payload 3.89.0 → 3.90.1

package/dist/uploads/validateISOBaseMediaFile.spec.js

@@ -0,0 +1,130 @@
+import fs from 'fs/promises';
+import { randomUUID } from 'crypto';
+import { fileTypeFromBuffer } from 'file-type';
+import os from 'os';
+import path from 'path';
+import { afterEach, describe, expect, it } from 'vitest';
+import { isISOBaseMediaMimeType, validateISOBaseMediaBuffer, validateISOBaseMediaFile } from './validateISOBaseMediaFile.js';
+const tempFiles = [];
+const box = (type, content = Buffer.alloc(0), size = content.length + 8)=>{
+    const header = Buffer.alloc(8);
+    header.writeUInt32BE(size);
+    header.write(type, 4, 4, 'latin1');
+    return Buffer.concat([
+        header,
+        content
+    ]);
+};
+const extendedBox = (type, content)=>{
+    const header = Buffer.alloc(16);
+    header.writeUInt32BE(1);
+    header.write(type, 4, 4, 'latin1');
+    header.writeBigUInt64BE(BigInt(content.length + 16), 8);
+    return Buffer.concat([
+        header,
+        content
+    ]);
+};
+const fileTypeContent = (brand = 'avif')=>{
+    const content = Buffer.alloc(12);
+    content.write(brand, 0, 4, 'latin1');
+    content.write(brand, 8, 4, 'latin1');
+    return content;
+};
+const validFile = (brand = 'avif')=>Buffer.concat([
+        box('ftyp', fileTypeContent(brand)),
+        box('free')
+    ]);
+afterEach(async ()=>{
+    await Promise.all(tempFiles.splice(0).map((filePath)=>fs.unlink(filePath)));
+});
+describe('ISO base media file validation', ()=>{
+    it.each([
+        'audio/mp4',
+        'audio/x-m4a',
+        'image/avif',
+        'image/heic',
+        'image/heic-sequence',
+        'image/heif',
+        'image/heif-sequence',
+        'image/x-canon-cr3',
+        'video/3gpp',
+        'video/3gpp2',
+        'video/mp4',
+        'video/quicktime',
+        'video/x-m4v'
+    ])('should identify %s as an ISO base media type', (mimeType)=>{
+        expect(isISOBaseMediaMimeType(mimeType)).toBe(true);
+    });
+    it('should preserve unrelated media types', ()=>{
+        expect(isISOBaseMediaMimeType('image/png')).toBe(false);
+    });
+    it('should accept normal and extended file type boxes', async ()=>{
+        await expect(validateISOBaseMediaBuffer(validFile())).resolves.toBe(true);
+        await expect(validateISOBaseMediaBuffer(Buffer.concat([
+            extendedBox('ftyp', fileTypeContent('heic')),
+            box('free')
+        ]))).resolves.toBe(true);
+    });
+    it('should accept a final box that extends to the end of the file', async ()=>{
+        const finalBox = box('mdat', Buffer.from('reference'), 0);
+        await expect(validateISOBaseMediaBuffer(Buffer.concat([
+            box('ftyp', fileTypeContent()),
+            finalBox
+        ]))).resolves.toBe(true);
+    });
+    it.each([
+        'free',
+        'mdat',
+        'moov',
+        'wide'
+    ])('should accept a QuickTime file beginning with %s', async (type)=>{
