omegon 0.6.32 → 0.7.0

package/node_modules/@smithy/node-http-handler/dist-types/ts3.4/readable.mock.d.ts

@@ -1,5 +1,5 @@
-import { ReadableOptions } from "stream";
-import { Readable } from "stream";
+import { ReadableOptions } from "node:stream";
+import { Readable } from "node:stream";
 export interface ReadFromBuffersOptions extends ReadableOptions {
     buffers: Buffer[];
     errorAfter?: number;

package/node_modules/@smithy/node-http-handler/dist-types/ts3.4/server.mock.d.ts

@@ -1,7 +1,7 @@
 import { HttpResponse } from "@smithy/types";
-import { IncomingMessage, Server as HttpServer, ServerResponse } from "http";
-import { Http2Server } from "http2";
-import { Server as HttpsServer } from "https";
+import { IncomingMessage, Server as HttpServer, ServerResponse } from "node:http";
+import { Http2Server } from "node:http2";
+import { Server as HttpsServer } from "node:https";
 export declare const createResponseFunction: (httpResp: HttpResponse) => (request: IncomingMessage, response: ServerResponse) => void;
 export declare const createResponseFunctionWithDelay: (httpResp: HttpResponse, delay: number) => (request: IncomingMessage, response: ServerResponse) => void;
 export declare const createContinueResponseFunction: (httpResp: HttpResponse) => (request: IncomingMessage, response: ServerResponse) => void;

package/node_modules/@smithy/node-http-handler/dist-types/ts3.4/set-connection-timeout.d.ts

@@ -1,2 +1,2 @@
-import { ClientRequest } from "http";
+import { ClientRequest } from "node:http";
 export declare const setConnectionTimeout: (request: ClientRequest, reject: (err: Error) => void, timeoutInMs?: number) => NodeJS.Timeout | number;

package/node_modules/@smithy/node-http-handler/dist-types/ts3.4/set-request-timeout.d.ts

@@ -1,5 +1,5 @@
 import { Logger } from "@smithy/types";
-import { ClientRequest } from "http";
+import { ClientRequest } from "node:http";
 /**
  * @internal
  */

package/node_modules/@smithy/node-http-handler/dist-types/ts3.4/set-socket-keep-alive.d.ts

@@ -1,4 +1,4 @@
-import { ClientRequest } from "http";
+import { ClientRequest } from "node:http";
 export interface SocketKeepAliveOptions {
     keepAlive: boolean;
     keepAliveMsecs?: number;

package/node_modules/@smithy/node-http-handler/dist-types/ts3.4/set-socket-timeout.d.ts

@@ -1,2 +1,2 @@
-import { ClientRequest } from "http";
+import { ClientRequest } from "node:http";
 export declare const setSocketTimeout: (request: ClientRequest, reject: (err: Error) => void, timeoutInMs?: number) => NodeJS.Timeout | number;

package/node_modules/@smithy/node-http-handler/dist-types/ts3.4/stream-collector/collector.d.ts

@@ -1,4 +1,4 @@
-import { Writable } from "stream";
+import { Writable } from "node:stream";
 export declare class Collector extends Writable {
     readonly bufferedBytes: Buffer[];
     _write(chunk: Buffer, encoding: string, callback: (err?: Error) => void): void;

package/node_modules/@smithy/node-http-handler/dist-types/ts3.4/stream-collector/readable.mock.d.ts

@@ -1,5 +1,5 @@
-import { ReadableOptions } from "stream";
-import { Readable } from "stream";
+import { ReadableOptions } from "node:stream";
+import { Readable } from "node:stream";
 export interface ReadFromBuffersOptions extends ReadableOptions {
     buffers: Buffer[];
     errorAfter?: number;

package/node_modules/@smithy/node-http-handler/dist-types/ts3.4/write-request-body.d.ts

@@ -1,6 +1,6 @@
 import { HttpRequest } from "@smithy/types";
-import { ClientRequest } from "http";
-import { ClientHttp2Stream } from "http2";
+import { ClientRequest } from "node:http";
+import { ClientHttp2Stream } from "node:http2";
 /**
  * This resolves when writeBody has been called.
  *

package/node_modules/@smithy/node-http-handler/dist-types/write-request-body.d.ts

