next-tinacms-dos 24.0.4 → 24.0.5
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/handlers.js +49 -0
- package/dist/upload-type.d.ts +6 -0
- package/package.json +3 -3
package/dist/handlers.js
CHANGED
|
@@ -92,6 +92,52 @@ function safeUploadName(originalName) {
|
|
|
92
92
|
return base === "." || base === ".." ? "" : base;
|
|
93
93
|
}
|
|
94
94
|
|
|
95
|
+
// src/upload-type.ts
|
|
96
|
+
var DISALLOWED_UPLOAD_EXTENSIONS = /* @__PURE__ */ new Set([
|
|
97
|
+
// HTML and web archives
|
|
98
|
+
"html",
|
|
99
|
+
"htm",
|
|
100
|
+
"xhtml",
|
|
101
|
+
"xht",
|
|
102
|
+
"shtml",
|
|
103
|
+
"mhtml",
|
|
104
|
+
"mht",
|
|
105
|
+
// XML document types
|
|
106
|
+
"xml",
|
|
107
|
+
"xsl",
|
|
108
|
+
"xslt",
|
|
109
|
+
"xsd",
|
|
110
|
+
"rng",
|
|
111
|
+
"rdf",
|
|
112
|
+
"rss",
|
|
113
|
+
"atom",
|
|
114
|
+
"mathml",
|
|
115
|
+
"wsdl",
|
|
116
|
+
"smil",
|
|
117
|
+
"xul",
|
|
118
|
+
"plist",
|
|
119
|
+
"xbl",
|
|
120
|
+
// Script
|
|
121
|
+
"js",
|
|
122
|
+
"mjs",
|
|
123
|
+
"cjs",
|
|
124
|
+
"ecma"
|
|
125
|
+
]);
|
|
126
|
+
var getFinalExtension = (filename) => {
|
|
127
|
+
const base = ((filename || "").split(/[\\/]/).pop() || "").replace(
|
|
128
|
+
/[.\s]+$/,
|
|
129
|
+
""
|
|
130
|
+
);
|
|
131
|
+
const dot = base.lastIndexOf(".");
|
|
132
|
+
if (dot < 0) return "";
|
|
133
|
+
if (dot === 0) return base.slice(1).toLowerCase();
|
|
134
|
+
return base.slice(dot + 1).toLowerCase();
|
|
135
|
+
};
|
|
136
|
+
var isDisallowedUploadType = (filename) => {
|
|
137
|
+
const name = (filename || "").split(/[\\/]/).pop() || "";
|
|
138
|
+
return DISALLOWED_UPLOAD_EXTENSIONS.has(getFinalExtension(name)) || DISALLOWED_UPLOAD_EXTENSIONS.has(getFinalExtension(name.split(":")[0]));
|
|
139
|
+
};
|
|
140
|
+
|
|
95
141
|
// src/handlers.ts
|
|
96
142
|
import { promisify } from "util";
|
|
97
143
|
var mediaHandlerConfig = {
|
|
@@ -152,6 +198,9 @@ async function uploadMedia(req, res, client, bucket, mediaRoot, cdnUrl) {
|
|
|
152
198
|
const fileType = req.file?.mimetype;
|
|
153
199
|
const blob = fs.readFileSync(filePath);
|
|
154
200
|
const filename = path2.basename(filePath);
|
|
201
|
+
if (isDisallowedUploadType(filename)) {
|
|
202
|
+
return res.status(415).json({ message: "Unsupported file type" });
|
|
203
|
+
}
|
|
155
204
|
let objectKey;
|
|
156
205
|
try {
|
|
157
206
|
objectKey = resolveKey(mediaRoot, prefix + filename, { decode: false });
|
|
@@ -0,0 +1,6 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* True when a filename's final extension is not allowed for media uploads. The
|
|
3
|
+
* part before a colon is checked as well as the whole name, so a Windows
|
|
4
|
+
* alternate-data-stream name like `a.html::$DATA` cannot hide the extension.
|
|
5
|
+
*/
|
|
6
|
+
export declare const isDisallowedUploadType: (filename: string) => boolean;
|
package/package.json
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "next-tinacms-dos",
|
|
3
3
|
"type": "module",
|
|
4
|
-
"version": "24.0.
|
|
4
|
+
"version": "24.0.5",
|
|
5
5
|
"main": "dist/index.js",
|
|
6
6
|
"module": "./dist/index.js",
|
|
7
7
|
"files": [
|
|
@@ -19,7 +19,7 @@
|
|
|
19
19
|
]
|
|
20
20
|
},
|
|
21
21
|
"peerDependencies": {
|
|
22
|
-
"tinacms": "^3.
|
|
22
|
+
"tinacms": "^3.14.3"
|
|
23
23
|
},
|
|
24
24
|
"devDependencies": {
|
|
25
25
|
"@types/js-cookie": "^2.2.7",
|
|
@@ -29,7 +29,7 @@
|
|
|
29
29
|
"react-dom": "^18.3.1",
|
|
30
30
|
"typescript": "^5.7.3",
|
|
31
31
|
"@tinacms/scripts": "1.6.4",
|
|
32
|
-
"tinacms": "3.
|
|
32
|
+
"tinacms": "3.14.3"
|
|
33
33
|
},
|
|
34
34
|
"publishConfig": {
|
|
35
35
|
"registry": "https://registry.npmjs.org"
|