+        const content = Buffer.concat([
+            box(type),
+            box('mdat', Buffer.from('reference'))
+        ]);
+        await expect(fileTypeFromBuffer(content)).resolves.toMatchObject({
+            mime: 'video/quicktime'
+        });
+        await expect(validateISOBaseMediaBuffer(content)).resolves.toBe(true);
+    });
+    it.each([
+        [
+            'missing following box',
+            box('ftyp', fileTypeContent())
+        ],
+        [
+            'file type box extending to end',
+            box('ftyp', fileTypeContent(), 0)
+        ],
+        [
+            'short file type payload',
+            box('ftyp', Buffer.from('avif'), 12)
+        ],
+        [
+            'unaligned compatible brands',
+            box('ftyp', Buffer.alloc(9), 17)
+        ],
+        [
+            'box extending beyond the file',
+            box('ftyp', fileTypeContent(), 128)
+        ],
+        [
+            'trailing partial header',
+            Buffer.concat([
+                validFile(),
+                Buffer.alloc(4)
+            ])
+        ]
+    ])('should reject %s', async (_, content)=>{
+        await expect(validateISOBaseMediaBuffer(content)).resolves.toBe(false);
+    });
+    it('should validate file-backed uploads without loading the full file', async ()=>{
+        const filePath = path.join(os.tmpdir(), `payload-media-${randomUUID()}`);
+        tempFiles.push(filePath);
+        await fs.writeFile(filePath, validFile('mif1'));
+        await expect(validateISOBaseMediaFile(filePath)).resolves.toBe(true);
+    });
+});
+
+//# sourceMappingURL=validateISOBaseMediaFile.spec.js.map

package/dist/uploads/validateISOBaseMediaFile.spec.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/uploads/validateISOBaseMediaFile.spec.ts"],"sourcesContent":["import fs from 'fs/promises'\nimport { randomUUID } from 'crypto'\nimport { fileTypeFromBuffer } from 'file-type'\nimport os from 'os'\nimport path from 'path'\nimport { afterEach, describe, expect, it } from 'vitest'\n\nimport {\n  isISOBaseMediaMimeType,\n  validateISOBaseMediaBuffer,\n  validateISOBaseMediaFile,\n} from './validateISOBaseMediaFile.js'\n\nconst tempFiles: string[] = []\n\nconst box = (type: string, content = Buffer.alloc(0), size = content.length + 8): Buffer => {\n  const header = Buffer.alloc(8)\n  header.writeUInt32BE(size)\n  header.write(type, 4, 4, 'latin1')\n  return Buffer.concat([header, content])\n}\n\nconst extendedBox = (type: string, content: Buffer): Buffer => {\n  const header = Buffer.alloc(16)\n  header.writeUInt32BE(1)\n  header.write(type, 4, 4, 'latin1')\n  header.writeBigUInt64BE(BigInt(content.length + 16), 8)\n  return Buffer.concat([header, content])\n}\n\nconst fileTypeContent = (brand = 'avif'): Buffer => {\n  const content = Buffer.alloc(12)\n  content.write(brand, 0, 4, 'latin1')\n  content.write(brand, 8, 4, 'latin1')\n  return content\n}\n\nconst validFile = (brand = 'avif'): Buffer =>\n  