next-tinacms-s3 23.0.3 → 23.0.4

package/dist/handlers.js

@@ -7,7 +7,85 @@ import {
   HeadObjectCommand
 } from "@aws-sdk/client-s3";
 import { getSignedUrl } from "@aws-sdk/s3-request-presigner";
+import path2 from "node:path";
+
+// src/media-key.ts
 import path from "node:path";
+var MediaKeyError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "MediaKeyError";
+  }
+};
+function stripSlashes(value) {
+  let start = 0;
+  let end = value.length;
+  while (start < end && value[start] === "/") start++;
+  while (end > start && value[end - 1] === "/") end--;
+  return value.slice(start, end);
+}
+function normalizeMediaRoot(mediaRoot) {
+  if (!mediaRoot) {
+    return "";
+  }
+  return stripSlashes(mediaRoot);
+}
+function resolveKey(mediaRoot, rawKey, options) {
+  if (typeof rawKey !== "string" || rawKey.trim() === "") {
+    throw new MediaKeyError("a media key is required");
+  }
+  let decoded;
+  if (options?.decode === false) {
+    decoded = rawKey;
+  } else {
+    try {
+      decoded = decodeURIComponent(rawKey);
+    } catch {
+      throw new MediaKeyError("media key is not valid");
+    }
+  }
+  if (decoded.includes("\0") || decoded.includes("\\")) {
+    throw new MediaKeyError("media key is not valid");
+  }
+  if (decoded.startsWith("/") || /^[a-zA-Z]:/.test(decoded)) {
+    throw new MediaKeyError("absolute media keys are not allowed");
+  }
+  const normalized = path.posix.normalize(decoded).replace(/^\.\//, "");
+  if (normalized === ".." || normalized.startsWith("../")) {
+    throw new MediaKeyError("media key may not traverse directories");
+  }
+  if (normalized === "" || normalized === ".") {
+    throw new MediaKeyError("a media key is required");
+  }
+  const root = normalizeMediaRoot(mediaRoot);
+  if (!root) {
+    return normalized;
+  }
+  const scoped = normalized === root || normalized.startsWith(root + "/") ? normalized : path.posix.join(root, normalized);
+  if (scoped !== root && !scoped.startsWith(root + "/")) {
+    throw new MediaKeyError("media key escapes mediaRoot");
+  }
+  return scoped;
+}
+function resolveDirectory(rawDirectory) {
+  if (typeof rawDirectory !== "string" || rawDirectory.trim() === "") {
+    return "";
+  }
+  if (rawDirectory.includes("\0") || rawDirectory.includes("\\")) {
+    throw new MediaKeyError("media directory is not valid");
+  }
+  const trimmed = stripSlashes(rawDirectory);
+  const normalized = path.posix.normalize(trimmed).replace(/^\.\//, "");
+  if (normalized === ".." || normalized.startsWith("../")) {
+    throw new MediaKeyError("media directory may not traverse directories");
+  }
+  if (normalized === "" || normalized === ".") {
+    return "";
+  }
+  return normalized + "/";
+}
+
+// src/handlers.ts
 var mediaHandlerConfig = {
   api: {
     bodyParser: false
@@ -38,10 +116,17 @@ var createMediaHandler = (config, options) => {
     switch (req.method) {
       case "GET":
         if (req.query.key) {
-          const expiresIn = req.query.expiresIn && Number(req.query.expiresIn) || 3600;
-          const s3_key = req.query.key ? Array.isArray(req.query.key) ? req.query.key[0] : req.query.key : null;
-          if (!s3_key) {
-            return res.status(400).json({ message: "key is required" });
+          const requestedExpiresIn = Number(req.query.expiresIn);
+          const expiresIn = Number.isFinite(requestedExpiresIn) && requestedExpiresIn > 0 ? Math.min(requestedExpiresIn, 3600) : 3600;
+          const rawKey = Array.isArray(req.query.key) ? req.query.key[0] : req.query.key;
+          let s3_key;
+          try {
+            s3_key = resolveKey(mediaRoot, rawKey, { decode: false });
+          } catch (e) {
+            if (e instanceof MediaKeyError) {
+              return res.status(400).json({ message: e.message });
+            }
+            throw e;
           }
           if (await keyExists(client, bucket, s3_key)) {
             return res.status(400).json({ message: "key already exists" });
@@ -56,7 +141,7 @@ var createMediaHandler = (config, options) => {
         }
         return listMedia(req, res, client, bucket, mediaRoot, cdnUrl);
       case "DELETE":
-        return deleteAsset(req, res, client, bucket);
+        return deleteAsset(req, res, client, bucket, mediaRoot);
       default:
         res.end(404);
     }
@@ -85,12 +170,20 @@ async function listMedia(req, res, client, bucket, mediaRoot, cdnUrl) {
       limit = 500,
       offset
     } = req.query;
-    let prefix = directory.replace(/^\//, "").replace(/\/$/, "");
-    if (prefix) prefix = prefix + "/";
+    let prefix;
+    try {
+      prefix = resolveDirectory(directory);
+    } catch (e) {
+      if (e instanceof MediaKeyError) {
+        res.status(400).json({ message: e.message });
+        return;
+      }
+      throw e;
+    }
     const params = {
       Bucket: bucket,
       Delimiter: "/",
-      Prefix: mediaRoot ? path.join(mediaRoot, prefix) : prefix,
+      Prefix: mediaRoot ? path2.join(mediaRoot, prefix) : prefix,
       Marker: offset?.toString(),
       MaxKeys: directory && !offset ? +limit + 1 : +limit
     };
@@ -105,8 +198,8 @@ async function listMedia(req, res, client, bucket, mediaRoot, cdnUrl) {
       items.push({
         id: Prefix,
         type: "dir",
-        filename: path.basename(strippedPrefix),
-        directory: path.dirname(strippedPrefix)
+        filename: path2.basename(strippedPrefix),
+        directory: path2.dirname(strippedPrefix)
       });
     });
     items.push(
@@ -133,9 +226,18 @@ var findErrorMessage = (e) => {
   if (e.error && e.error.message) return e.error.message;
   return "an error occurred";
 };
-async function deleteAsset(req, res, client, bucket) {
+async function deleteAsset(req, res, client, bucket, mediaRoot) {
   const { media } = req.query;
-  const [, objectKey] = media;
+  const [, rawKey] = media;
+  let objectKey;
+  try {
+    objectKey = resolveKey(mediaRoot, rawKey, { decode: false });
+  } catch (e) {
+    if (e instanceof MediaKeyError) {
+      return res.status(400).json({ message: e.message });
+    }
+    throw e;
+  }
   const params = {
     Bucket: bucket,
     Key: objectKey
@@ -183,8 +285,8 @@ var getUploadUrl = async (bucket, key, expiresIn, client) => {
 function getS3ToTinaFunc(cdnUrl, mediaRoot) {
   return function s3ToTina(file) {
     const strippedKey = stripMediaRoot(mediaRoot, file.Key);
-    const filename = path.basename(strippedKey);
-    const directory = path.dirname(strippedKey) + "/";
+    const filename = path2.basename(strippedKey);
+    const directory = path2.dirname(strippedKey) + "/";
     const src = cdnUrl + file.Key;
     return {
       id: file.Key,

