next-tinacms-dos 23.0.2 → 23.0.4

package/dist/handlers.js

@@ -5,9 +5,87 @@ import {
   PutObjectCommand,
   DeleteObjectCommand
 } from "@aws-sdk/client-s3";
-import path from "path";
+import path2 from "path";
 import fs from "fs";
 import multer from "multer";
+
+// src/media-key.ts
+import path from "node:path";
+var MediaKeyError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "MediaKeyError";
+  }
+};
+function stripSlashes(value) {
+  let start = 0;
+  let end = value.length;
+  while (start < end && value[start] === "/") start++;
+  while (end > start && value[end - 1] === "/") end--;
+  return value.slice(start, end);
+}
+function normalizeMediaRoot(mediaRoot) {
+  if (!mediaRoot) {
+    return "";
+  }
+  return stripSlashes(mediaRoot);
+}
+function resolveKey(mediaRoot, rawKey, options) {
+  if (typeof rawKey !== "string" || rawKey.trim() === "") {
+    throw new MediaKeyError("a media key is required");
+  }
+  let decoded;
+  if (options?.decode === false) {
+    decoded = rawKey;
+  } else {
+    try {
+      decoded = decodeURIComponent(rawKey);
+    } catch {
+      throw new MediaKeyError("media key is not valid");
+    }
+  }
+  if (decoded.includes("\0") || decoded.includes("\\")) {
+    throw new MediaKeyError("media key is not valid");
+  }
+  if (decoded.startsWith("/") || /^[a-zA-Z]:/.test(decoded)) {
+    throw new MediaKeyError("absolute media keys are not allowed");
+  }
+  const normalized = path.posix.normalize(decoded).replace(/^\.\//, "");
+  if (normalized === ".." || normalized.startsWith("../")) {
+    throw new MediaKeyError("media key may not traverse directories");
+  }
+  if (normalized === "" || normalized === ".") {
+    throw new MediaKeyError("a media key is required");
+  }
+  const root = normalizeMediaRoot(mediaRoot);
+  if (!root) {
+    return normalized;
+  }
+  const scoped = normalized === root || normalized.startsWith(root + "/") ? normalized : path.posix.join(root, normalized);
+  if (scoped !== root && !scoped.startsWith(root + "/")) {
+    throw new MediaKeyError("media key escapes mediaRoot");
+  }
+  return scoped;
+}
+function resolveDirectory(rawDirectory) {
+  if (typeof rawDirectory !== "string" || rawDirectory.trim() === "") {
+    return "";
+  }
+  if (rawDirectory.includes("\0") || rawDirectory.includes("\\")) {
+    throw new MediaKeyError("media directory is not valid");
+  }
+  const trimmed = stripSlashes(rawDirectory);
+  const normalized = path.posix.normalize(trimmed).replace(/^\.\//, "");
+  if (normalized === ".." || normalized.startsWith("../")) {
+    throw new MediaKeyError("media directory may not traverse directories");
+  }
+  if (normalized === "" || normalized === ".") {
+    return "";
+  }
+  return normalized + "/";
+}
+
+// src/handlers.ts
 import { promisify } from "util";
 var mediaHandlerConfig = {
   api: {
@@ -40,7 +118,7 @@ var createMediaHandler = (config, options) => {
       case "POST":
         return uploadMedia(req, res, client, bucket, mediaRoot, cdnUrl);
       case "DELETE":
-        return deleteAsset(req, res, client, bucket);
+        return deleteAsset(req, res, client, bucket, mediaRoot);
       default:
         res.end(404);
     }
@@ -68,10 +146,19 @@ async function uploadMedia(req, res, client, bucket, mediaRoot, cdnUrl) {
   const filePath = req.file.path;
   const fileType = req.file?.mimetype;
   const blob = fs.readFileSync(filePath);
-  const filename = path.basename(filePath);
+  const filename = path2.basename(filePath);
+  let objectKey;
+  try {
+    objectKey = resolveKey(mediaRoot, prefix + filename, { decode: false });
+  } catch (e) {
+    if (e instanceof MediaKeyError) {
+      return res.status(400).json({ message: e.message });
+    }
+    throw e;
+  }
   const params = {
     Bucket: bucket,
-    Key: mediaRoot ? path.join(mediaRoot, prefix + filename) : prefix + filename,
+    Key: objectKey,
     Body: blob,
     ACL: "public-read",
     ContentType: fileType || "application/octet-stream"
@@ -90,7 +177,7 @@ async function uploadMedia(req, res, client, bucket, mediaRoot, cdnUrl) {
         "400x400": src,
         "1000x1000": src
       },
-      src: cdnUrl + (mediaRoot ? path.join(mediaRoot, prefix + filename) : prefix + filename)
+      src: cdnUrl + objectKey
     });
   } catch (e) {
     console.error("Error uploading media");
@@ -121,12 +208,20 @@ async function listMedia(req, res, client, bucket, mediaRoot, cdnUrl) {
       limit = 500,
       offset
     } = req.query;
-    let prefix = directory.replace(/^\//, "").replace(/\/$/, "");
-    if (prefix) prefix = prefix + "/";
+    let prefix;
+    try {
+      prefix = resolveDirectory(directory);
+    } catch (e) {
+      if (e instanceof MediaKeyError) {
+        res.status(400).json({ message: e.message });
+        return;
+      }
+      throw e;
+    }
     const params = {
       Bucket: bucket,
       Delimiter: "/",
-      Prefix: mediaRoot ? path.join(mediaRoot, prefix) : prefix,
+      Prefix: mediaRoot ? path2.join(mediaRoot, prefix) : prefix,
       Marker: offset?.toString(),
       MaxKeys: directory && !offset ? +limit + 1 : +limit
     };
@@ -140,8 +235,8 @@ async function listMedia(req, res, client, bucket, mediaRoot, cdnUrl) {
       items.push({
         id: Prefix,
         type: "dir",
-        filename: path.basename(strippedPrefix),
-        directory: path.dirname(strippedPrefix)
+        filename: path2.basename(strippedPrefix),
+        directory: path2.dirname(strippedPrefix)
       });
     });
     items.push(
@@ -168,12 +263,21 @@ var findErrorMessage = (e) => {
   if (e.error && e.error.message) return e.error.message;
   return "an error occurred";
 };
-async function deleteAsset(req, res, client, bucket) {
+async function deleteAsset(req, res, client, bucket, mediaRoot) {
   const { media } = req.query;
-  let [, objectKey] = media;
+  let [, rawKey] = media;
   const objectKeyIsSplit = media && media.length > 2 && typeof media !== "string";
   if (objectKeyIsSplit) {
-    objectKey = media.slice(1).join("/");
+    rawKey = media.slice(1).join("/");
+  }
+  let objectKey;
+  try {
+    objectKey = resolveKey(mediaRoot, rawKey, { decode: false });
+  } catch (e) {
+    if (e instanceof MediaKeyError) {
+      return res.status(400).json({ message: e.message });
+    }
+    throw e;
   }
   const params = {
     Bucket: bucket,
@@ -193,8 +297,8 @@ async function deleteAsset(req, res, client, bucket) {
 function getDOSToTinaFunc(cdnUrl, mediaRoot) {
   return function dosToTina(file) {
     const strippedKey = stripMediaRoot(mediaRoot, file.Key);
-    const filename = path.basename(strippedKey);
-    const directory = path.dirname(strippedKey) + "/";
+    const filename = path2.basename(strippedKey);
+    const directory = path2.dirname(strippedKey) + "/";
     const src = cdnUrl + file.Key;
     return {
       id: file.Key,

