next-tinacms-cloudinary 27.0.1 → 27.0.3

package/dist/handlers.js

@@ -1,6 +1,7 @@
 // src/handlers.ts
 import { v2 as cloudinary } from "cloudinary";
 import path2 from "path";
+import os from "os";
 import multer from "multer";
 import { promisify } from "util";
 
@@ -80,6 +81,17 @@ function resolveDirectory(rawDirectory) {
   return normalized + "/";
 }
 
+// src/search-expression.ts
+function escapeSearchValue(value) {
+  return value.replace(/[\\"*]/g, "\\$&");
+}
+
+// src/upload-filename.ts
+function safeUploadName(originalName) {
+  const base = originalName.split(/[/\\]/).pop() || "";
+  return base === "." || base === ".." ? "" : base;
+}
+
 // src/handlers.ts
 var mediaHandlerConfig = {
   api: {
@@ -110,12 +122,11 @@ async function uploadMedia(req, res) {
   const upload = promisify(
     multer({
       storage: multer.diskStorage({
-        // @ts-ignore
-        directory: (req2, file, cb) => {
-          cb(null, "/tmp");
+        destination: (req2, file, cb) => {
+          cb(null, os.tmpdir());
         },
         filename: (req2, file, cb) => {
-          cb(null, file.originalname);
+          cb(null, safeUploadName(file.originalname));
         }
       })
     }).single("file")
@@ -151,8 +162,10 @@ async function uploadMedia(req, res) {
 }
 async function listMedia(req, res, opts) {
   try {
+    const rawDirectory = req.query.directory;
+    const directory = Array.isArray(rawDirectory) ? rawDirectory[0] : rawDirectory;
     const mediaListOptions = {
-      directory: req.query.directory || '""',
+      directory: directory || '""',
       limit: parseInt(req.query.limit, 10) || 500,
       offset: req.query.offset,
       filesOnly: req.query.filesOnly === "true" || false
@@ -169,14 +182,14 @@ async function listMedia(req, res, opts) {
         throw e;
       }
     }
-    const query = useRootDirectory ? 'folder=""' : `folder="${mediaListOptions.directory}"`;
+    const query = useRootDirectory ? 'folder=""' : `folder="${escapeSearchValue(mediaListOptions.directory)}"`;
     const response = await cloudinary.search.expression(query).max_results(mediaListOptions.limit).next_cursor(mediaListOptions.offset).execute();
     const files = response.resources.map(getCloudinaryToTinaFunc(opts));
-    cloudinary.api.folders = (directory = '""') => {
+    cloudinary.api.folders = (directory2 = '""') => {
       if (useRootDirectory) {
         return cloudinary.api.root_folders();
       } else {
-        return cloudinary.api.sub_folders(directory);
+        return cloudinary.api.sub_folders(directory2);
       }
     };
     let folders = [];

package/dist/search-expression.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Escape a value for interpolation into a quoted Cloudinary Search API term.
+ *
+ * Cloudinary treats a double-quoted term literally except for `"` and `*`,
+ * which keep their meaning and must be backslash-escaped. Backslash is escaped
+ * too as a conservative hedge; callers reach this through resolveDirectory,
+ * which already rejects backslashes, so that branch is unreachable today.
+ *
+ * See https://cloudinary.com/documentation/search_expressions
+ */
+export declare function escapeSearchValue(value: string): string;

package/dist/upload-filename.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Strip any directory component from an uploaded filename so
+ * path.join(os.tmpdir(), name) can't escape the temp dir. Defense in depth:
+ * multer's parser already basenames the name, but don't rely on it.
+ * Duplicated byte-for-byte across the multer-based media adapters.
+ */
+export declare function safeUploadName(originalName: string): string;

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "next-tinacms-cloudinary",
   "type": "module",
-  "version": "27.0.1",
+  "version": "27.0.3",
   "main": "dist/index.js",
   "module": "./dist/index.js",
   "files": [
@@ -20,7 +20,7 @@
   },
   "dependencies": {
     "cloudinary": "^1.41.3",
-    "multer": "1.4.5-lts.1"
+    "multer": "2.2.0"
   },
   "devDependencies": {
     "@types/crypto-js": "^3.1.47",
@@ -30,11 +30,11 @@
     "react": "^18.3.1",
     "react-dom": "^18.3.1",
     "typescript": "^5.7.3",
-    "@tinacms/scripts": "1.6.2",
-    "tinacms": "3.10.1"
+    "@tinacms/scripts": "1.6.3",
+    "tinacms": "3.12.0"
   },
   "peerDependencies": {
-    "tinacms": "3.10.1"
+    "tinacms": "^3.12.0"
   },
   "publishConfig": {
     "registry": "https://registry.npmjs.org"