next-tinacms-cloudinary 26.0.2 → 26.0.4

package/dist/handlers.js

@@ -1,8 +1,86 @@
 // src/handlers.ts
 import { v2 as cloudinary } from "cloudinary";
-import path from "path";
+import path2 from "path";
 import multer from "multer";
 import { promisify } from "util";
+
+// src/media-key.ts
+import path from "node:path";
+var MediaKeyError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "MediaKeyError";
+  }
+};
+function stripSlashes(value) {
+  let start = 0;
+  let end = value.length;
+  while (start < end && value[start] === "/") start++;
+  while (end > start && value[end - 1] === "/") end--;
+  return value.slice(start, end);
+}
+function normalizeMediaRoot(mediaRoot) {
+  if (!mediaRoot) {
+    return "";
+  }
+  return stripSlashes(mediaRoot);
+}
+function resolveKey(mediaRoot, rawKey, options) {
+  if (typeof rawKey !== "string" || rawKey.trim() === "") {
+    throw new MediaKeyError("a media key is required");
+  }
+  let decoded;
+  if (options?.decode === false) {
+    decoded = rawKey;
+  } else {
+    try {
+      decoded = decodeURIComponent(rawKey);
+    } catch {
+      throw new MediaKeyError("media key is not valid");
+    }
+  }
+  if (decoded.includes("\0") || decoded.includes("\\")) {
+    throw new MediaKeyError("media key is not valid");
+  }
+  if (decoded.startsWith("/") || /^[a-zA-Z]:/.test(decoded)) {
+    throw new MediaKeyError("absolute media keys are not allowed");
+  }
+  const normalized = path.posix.normalize(decoded).replace(/^\.\//, "");
+  if (normalized === ".." || normalized.startsWith("../")) {
+    throw new MediaKeyError("media key may not traverse directories");
+  }
+  if (normalized === "" || normalized === ".") {
+    throw new MediaKeyError("a media key is required");
+  }
+  const root = normalizeMediaRoot(mediaRoot);
+  if (!root) {
+    return normalized;
+  }
+  const scoped = normalized === root || normalized.startsWith(root + "/") ? normalized : path.posix.join(root, normalized);
+  if (scoped !== root && !scoped.startsWith(root + "/")) {
+    throw new MediaKeyError("media key escapes mediaRoot");
+  }
+  return scoped;
+}
+function resolveDirectory(rawDirectory) {
+  if (typeof rawDirectory !== "string" || rawDirectory.trim() === "") {
+    return "";
+  }
+  if (rawDirectory.includes("\0") || rawDirectory.includes("\\")) {
+    throw new MediaKeyError("media directory is not valid");
+  }
+  const trimmed = stripSlashes(rawDirectory);
+  const normalized = path.posix.normalize(trimmed).replace(/^\.\//, "");
+  if (normalized === ".." || normalized.startsWith("../")) {
+    throw new MediaKeyError("media directory may not traverse directories");
+  }
+  if (normalized === "" || normalized === ".") {
+    return "";
+  }
+  return normalized + "/";
+}
+
+// src/handlers.ts
 var mediaHandlerConfig = {
   api: {
     bodyParser: false
@@ -43,10 +121,25 @@ async function uploadMedia(req, res) {
     }).single("file")
   );
   await upload(req, res);
+  if (!req.file) {
+    return res.status(400).json({ message: "file is required" });
+  }
   const { directory } = req.body;
+  const filename = req.file.originalname;
+  let folder;
+  try {
+    const rawFolder = (directory || "").replace(/^\/+/, "");
+    folder = rawFolder ? resolveKey("", rawFolder, { decode: false }) : "";
+    resolveKey("", filename, { decode: false });
+  } catch (e) {
+    if (e instanceof MediaKeyError) {
+      return res.status(400).json({ message: e.message });
+    }
+    throw e;
+  }
   try {
     const result = await cloudinary.uploader.upload(req.file.path, {
-      folder: directory.replace(/^\//, ""),
+      folder,
       use_filename: true,
       overwrite: false,
       resource_type: "auto"
@@ -65,6 +158,17 @@ async function listMedia(req, res, opts) {
       filesOnly: req.query.filesOnly === "true" || false
     };
     const useRootDirectory = !mediaListOptions.directory || mediaListOptions.directory === "/" || mediaListOptions.directory === '""';
+    if (!useRootDirectory) {
+      try {
+        resolveDirectory(mediaListOptions.directory);
+      } catch (e) {
+        if (e instanceof MediaKeyError) {
+          res.status(400).json({ message: e.message });
+          return;
+        }
+        throw e;
+      }
+    }
     const query = useRootDirectory ? 'folder=""' : `folder="${mediaListOptions.directory}"`;
     const response = await cloudinary.search.expression(query).max_results(mediaListOptions.limit).next_cursor(mediaListOptions.offset).execute();
     const files = response.resources.map(getCloudinaryToTinaFunc(opts));
@@ -100,8 +204,8 @@ async function listMedia(req, res, opts) {
         return {
           id: folder.path,
           type: "dir",
-          filename: path.basename(folder.path),
-          directory: path.dirname(folder.path)
+          filename: path2.basename(folder.path),
+          directory: path2.dirname(folder.path)
         };
       });
     }
@@ -124,7 +228,16 @@ var findErrorMessage = (e) => {
 };
 async function deleteAsset(req, res) {
   const { media } = req.query;
-  const [, public_id] = media;
+  const [, rawPublicId] = media;
+  let public_id;
+  try {
+    public_id = resolveKey("", rawPublicId, { decode: false });
+  } catch (e) {
+    if (e instanceof MediaKeyError) {
+      return res.status(400).json({ message: e.message });
+    }
+    throw e;
+  }
   cloudinary.uploader.destroy(public_id, {}, (err) => {
     if (err) res.status(500);
     res.json({
@@ -140,8 +253,8 @@ function getCloudinaryToTinaFunc(opts) {
       useHttps = opts.useHttps;
     }
     const sel = useHttps ? "secure_url" : "url";
-    const filename = path.basename(file.public_id);
-    const directory = path.dirname(file.public_id);
+    const filename = path2.basename(file.public_id);
+    const directory = path2.dirname(file.public_id);
     return {
       id: file.public_id,
       filename,