Buffer.concat([box('ftyp', fileTypeContent(brand)), box('free')])\n\nafterEach(async () => {\n  await Promise.all(tempFiles.splice(0).map((filePath) => fs.unlink(filePath)))\n})\n\ndescribe('ISO base media file validation', () => {\n  it.each([\n    'audio/mp4',\n    'audio/x-m4a',\n    'image/avif',\n    'image/heic',\n    'image/heic-sequence',\n    'image/heif',\n    'image/heif-sequence',\n    'image/x-canon-cr3',\n    'video/3gpp',\n    'video/3gpp2',\n    'video/mp4',\n    'video/quicktime',\n    'video/x-m4v',\n  ])('should identify %s as an ISO base media type', (mimeType) => {\n    expect(isISOBaseMediaMimeType(mimeType)).toBe(true)\n  })\n\n  it('should preserve unrelated media types', () => {\n    expect(isISOBaseMediaMimeType('image/png')).toBe(false)\n  })\n\n  it('should accept normal and extended file type boxes', async () => {\n    await expect(validateISOBaseMediaBuffer(validFile())).resolves.toBe(true)\n    await expect(\n      validateISOBaseMediaBuffer(\n        Buffer.concat([extendedBox('ftyp', fileTypeContent('heic')), box('free')]),\n      ),\n    ).resolves.toBe(true)\n  })\n\n  it('should accept a final box that extends to the end of the file', async () => {\n    const finalBox = box('mdat', Buffer.from('reference'), 0)\n    await expect(\n      validateISOBaseMediaBuffer(Buffer.concat([box('ftyp', fileTypeContent()), finalBox])),\n    ).resolves.toBe(true)\n  })\n\n  it.each(['free', 'mdat', 'moov', 'wide'])(\n    'should accept a QuickTime file beginning with %s',\n    async (type) => {\n      const content = Buffer.concat([box(type), box('mdat', Buffer.from('reference'))])\n      await expect(fileTypeFromBuffer(content)).resolves.toMatchObject({ mime: 'video/quicktime' })\n      await expect(validateISOBaseMediaBuffer(content)).resolves.toBe(true)\n    },\n  )\n\n  it.each([\n    ['missing following box', box('ftyp', fileTypeContent())],\n    ['file type box extending to end', box('ftyp', fileTypeContent(), 0)],\n    ['short file type payload', box('ftyp', Buffer.from('avif'), 12)],\n    ['unaligned compatible brands', box('ftyp', Buffer.alloc(9), 17)],\n    ['box extending beyond the file', box('ftyp', fileTypeContent(), 128)],\n    ['trailing partial header', Buffer.concat([validFile(), Buffer.alloc(4)])],\n  ])('should reject %s', async (_, content) => {\n    await expect(validateISOBaseMediaBuffer(content)).resolves.toBe(false)\n  })\n\n  it('should validate file-backed uploads without loading the full file', async () => {\n    const filePath = path.join(os.tmpdir(), `payload-media-${randomUUID()}`)\n    tempFiles.push(filePath)\n    await fs.writeFile(filePath, validFile('mif1'))\n\n    await expect(validateISOBaseMediaFile(filePath)).resolves.toBe(true)\n  })\n})\n"],"names":["fs","randomUUID","fileTypeFromBuffer","os","path","afterEach","describe","expect","it","isISOBaseMediaMimeType","validateISOBaseMediaBuffer","validateISOBaseMediaFile","tempFiles","box","type","content","Buffer","alloc","size","length","header","writeUInt32BE","write","concat","extendedBox","writeBigUInt64BE","BigInt","fileTypeContent","brand","validFile","Promise","all","splice","map","filePath","unlink","each","mimeType","toBe","resolves","finalBox","from","toMatchObject","mime","_","join","tmpdir","push","writeFile"],"mappings":"AAAA,OAAOA,QAAQ,cAAa;AAC5B,SAASC,UAAU,QAAQ,SAAQ;AACnC,SAASC,kBAAkB,QAAQ,YAAW;AAC9C,OAAOC,QAAQ,KAAI;AACnB,OAAOC,UAAU,OAAM;AACvB,SAASC,SAAS,EAAEC,QAAQ,EAAEC,MAAM,EAAEC,EAAE,QAAQ,SAAQ;AAExD,SACEC,sBAAsB,EACtBC,0BAA0B,EAC1BC,wBAAwB,QACnB,gCAA+B;AAEtC,MAAMC,YAAsB,EAAE;AAE9B,MAAMC,MAAM,CAACC,MAAcC,UAAUC,OAAOC,KAAK,CAAC,EAAE,EAAEC,OAAOH,QAAQI,MAAM,GAAG,CAAC;IAC7E,MAAMC,SAASJ,OAAOC,KAAK,CAAC;IAC5BG,OAAOC,aAAa,CAACH;IACrBE,OAAOE,KAAK,CAACR,MAAM,GAAG,GAAG;IACzB,OAAOE,OAAOO,MAAM,CAAC;QAACH;QAAQL;KAAQ;AACxC;AAEA,MAAMS,cAAc,CAACV,MAAcC;IACjC,MAAMK,SAASJ,OAAOC,KAAK,CAAC;IAC5BG,OAAOC,aAAa,CAAC;IACrBD,OAAOE,KAAK,CAACR,MAAM,GAAG,GAAG;IACzBM,OAAOK,gBAAgB,CAACC,OAAOX,QAAQI,MAAM,GAAG,KAAK;IACrD,OAAOH,OAAOO,MAAM,CAAC;QAACH;QAAQL;KAAQ;AACxC;AAEA,MAAMY,kBAAkB,CAACC,QAAQ,MAAM;IACrC,MAAMb,UAAUC,OAAOC,KAAK,CAAC;IAC7BF,QAAQO,KAAK,CAACM,OAAO,GAAG,GAAG;IAC3Bb,QAAQO,KAAK,CAACM,OAAO,GAAG,GAAG;IAC3B,OAAOb;AACT;AAEA,MAAMc,YAAY,CAACD,QAAQ,MAAM,GAC/BZ,OAAOO,MAAM,CAAC;QAACV,IAAI,QAAQc,gBAAgBC;QAASf,IAAI;KAAQ;AAElER,UAAU;IACR,MAAMyB,QAAQC,GAAG,CAACnB,UAAUoB,MAAM,CAAC,GAAGC,GAAG,CAAC,CAACC,WAAalC,GAAGmC,MAAM,CAACD;AACpE;AAEA5B,SAAS,kCAAkC;IACzCE,GAAG4B,IAAI,CAAC;QACN;QACA;QACA;QACA;QACA;QACA;QACA;QACA;QACA;QACA;QACA;QACA;QACA;KACD,EAAE,gDAAgD,CAACC;QAClD9B,OAAOE,uBAAuB4B,WAAWC,IAAI,CAAC;IAChD;IAEA9B,GAAG,yCAAyC;QAC1CD,OAAOE,uBAAuB,cAAc6B,IAAI,CAAC;IACnD;IAEA9B,GAAG,qDAAqD;QACtD,MAAMD,OAAOG,2BAA2BmB,cAAcU,QAAQ,CAACD,IAAI,CAAC;QACpE,MAAM/B,OACJG,2BACEM,OAAOO,MAAM,CAAC;YAACC,YAAY,QAAQG,gBAAgB;YAAUd,IAAI;SAAQ,IAE3E0B,QAAQ,CAACD,IAAI,CAAC;IAClB;IAEA9B,GAAG,iEAAiE;QAClE,MAAMgC,WAAW3B,IAAI,QAAQG,OAAOyB,IAAI,CAAC,cAAc;QACvD,MAAMlC,OACJG,2BAA2BM,OAAOO,MAAM,CAAC;YAACV,IAAI,QAAQc;YAAoBa;SAAS,IACnFD,QAAQ,CAACD,IAAI,CAAC;IAClB;IAEA9B,GAAG4B,IAAI,CAAC;QAAC;QAAQ;QAAQ;QAAQ;KAAO,EACtC,oDACA,OAAOtB;QACL,MAAMC,UAAUC,OAAOO,MAAM,CAAC;YAACV,IAAIC;YAAOD,IAAI,QAAQG,OAAOyB,IAAI,CAAC;SAAc;QAChF,MAAMlC,OAAOL,mBAAmBa,UAAUwB,QAAQ,CAACG,aAAa,CAAC;YAAEC,MAAM;QAAkB;QAC3F,MAAMpC,OAAOG,2BAA2BK,UAAUwB,QAAQ,CAACD,IAAI,CAAC;IAClE;IAGF9B,GAAG4B,IAAI,CAAC;QACN;YAAC;YAAyBvB,IAAI,QAAQc;SAAmB;QACzD;YAAC;YAAkCd,IAAI,QAAQc,mBAAmB;SAAG;QACrE;YAAC;YAA2Bd,IAAI,QAAQG,OAAOyB,IAAI,CAAC,SAAS;SAAI;QACjE;YAAC;YAA+B5B,IAAI,QAAQG,OAAOC,KAAK,CAAC,IAAI;SAAI;QACjE;YAAC;YAAiCJ,IAAI,QAAQc,mBAAmB;SAAK;QACtE;YAAC;YAA2BX,OAAOO,MAAM,CAAC;gBAACM;gBAAab,OAAOC,KAAK,CAAC;aAAG;SAAE;KAC3E,EAAE,oBAAoB,OAAO2B,GAAG7B;QAC/B,MAAMR,OAAOG,2BAA2BK,UAAUwB,QAAQ,CAACD,IAAI,CAAC;IAClE;IAEA9B,GAAG,qEAAqE;QACtE,MAAM0B,WAAW9B,KAAKyC,IAAI,CAAC1C,GAAG2C,MAAM,IAAI,CAAC,cAAc,EAAE7C,cAAc;QACvEW,UAAUmC,IAAI,CAACb;QACf,MAAMlC,GAAGgD,SAAS,CAACd,UAAUL,UAAU;QAEvC,MAAMtB,OAAOI,yBAAyBuB,WAAWK,QAAQ,CAACD,IAAI,CAAC;IACjE;AACF"}