@@ -1,6 +1,6 @@
 import type { HttpRequest } from "@smithy/types";
-import type { ClientRequest } from "http";
-import type { ClientHttp2Stream } from "http2";
+import type { ClientRequest } from "node:http";
+import type { ClientHttp2Stream } from "node:http2";
 /**
  * This resolves when writeBody has been called.
  *

package/node_modules/@smithy/node-http-handler/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@smithy/node-http-handler",
-  "version": "4.4.16",
+  "version": "4.5.0",
   "description": "Provides a way to make requests",
   "scripts": {
     "build": "concurrently 'yarn:build:cjs' 'yarn:build:es' 'yarn:build:types && yarn build:types:downlevel'",

package/node_modules/@smithy/smithy-client/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@smithy/smithy-client",
-  "version": "4.12.5",
+  "version": "4.12.6",
   "scripts": {
     "build": "concurrently 'yarn:build:cjs' 'yarn:build:es' 'yarn:build:types && yarn build:types:downlevel'",
     "build:cjs": "node ../../scripts/inline smithy-client",
@@ -27,12 +27,12 @@
   "license": "Apache-2.0",
   "sideEffects": false,
   "dependencies": {
-    "@smithy/core": "^3.23.11",
-    "@smithy/middleware-endpoint": "^4.4.25",
+    "@smithy/core": "^3.23.12",
+    "@smithy/middleware-endpoint": "^4.4.26",
     "@smithy/middleware-stack": "^4.2.12",
     "@smithy/protocol-http": "^5.3.12",
     "@smithy/types": "^4.13.1",
-    "@smithy/util-stream": "^4.5.19",
+    "@smithy/util-stream": "^4.5.20",
     "tslib": "^2.6.2"
   },
   "engines": {

package/node_modules/@smithy/util-defaults-mode-browser/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@smithy/util-defaults-mode-browser",
-  "version": "4.3.41",
+  "version": "4.3.42",
   "scripts": {
     "build": "concurrently 'yarn:build:cjs' 'yarn:build:es' 'yarn:build:types && yarn build:types:downlevel'",
     "build:cjs": "node ../../scripts/inline util-defaults-mode-browser",
@@ -25,7 +25,7 @@
   "sideEffects": false,
   "dependencies": {
     "@smithy/property-provider": "^4.2.12",
-    "@smithy/smithy-client": "^4.12.5",
+    "@smithy/smithy-client": "^4.12.6",
     "@smithy/types": "^4.13.1",
     "tslib": "^2.6.2"
   },

package/node_modules/@smithy/util-defaults-mode-node/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@smithy/util-defaults-mode-node",
-  "version": "4.2.44",
+  "version": "4.2.45",
   "scripts": {
     "build": "concurrently 'yarn:build:cjs' 'yarn:build:es' 'yarn:build:types && yarn build:types:downlevel'",
     "build:cjs": "node ../../scripts/inline util-defaults-mode-node",
@@ -28,7 +28,7 @@
     "@smithy/credential-provider-imds": "^4.2.12",
     "@smithy/node-config-provider": "^4.3.12",
     "@smithy/property-provider": "^4.2.12",
-    "@smithy/smithy-client": "^4.12.5",
+    "@smithy/smithy-client": "^4.12.6",
     "@smithy/types": "^4.13.1",
     "tslib": "^2.6.2"
   },

package/node_modules/@smithy/util-stream/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@smithy/util-stream",
-  "version": "4.5.19",
+  "version": "4.5.20",
   "scripts": {
     "build": "concurrently 'yarn:build:cjs' 'yarn:build:es' 'yarn:build:types && yarn build:types:downlevel'",
     "build:cjs": "node ../../scripts/inline util-stream",
@@ -30,7 +30,7 @@
   "sideEffects": false,
   "dependencies": {
     "@smithy/fetch-http-handler": "^5.3.15",
-    "@smithy/node-http-handler": "^4.4.16",
+    "@smithy/node-http-handler": "^4.5.0",
     "@smithy/types": "^4.13.1",
     "@smithy/util-base64": "^4.3.2",
     "@smithy/util-buffer-from": "^4.2.2",

