
  * values of the specified "type"
@@ -101,6 +119,7 @@ function assertInteger(attr, data) {
 }
 module.exports = {
     assertArray,
+    assertArrayOrObject,
     assertInteger,
     assertObject,
     assertString,

package/dist/package.json

@@ -1,7 +1,7 @@
 {
     "name": "kuzzle",
     "author": "The Kuzzle Team <support@kuzzle.io>",
-    "version": "2.52.0",
+    "version": "2.53.0",
     "description": "Kuzzle is an open-source solution that handles all the data management through a secured API, with a large choice of protocols.",
     "scripts": {
         "build": "rm -Rf ./dist && tsc && node ./bin/copy-protobuf.js",

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "kuzzle",
   "author": "The Kuzzle Team <support@kuzzle.io>",
-  "version": "2.52.0",
+  "version": "2.53.0",
   "description": "Kuzzle is an open-source solution that handles all the data management through a secured API, with a large choice of protocols.",
   "scripts": {
     "build": "rm -Rf ./dist && tsc && node ./bin/copy-protobuf.js",