package/dist/uploads/validateSvg.d.ts

@@ -1,6 +1,12 @@
-/**
- * Validate SVG content for security vulnerabilities
- * Detects and blocks malicious patterns commonly used in SVG-based attacks
- */
+export type SvgInspection = {
+    isSafe: boolean;
+    isSvg: boolean;
+    isValid: boolean;
+};
+export declare function inspectSvg(buffer: Buffer): SvgInspection;
+export declare function inspectSvgFile(filePath: string, options?: {
+    highWaterMark?: number;
+}): Promise<SvgInspection>;
+/** Validate SVG content by parsing its XML structure and rejecting active content. */
 export declare function validateSvg(buffer: Buffer): boolean;
 //# sourceMappingURL=validateSvg.d.ts.map

package/dist/uploads/validateSvg.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"validateSvg.d.ts","sourceRoot":"","sources":["../../src/uploads/validateSvg.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,wBAAgB,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAqDnD"}
+{"version":3,"file":"validateSvg.d.ts","sourceRoot":"","sources":["../../src/uploads/validateSvg.ts"],"names":[],"mappings":"AAuEA,MAAM,MAAM,aAAa,GAAG;IAC1B,MAAM,EAAE,OAAO,CAAA;IACf,KAAK,EAAE,OAAO,CAAA;IACd,OAAO,EAAE,OAAO,CAAA;CACjB,CAAA;AAmMD,wBAAgB,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,aAAa,CAiBxD;AAED,wBAAsB,cAAc,CAClC,QAAQ,EAAE,MAAM,EAChB,OAAO,CAAC,EAAE;IAAE,aAAa,CAAC,EAAE,MAAM,CAAA;CAAE,GACnC,OAAO,CAAC,aAAa,CAAC,CAiCxB;AAED,sFAAsF;AACtF,wBAAgB,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAEnD"}

package/dist/uploads/validateSvg.js

@@ -1,46 +1,286 @@
-/**
- * Validate SVG content for security vulnerabilities
- * Detects and blocks malicious patterns commonly used in SVG-based attacks
- */ export function validateSvg(buffer) {
+import { createReadStream } from 'fs';
+import sax from 'sax';
+import { TextDecoder } from 'util';
+const SVG_NAMESPACE = 'http://www.w3.org/2000/svg';
+const blockedElements = new Set([
+    'embed',
+    'foreignobject',
+    'iframe',
+    'object',
+    'script'
+]);
+const animationElements = new Set([
+    'animate',
+    'animatemotion',
+    'animatetransform',
+    'set'
+]);
+const animationValueAttributes = new Set([
+    'by',
+    'from',
+    'to',
+    'values'
+]);
+const urlAttributes = new Set([
+    'data',
+    'href',
+    'src'
+]);
+const urlFunctionAttributes = new Set([
+    'clip-path',
+    'cursor',
+    'fill',
+    'filter',
+    'marker',
+    'marker-end',
+    'marker-mid',
+    'marker-start',
+    'mask',
+    'stroke'
+]);
+const getLocalName = (name)=>{
+    const separator = name.lastIndexOf(':');
+    return (separator === -1 ? name : name.slice(separator + 1)).toLowerCase();
+};
+const getPrefix = (name)=>{
+    const separator = name.indexOf(':');
+    return separator === -1 ? '' : name.slice(0, separator);
+};
+const hasBlockedURL = (value)=>{
+    let normalizedValue = '';
+    for (const character of value){
+        const codePoint = character.codePointAt(0);