package/dist/media-key.d.ts

@@ -0,0 +1,26 @@
+export declare class MediaKeyError extends Error {
+    constructor(message: string);
+}
+/**
+ * Resolve a caller-supplied media key against the configured mediaRoot.
+ *
+ * @throws {MediaKeyError} when the key is empty, absolute, contains a NUL
+ * byte, uses path traversal, or escapes mediaRoot.
+ */
+export declare function resolveKey(mediaRoot: string, rawKey: unknown, options?: {
+    decode?: boolean;
+}): string;
+/**
+ * Resolve a caller-supplied listing directory into a relative prefix.
+ *
+ * The directory is optional: an empty / root directory returns `''` (list the
+ * mediaRoot itself). Otherwise leading/trailing slashes are stripped (matching
+ * the historical handler behaviour) and the result is normalised so it cannot
+ * traverse upward — `path.join(mediaRoot, directory)` would otherwise collapse
+ * `..` and list objects outside mediaRoot. Returns a prefix with a trailing
+ * slash so it can be joined onto mediaRoot directly.
+ *
+ * @throws {MediaKeyError} when the directory contains a NUL byte or backslash,
+ * or uses upward path traversal.
+ */
+export declare function resolveDirectory(rawDirectory: unknown): string;

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "next-tinacms-cloudinary",
   "type": "module",
-  "version": "26.0.2",
+  "version": "26.0.4",
   "main": "dist/index.js",
   "module": "./dist/index.js",
   "files": [
@@ -30,11 +30,11 @@
     "react": "^18.3.1",
     "react-dom": "^18.3.1",
     "typescript": "^5.7.3",
-    "@tinacms/scripts": "1.6.1",
-    "tinacms": "3.9.2"
+    "@tinacms/scripts": "1.6.2",
+    "tinacms": "3.9.4"
   },
   "peerDependencies": {
-    "tinacms": "3.9.2"
+    "tinacms": "3.9.4"
   },
   "publishConfig": {
     "registry": "https://registry.npmjs.org"