package/node_modules/file-type/core.js

@@ -20,18 +20,22 @@ const maximumZipEntrySizeInBytes = 1024 * 1024;
 const maximumZipEntryCount = 1024;
 const maximumZipBufferedReadSizeInBytes = (2 ** 31) - 1;
 const maximumUntrustedSkipSizeInBytes = 16 * 1024 * 1024;
+const maximumUnknownSizePayloadProbeSizeInBytes = maximumZipEntrySizeInBytes;
 const maximumZipTextEntrySizeInBytes = maximumZipEntrySizeInBytes;
 const maximumNestedGzipDetectionSizeInBytes = maximumUntrustedSkipSizeInBytes;
 const maximumNestedGzipProbeDepth = 1;
 const maximumId3HeaderSizeInBytes = maximumUntrustedSkipSizeInBytes;
 const maximumEbmlDocumentTypeSizeInBytes = 64;
-const maximumEbmlElementPayloadSizeInBytes = maximumUntrustedSkipSizeInBytes;
+const maximumEbmlElementPayloadSizeInBytes = maximumUnknownSizePayloadProbeSizeInBytes;
 const maximumEbmlElementCount = 256;
 const maximumPngChunkCount = 512;
+const maximumPngStreamScanBudgetInBytes = maximumUntrustedSkipSizeInBytes;
 const maximumAsfHeaderObjectCount = 512;
 const maximumTiffTagCount = 512;
 const maximumDetectionReentryCount = 256;
-const maximumPngChunkSizeInBytes = maximumUntrustedSkipSizeInBytes;
+const maximumPngChunkSizeInBytes = maximumUnknownSizePayloadProbeSizeInBytes;
+const maximumAsfHeaderPayloadSizeInBytes = maximumUnknownSizePayloadProbeSizeInBytes;
+const maximumTiffStreamIfdOffsetInBytes = maximumUnknownSizePayloadProbeSizeInBytes;
 const maximumTiffIfdOffsetInBytes = maximumUntrustedSkipSizeInBytes;
 const recoverableZipErrorMessages = new Set([
 	'Unexpected signature',
@@ -141,6 +145,10 @@ function findZipDataDescriptorOffset(buffer, bytesConsumed) {
 	return -1;
 }
 
+function isPngAncillaryChunk(type) {
+	return (type.codePointAt(0) & 0x20) !== 0;
+}
+
 function mergeByteChunks(chunks, totalLength) {
 	const merged = new Uint8Array(totalLength);
 	let offset = 0;
@@ -193,6 +201,10 @@ async function readZipDataDescriptorEntryWithLimit(zipHandler, {shouldBuffer, ma
 		}
 	}
 
+	if (!hasUnknownFileSize(zipHandler.tokenizer)) {
+		zipHandler.knownSizeDescriptorScannedBytes += bytesConsumed;
+	}
+
 	if (!shouldBuffer) {
 		return;
 	}
@@ -200,16 +212,30 @@ async function readZipDataDescriptorEntryWithLimit(zipHandler, {shouldBuffer, ma
 	return mergeByteChunks(chunks, bytesConsumed);
 }
 
-async function readZipEntryData(zipHandler, zipHeader, {shouldBuffer} = {}) {
+function getRemainingZipScanBudget(zipHandler, startOffset) {
+	if (hasUnknownFileSize(zipHandler.tokenizer)) {
+		return Math.max(0, maximumUntrustedSkipSizeInBytes - (zipHandler.tokenizer.position - startOffset));
+	}
+
+	return Math.max(0, maximumZipEntrySizeInBytes - zipHandler.knownSizeDescriptorScannedBytes);
+}
+
+async function readZipEntryData(zipHandler, zipHeader, {shouldBuffer, maximumDescriptorLength = maximumZipEntrySizeInBytes} = {}) {
 	if (
 		zipHeader.dataDescriptor
 		&& zipHeader.compressedSize === 0
 	) {
-		return readZipDataDescriptorEntryWithLimit(zipHandler, {shouldBuffer});
+		return readZipDataDescriptorEntryWithLimit(zipHandler, {
+			shouldBuffer,
+			maximumLength: maximumDescriptorLength,
+		});
 	}
 
 	if (!shouldBuffer) {
-		await zipHandler.tokenizer.ignore(zipHeader.compressedSize);
+		await safeIgnore(zipHandler.tokenizer, zipHeader.compressedSize, {
+			maximumLength: hasUnknownFileSize(zipHandler.tokenizer) ? maximumZipEntrySizeInBytes : zipHandler.tokenizer.fileInfo.size,
+			reason: 'ZIP entry compressed data',
+		});
 		return;
 	}
 