+        if (codePoint && codePoint > 0x20 && codePoint !== 0x7f) {
+            normalizedValue += character;
+        }
+    }
+    normalizedValue = normalizedValue.toLowerCase();
+    return normalizedValue.includes('javascript:') || normalizedValue.includes('data:text/html') || normalizedValue.includes('data:image/svg+xml');
+};
+const decodeCSSValue = (value)=>value.replace(/\/\*[\s\S]*?\*\//g, '').replace(/\\\r\n|\\[\n\r\f]/g, '').replace(/\\([\da-f]{1,6})\s?|\\(.)/gi, (_match, hexadecimal, escapedCharacter)=>{
+        if (hexadecimal) {
+            const codePoint = Number.parseInt(hexadecimal, 16);
+            return codePoint > 0 && codePoint <= 0x10ffff ? String.fromCodePoint(codePoint) : '';
+        }
+        return escapedCharacter || '';
+    });
+const hasBlockedStyles = (value)=>{
+    const decodedValue = decodeCSSValue(value);
+    return decodedValue.toLowerCase().includes('@import') || hasBlockedURL(decodedValue);
+};
+const getXMLDecoder = (buffer)=>{
+    if (buffer[0] === 0xff && buffer[1] === 0xfe || buffer[0] === 0x3c && buffer[1] === 0x00 && buffer[2] === 0x3f && buffer[3] === 0x00) {
+        return new TextDecoder('utf-16le');
+    }
+    if (buffer[0] === 0xfe && buffer[1] === 0xff || buffer[0] === 0x00 && buffer[1] === 0x3c && buffer[2] === 0x00 && buffer[3] === 0x3f) {
+        return new TextDecoder('utf-16be');
+    }
+    return new TextDecoder('utf-8');
+};
+const createSvgInspector = ()=>{
+    // sax's namespace mode walks prototype chains at every close tag. Payload only needs to resolve
+    // the root SVG namespace; active descendants and attributes are checked by local name.
+    const saxWithBufferLength = sax;
+    const maxBufferLength = saxWithBufferLength.MAX_BUFFER_LENGTH;
+    let parser;
+    try {
+        saxWithBufferLength.MAX_BUFFER_LENGTH = Number.POSITIVE_INFINITY;
+        parser = sax.parser(true, {
+            position: false,
+            strictEntities: true,
+            xmlns: false
+        });
+    } finally{
+        saxWithBufferLength.MAX_BUFFER_LENGTH = maxBufferLength;
+    }
+    let attributes = [];
+    const elementNames = [];
+    let isSafe = true;
+    let isSvg = false;
+    let isValid = true;
+    let rootElementSeen = false;
+    let styleContent = null;
+    let styleElementDepth = 0;
+    parser.onerror = (error)=>{
+        throw error;
+    };
+    parser.onprocessinginstruction = ({ name })=>{
+        if (name.toLowerCase() === 'xml-stylesheet') {
+            isSafe = false;
+        }
+    };
+    parser.ondoctype = (doctype)=>{
+        if (doctype.includes('[') || /<!entity/i.test(doctype)) {
+            isSafe = false;
+        }
+    };
+    parser.onopentagstart = (tag)=>{
+        attributes = [];
+        // sax stores attributes in a normal object and calls its hasOwnProperty method. Use a guarded
+        // null-prototype object so valid XML attributes with object-property names remain supported.
