payload 3.41.0-canary.1 → 3.41.0-internal.8617025

package/dist/uploads/getExternalFile.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"getExternalFile.d.ts","sourceRoot":"","sources":["../../src/uploads/getExternalFile.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAA;AACvD,OAAO,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,YAAY,CAAA;AAI9D,KAAK,IAAI,GAAG;IACV,IAAI,EAAE,QAAQ,CAAA;IACd,GAAG,EAAE,cAAc,CAAA;IACnB,YAAY,EAAE,YAAY,CAAA;CAC3B,CAAA;AACD,eAAO,MAAM,eAAe,gCAAuC,IAAI,KAAG,OAAO,CAAC,IAAI,CAmCrF,CAAA"}
+{"version":3,"file":"getExternalFile.d.ts","sourceRoot":"","sources":["../../src/uploads/getExternalFile.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAA;AACvD,OAAO,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,YAAY,CAAA;AAI9D,KAAK,IAAI,GAAG;IACV,IAAI,EAAE,QAAQ,CAAA;IACd,GAAG,EAAE,cAAc,CAAA;IACnB,YAAY,EAAE,YAAY,CAAA;CAC3B,CAAA;AACD,eAAO,MAAM,eAAe,gCAAuC,IAAI,KAAG,OAAO,CAAC,IAAI,CAyCrF,CAAA"}

package/dist/uploads/getExternalFile.js

@@ -1,4 +1,4 @@
-// @ts-strict-ignore
+import ssrfFilter from 'ssrf-req-filter';
 import { APIError } from '../errors/index.js';
 export const getExternalFile = async ({ data, req, uploadConfig })=>{
     const { filename, url } = data;
@@ -8,6 +8,13 @@ export const getExternalFile = async ({ data, req, uploadConfig })=>{
             const baseUrl = req.headers.get('origin') || `${req.protocol}://${req.headers.get('host')}`;
             fileURL = `${baseUrl}${url}`;
         }
+        try {
+            ssrfFilter({
+                url: fileURL
+            });
+        } catch (error) {
+            throw new APIError(`Failed to fetch file from filtered url, ${fileURL}`, 400);
+        }
         const headers = uploadConfig.externalFileHeaderFilter ? uploadConfig.externalFileHeaderFilter(Object.fromEntries(new Headers(req.headers))) : {
             cookie: req.headers?.get('cookie')
         };

package/dist/uploads/getExternalFile.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/uploads/getExternalFile.ts"],"sourcesContent":["// @ts-strict-ignore\nimport type { PayloadRequest } from '../types/index.js'\nimport type { File, FileData, UploadConfig } from './types.js'\n\nimport { APIError } from '../errors/index.js'\n\ntype Args = {\n  data: FileData\n  req: PayloadRequest\n  uploadConfig: UploadConfig\n}\nexport const getExternalFile = async ({ data, req, uploadConfig }: Args): Promise<File> => {\n  const { filename, url } = data\n\n  if (typeof url === 'string') {\n    let fileURL = url\n    if (!url.startsWith('http')) {\n      const baseUrl = req.headers.get('origin') || `${req.protocol}://${req.headers.get('host')}`\n      fileURL = `${baseUrl}${url}`\n    }\n\n    const headers = uploadConfig.externalFileHeaderFilter\n      ? uploadConfig.externalFileHeaderFilter(Object.fromEntries(new Headers(req.headers)))\n      : { cookie: req.headers?.get('cookie') }\n\n    const res = await fetch(fileURL, {\n      credentials: 'include',\n      headers,\n      method: 'GET',\n    })\n\n    if (!res.ok) {\n      throw new APIError(`Failed to fetch file from ${fileURL}`, res.status)\n    }\n\n    const data = await res.arrayBuffer()\n\n    return {\n      name: filename,\n      data: Buffer.from(data),\n      mimetype: res.headers.get('content-type') || undefined,\n      size: Number(res.headers.get('content-length')) || 0,\n    }\n  }\n\n  throw new APIError('Invalid file url', 400)\n}\n"],"names":["APIError","getExternalFile","data","req","uploadConfig","filename","url","fileURL","startsWith","baseUrl","headers","get","protocol","externalFileHeaderFilter","Object","fromEntries","Headers","cookie","res","fetch","credentials","method","ok","status","arrayBuffer","name","Buffer","from","mimetype","undefined","size","Number"],"mappings":"AAAA,oBAAoB;AAIpB,SAASA,QAAQ,QAAQ,qBAAoB;AAO7C,OAAO,MAAMC,kBAAkB,OAAO,EAAEC,IAAI,EAAEC,GAAG,EAAEC,YAAY,EAAQ;IACrE,MAAM,EAAEC,QAAQ,EAAEC,GAAG,EAAE,GAAGJ;IAE1B,IAAI,OAAOI,QAAQ,UAAU;QAC3B,IAAIC,UAAUD;QACd,IAAI,CAACA,IAAIE,UAAU,CAAC,SAAS;YAC3B,MAAMC,UAAUN,IAAIO,OAAO,CAACC,GAAG,CAAC,aAAa,GAAGR,IAAIS,QAAQ,CAAC,GAAG,EAAET,IAAIO,OAAO,CAACC,GAAG,CAAC,SAAS;YAC3FJ,UAAU,GAAGE,UAAUH,KAAK;QAC9B;QAEA,MAAMI,UAAUN,aAAaS,wBAAwB,GACjDT,aAAaS,wBAAwB,CAACC,OAAOC,WAAW,CAAC,IAAIC,QAAQb,IAAIO,OAAO,MAChF;YAAEO,QAAQd,IAAIO,OAAO,EAAEC,IAAI;QAAU;QAEzC,MAAMO,MAAM,MAAMC,MAAMZ,SAAS;YAC/Ba,aAAa;YACbV;YACAW,QAAQ;QACV;QAEA,IAAI,CAACH,IAAII,EAAE,EAAE;YACX,MAAM,IAAItB,SAAS,CAAC,0BAA0B,EAAEO,SAAS,EAAEW,IAAIK,MAAM;QACvE;QAEA,MAAMrB,OAAO,MAAMgB,IAAIM,WAAW;QAElC,OAAO;YACLC,MAAMpB;YACNH,MAAMwB,OAAOC,IAAI,CAACzB;YAClB0B,UAAUV,IAAIR,OAAO,CAACC,GAAG,CAAC,mBAAmBkB;YAC7CC,MAAMC,OAAOb,IAAIR,OAAO,CAACC,GAAG,CAAC,sBAAsB;QACrD;IACF;IAEA,MAAM,IAAIX,SAAS,oBAAoB;AACzC,EAAC"}
+{"version":3,"sources":["../../src/uploads/getExternalFile.ts"],"sourcesContent":["import ssrfFilter from 'ssrf-req-filter'\n\n// @ts-strict-ignore\nimport type { PayloadRequest } from '../types/index.js'\nimport type { File, FileData, UploadConfig } from './types.js'\n\nimport { APIError } from '../errors/index.js'\n\ntype Args = {\n  data: FileData\n  req: PayloadRequest\n  uploadConfig: UploadConfig\n}\nexport const getExternalFile = async ({ data, req, uploadConfig }: Args): Promise<File> => {\n  const { filename, url } = data\n\n  if (typeof url === 'string') {\n    let fileURL = url\n    if (!url.startsWith('http')) {\n      const baseUrl = req.headers.get('origin') || `${req.protocol}://${req.headers.get('host')}`\n      fileURL = `${baseUrl}${url}`\n    }\n\n    try {\n      ssrfFilter({ url: fileURL })\n    } catch (error) {\n      throw new APIError(`Failed to fetch file from filtered url, ${fileURL}`, 400)\n    }\n\n    const headers = uploadConfig.externalFileHeaderFilter\n      ? uploadConfig.externalFileHeaderFilter(Object.fromEntries(new Headers(req.headers)))\n      : { cookie: req.headers?.get('cookie') }\n\n    const res = await fetch(fileURL, {\n      credentials: 'include',\n      headers,\n      method: 'GET',\n    })\n\n    if (!res.ok) {\n      throw new APIError(`Failed to fetch file from ${fileURL}`, res.status)\n    }\n\n    const data = await res.arrayBuffer()\n\n    return {\n      name: filename,\n      data: Buffer.from(data),\n      mimetype: res.headers.get('content-type') || undefined,\n      size: Number(res.headers.get('content-length')) || 0,\n    }\n  }\n\n  throw new APIError('Invalid file url', 400)\n}\n"],"names":["ssrfFilter","APIError","getExternalFile","data","req","uploadConfig","filename","url","fileURL","startsWith","baseUrl","headers","get","protocol","error","externalFileHeaderFilter","Object","fromEntries","Headers","cookie","res","fetch","credentials","method","ok","status","arrayBuffer","name","Buffer","from","mimetype","undefined","size","Number"],"mappings":"AAAA,OAAOA,gBAAgB,kBAAiB;AAMxC,SAASC,QAAQ,QAAQ,qBAAoB;AAO7C,OAAO,MAAMC,kBAAkB,OAAO,EAAEC,IAAI,EAAEC,GAAG,EAAEC,YAAY,EAAQ;IACrE,MAAM,EAAEC,QAAQ,EAAEC,GAAG,EAAE,GAAGJ;IAE1B,IAAI,OAAOI,QAAQ,UAAU;QAC3B,IAAIC,UAAUD;QACd,IAAI,CAACA,IAAIE,UAAU,CAAC,SAAS;YAC3B,MAAMC,UAAUN,IAAIO,OAAO,CAACC,GAAG,CAAC,aAAa,GAAGR,IAAIS,QAAQ,CAAC,GAAG,EAAET,IAAIO,OAAO,CAACC,GAAG,CAAC,SAAS;YAC3FJ,UAAU,GAAGE,UAAUH,KAAK;QAC9B;QAEA,IAAI;YACFP,WAAW;gBAAEO,KAAKC;YAAQ;QAC5B,EAAE,OAAOM,OAAO;YACd,MAAM,IAAIb,SAAS,CAAC,wCAAwC,EAAEO,SAAS,EAAE;QAC3E;QAEA,MAAMG,UAAUN,aAAaU,wBAAwB,GACjDV,aAAaU,wBAAwB,CAACC,OAAOC,WAAW,CAAC,IAAIC,QAAQd,IAAIO,OAAO,MAChF;YAAEQ,QAAQf,IAAIO,OAAO,EAAEC,IAAI;QAAU;QAEzC,MAAMQ,MAAM,MAAMC,MAAMb,SAAS;YAC/Bc,aAAa;YACbX;YACAY,QAAQ;QACV;QAEA,IAAI,CAACH,IAAII,EAAE,EAAE;YACX,MAAM,IAAIvB,SAAS,CAAC,0BAA0B,EAAEO,SAAS,EAAEY,IAAIK,MAAM;QACvE;QAEA,MAAMtB,OAAO,MAAMiB,IAAIM,WAAW;QAElC,OAAO;YACLC,MAAMrB;YACNH,MAAMyB,OAAOC,IAAI,CAAC1B;YAClB2B,UAAUV,IAAIT,OAAO,CAACC,GAAG,CAAC,mBAAmBmB;YAC7CC,MAAMC,OAAOb,IAAIT,OAAO,CAACC,GAAG,CAAC,sBAAsB;QACrD;IACF;IAEA,MAAM,IAAIX,SAAS,oBAAoB;AACzC,EAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "payload",
-  "version": "3.41.0-canary.1",
+  "version": "3.41.0-internal.8617025",
   "description": "Node, React, Headless CMS and Application Framework built on Next.js",
   "keywords": [
     "admin panel",
@@ -95,11 +95,12 @@
     "qs-esm": "7.0.2",
     "sanitize-filename": "1.6.3",
     "scmp": "2.1.0",
+    "ssrf-req-filter": "1.1.1",
     "ts-essentials": "10.0.3",
     "tsx": "4.19.2",
     "uuid": "10.0.0",
     "ws": "^8.16.0",
-    "@payloadcms/translations": "3.41.0-canary.1"
+    "@payloadcms/translations": "3.41.0-internal.8617025"
   },
   "devDependencies": {
     "@hyrious/esbuild-plugin-commonjs": "^0.2.4",