@@ -244,7 +270,13 @@ ZipHandler.prototype.inflate = async function (zipHeader, fileData, callback) {
 ZipHandler.prototype.unzip = async function (fileCallback) {
 	let stop = false;
 	let zipEntryCount = 0;
+	const zipScanStart = this.tokenizer.position;
+	this.knownSizeDescriptorScannedBytes = 0;
 	do {
+		if (hasExceededUnknownSizeScanBudget(this.tokenizer, zipScanStart, maximumUntrustedSkipSizeInBytes)) {
+			throw new ParserHardLimitError(`ZIP stream probing exceeds ${maximumUntrustedSkipSizeInBytes} bytes`);
+		}
+
 		const zipHeader = await this.readLocalFileHeader();
 		if (!zipHeader) {
 			break;
@@ -260,6 +292,7 @@ ZipHandler.prototype.unzip = async function (fileCallback) {
 		await this.tokenizer.ignore(zipHeader.extraFieldLength);
 		const fileData = await readZipEntryData(this, zipHeader, {
 			shouldBuffer: Boolean(next.handler),
+			maximumDescriptorLength: Math.min(maximumZipEntrySizeInBytes, getRemainingZipScanBudget(this, zipScanStart)),
 		});
 
 		if (next.handler) {
@@ -273,6 +306,10 @@ ZipHandler.prototype.unzip = async function (fileCallback) {
 				throw new Error(`Expected data-descriptor-signature at position ${this.tokenizer.position - dataDescriptor.length}`);
 			}
 		}
+
+		if (hasExceededUnknownSizeScanBudget(this.tokenizer, zipScanStart, maximumUntrustedSkipSizeInBytes)) {
+			throw new ParserHardLimitError(`ZIP stream probing exceeds ${maximumUntrustedSkipSizeInBytes} bytes`);
+		}
 	} while (!stop);
 };
 
@@ -1001,7 +1038,10 @@ export class FileTypeParser {
 				// Keep ID3 probing bounded for unknown-size streams to avoid attacker-controlled large skips.
 				|| (
 					isUnknownFileSize
-					&& id3HeaderLength > maximumId3HeaderSizeInBytes
+					&& (
+						id3HeaderLength > maximumId3HeaderSizeInBytes
+						|| (tokenizer.position + id3HeaderLength) > maximumId3HeaderSizeInBytes
+					)
 				)
 			) {
 				return;
@@ -1454,6 +1494,10 @@ export class FileTypeParser {
 						return;
 					}
 
+					if (hasExceededUnknownSizeScanBudget(tokenizer, ebmlScanStart, maximumUntrustedSkipSizeInBytes)) {
+						return;
+					}
+
 					const previousPosition = tokenizer.position;
 					const element = await readElement();
 
@@ -1493,6 +1537,7 @@ export class FileTypeParser {
 			}
 
 			const rootElement = await readElement();
+			const ebmlScanStart = tokenizer.position;
 			const documentType = await readChildren(rootElement.len);
 
 			switch (documentType) {
@@ -1875,13 +1920,14 @@ export class FileTypeParser {
 			const isUnknownPngStream = hasUnknownFileSize(tokenizer);
 			const pngScanStart = tokenizer.position;
 			let pngChunkCount = 0;
+			let hasSeenImageHeader = false;
 			do {
 				pngChunkCount++;
 				if (pngChunkCount > maximumPngChunkCount) {
 					break;
 				}
 
-				if (hasExceededUnknownSizeScanBudget(tokenizer, pngScanStart, maximumPngChunkSizeInBytes)) {
+				if (hasExceededUnknownSizeScanBudget(tokenizer, pngScanStart, maximumPngStreamScanBudgetInBytes)) {
 					break;
 				}
 
@@ -1891,18 +1937,34 @@ export class FileTypeParser {
 					return; // Invalid chunk length
 				}
 