package/dist/media-key.d.ts

@@ -0,0 +1,26 @@
+export declare class MediaKeyError extends Error {
+    constructor(message: string);
+}
+/**
+ * Resolve a caller-supplied media key against the configured mediaRoot.
+ *
+ * @throws {MediaKeyError} when the key is empty, absolute, contains a NUL
+ * byte, uses path traversal, or escapes mediaRoot.
+ */
+export declare function resolveKey(mediaRoot: string, rawKey: unknown, options?: {
+    decode?: boolean;
+}): string;
+/**
+ * Resolve a caller-supplied listing directory into a relative prefix.
+ *
+ * The directory is optional: an empty / root directory returns `''` (list the
+ * mediaRoot itself). Otherwise leading/trailing slashes are stripped (matching
+ * the historical handler behaviour) and the result is normalised so it cannot
+ * traverse upward — `path.join(mediaRoot, directory)` would otherwise collapse
+ * `..` and list objects outside mediaRoot. Returns a prefix with a trailing
+ * slash so it can be joined onto mediaRoot directly.
+ *
+ * @throws {MediaKeyError} when the directory contains a NUL byte or backslash,
+ * or uses upward path traversal.
+ */
+export declare function resolveDirectory(rawDirectory: unknown): string;

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "next-tinacms-dos",
   "type": "module",
-  "version": "23.0.2",
+  "version": "23.0.4",
   "main": "dist/index.js",
   "module": "./dist/index.js",
   "files": [
@@ -19,7 +19,7 @@
     ]
   },
   "peerDependencies": {
-    "tinacms": "3.9.2"
+    "tinacms": "3.9.4"
   },
   "devDependencies": {
     "@types/crypto-js": "^3.1.47",
@@ -29,8 +29,8 @@
     "react": "^18.3.1",
     "react-dom": "^18.3.1",
     "typescript": "^5.7.3",
-    "@tinacms/scripts": "1.6.1",
-    "tinacms": "3.9.2"
+    "tinacms": "3.9.4",
+    "@tinacms/scripts": "1.6.2"
   },
   "publishConfig": {
     "registry": "https://registry.npmjs.org"