package/dist/media-key.d.ts

@@ -0,0 +1,26 @@
+export declare class MediaKeyError extends Error {
+    constructor(message: string);
+}
+/**
+ * Resolve a caller-supplied media key against the configured mediaRoot.
+ *
+ * @throws {MediaKeyError} when the key is empty, absolute, contains a NUL
+ * byte, uses path traversal, or escapes mediaRoot.
+ */
+export declare function resolveKey(mediaRoot: string, rawKey: unknown, options?: {
+    decode?: boolean;
+}): string;
+/**
+ * Resolve a caller-supplied listing directory into a relative prefix.
+ *
+ * The directory is optional: an empty / root directory returns `''` (list the
+ * mediaRoot itself). Otherwise leading/trailing slashes are stripped (matching
+ * the historical handler behaviour) and the result is normalised so it cannot
+ * traverse upward — `path.join(mediaRoot, directory)` would otherwise collapse
+ * `..` and list objects outside mediaRoot. Returns a prefix with a trailing
+ * slash so it can be joined onto mediaRoot directly.
+ *
+ * @throws {MediaKeyError} when the directory contains a NUL byte or backslash,
+ * or uses upward path traversal.
+ */
+export declare function resolveDirectory(rawDirectory: unknown): string;

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "next-tinacms-s3",
   "type": "module",
-  "version": "23.0.3",
+  "version": "23.0.4",
   "main": "dist/index.js",
   "module": "./dist/index.js",
   "files": [
@@ -27,11 +27,11 @@
     "react": "^18.3.1",
     "react-dom": "^18.3.1",
     "typescript": "^5.7.3",
-    "@tinacms/scripts": "1.6.1",
-    "tinacms": "3.9.3"
+    "@tinacms/scripts": "1.6.2",
+    "tinacms": "3.9.4"
   },
   "peerDependencies": {
-    "tinacms": "3.9.3"
+    "tinacms": "3.9.4"
   },
   "publishConfig": {
     "registry": "https://registry.npmjs.org"