+				if (chunk.type === 'IHDR') {
+					// PNG requires the first real image header to be a 13-byte IHDR chunk.
+					if (chunk.length !== 13) {
+						return;
+					}
+
+					hasSeenImageHeader = true;
+				}
+
 				switch (chunk.type) {
 					case 'IDAT':
 						return pngFileType;
 					case 'acTL':
 						return apngFileType;
 					default:
+						if (
+							!hasSeenImageHeader
+							&& chunk.type !== 'CgBI'
+						) {
+							return;
+						}
+
 						if (
 							isUnknownPngStream
 								&& chunk.length > maximumPngChunkSizeInBytes
 						) {
 							// Avoid huge attacker-controlled skips when probing unknown-size streams.
-							return;
+							return hasSeenImageHeader && isPngAncillaryChunk(chunk.type) ? pngFileType : undefined;
 						}
 
 						try {
@@ -2158,8 +2220,16 @@ export class FileTypeParser {
 						break;
 					}
 
+					if (
+						isUnknownFileSize
+						&& payload > maximumAsfHeaderPayloadSizeInBytes
+					) {
+						isMalformedAsf = true;
+						break;
+					}
+
 					await safeIgnore(tokenizer, payload, {
-						maximumLength: isUnknownFileSize ? maximumUntrustedSkipSizeInBytes : tokenizer.fileInfo.size,
+						maximumLength: isUnknownFileSize ? maximumAsfHeaderPayloadSizeInBytes : tokenizer.fileInfo.size,
 						reason: 'ASF header payload',
 					});
 
@@ -2625,6 +2695,13 @@ export class FileTypeParser {
 				}
 			}
 
+			if (
+				hasUnknownFileSize(this.tokenizer)
+				&& ifdOffset > maximumTiffStreamIfdOffsetInBytes
+			) {
+				return tiffFileType;
+			}
+
 			const maximumTiffOffset = hasUnknownFileSize(this.tokenizer) ? maximumTiffIfdOffsetInBytes : this.tokenizer.fileInfo.size;
 
 			try {

package/node_modules/file-type/index.js

@@ -4,6 +4,8 @@ Node.js specific entry point.
 
 import {ReadableStream as WebReadableStream} from 'node:stream/web';
 import {pipeline, PassThrough, Readable} from 'node:stream';
+import fs from 'node:fs/promises';
+import {constants as fileSystemConstants} from 'node:fs';
 import * as strtok3 from 'strtok3';
 import {
 	FileTypeParser as DefaultFileTypeParser,
@@ -42,7 +44,21 @@ export class FileTypeParser extends DefaultFileTypeParser {
 	}
 
 	async fromFile(path) {
-		const tokenizer = await strtok3.fromFile(path);
+		// TODO: Remove this when `strtok3.fromFile()` safely rejects non-regular filesystem objects without a pathname race.
+		const fileHandle = await fs.open(path, fileSystemConstants.O_RDONLY | fileSystemConstants.O_NONBLOCK);
+		const fileStat = await fileHandle.stat();
+		if (!fileStat.isFile()) {
+			await fileHandle.close();
+			return;
+		}
+
+		const tokenizer = new strtok3.FileTokenizer(fileHandle, {
+			...this.getTokenizerOptions(),
+			fileInfo: {
+				path,
+				size: fileStat.size,
+			},
+		});
 		try {
 			return await super.fromTokenizer(tokenizer);
 		} finally {

package/node_modules/file-type/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "file-type",
-	"version": "21.3.2",
+	"version": "21.3.3",
 	"description": "Detect the file type of a file, stream, or data",
 	"license": "MIT",
 	"repository": "sindresorhus/file-type",

package/node_modules/file-type/readme.md

@@ -10,6 +10,9 @@ This package is for detecting binary-based file formats, not text-based formats
 
 We accept contributions for commonly used modern file formats, not historical or obscure ones. Open an issue first for discussion.
 
+> [!IMPORTANT]
+> NO SECURITY REPORTS WILL BE ACCEPTED RIGHT NOW. I'm currently hardening the parser and all the low-quality AI-generated security reports is just a huge waste of time.
+
 ## Install
 
 ```sh