+        const saxAttributes = Object.create(null);
+        tag.attributes = new Proxy(saxAttributes, {
+            get: (target, property, receiver)=>{
+                if (property === 'hasOwnProperty') {
+                    return (name)=>Object.prototype.hasOwnProperty.call(target, name);
+                }
+                return Reflect.get(target, property, receiver);
+            }
+        });
+    };
+    parser.onattribute = (attribute)=>{
+        attributes.push(attribute);
+    };
+    parser.onopentag = (tag)=>{
+        const localName = getLocalName(tag.name);
+        elementNames.push(localName);
+        if (!rootElementSeen) {
+            rootElementSeen = true;
+            const prefix = getPrefix(tag.name);
+            const namespaceAttribute = prefix ? `xmlns:${prefix}` : 'xmlns';
+            const namespace = attributes.find(({ name })=>name === namespaceAttribute)?.value;
+            isSvg = localName === 'svg' && namespace === SVG_NAMESPACE;
+            if (!isSvg) {
+                isSafe = false;
+            }
+        }
+        if (blockedElements.has(localName)) {
+            isSafe = false;
+        }
+        if (localName === 'style') {
+            styleElementDepth += 1;
+            if (styleElementDepth === 1) {
+                styleContent = '';
+            }
+        }
+        if (animationElements.has(localName)) {
+            const targetAttribute = attributes.find(({ name })=>getLocalName(name).toLowerCase() === 'attributename')?.value.trim();
+            const targetName = targetAttribute ? getLocalName(targetAttribute) : '';
+            const values = attributes.filter(({ name })=>animationValueAttributes.has(getLocalName(name))).map(({ value })=>value).join(';');
+            if (/^on[a-z]/.test(targetName) || urlAttributes.has(targetName) && hasBlockedURL(values) || targetName === 'style' && hasBlockedStyles(values) || urlFunctionAttributes.has(targetName) && hasBlockedStyles(values)) {
+                isSafe = false;
+            }
+        }
+        for (const attribute of attributes){
+            const attributeName = getLocalName(attribute.name);
+            if (/^on[a-z]/.test(attributeName)) {
+                isSafe = false;
+            }
+            if (attributeName === 'style' && hasBlockedStyles(attribute.value)) {
+                isSafe = false;
+            }
+            if (urlAttributes.has(attributeName) && hasBlockedURL(attribute.value)) {
+                isSafe = false;
+            }
+            if (urlFunctionAttributes.has(attributeName) && /url\s*\(/i.test(attribute.value) && hasBlockedStyles(attribute.value)) {
+                isSafe = false;
+            }
+        }
+    };
+    parser.onclosetag = ()=>{
+        if (elementNames.pop() === 'style') {
+            if (styleElementDepth === 1 && styleContent && hasBlockedStyles(styleContent)) {
+                isSafe = false;
+            }
+            styleElementDepth -= 1;
+            if (styleElementDepth === 0) {
+                styleContent = null;
+            }
+        }
+    };
+    const collectStyleContent = (value)=>{
+        if (styleElementDepth > 0 && styleContent !== null) {
+            styleContent += value;
+        }
+    };
+    parser.ontext = collectStyleContent;
+    parser.oncdata = collectStyleContent;
+    return {
+        close: ()=>{
+            parser.close();
+            if (!rootElementSeen) {
+                throw new Error('Missing root element');
+            }
+        },
+        getResult: ()=>({
+                isSafe: rootElementSeen && isSafe && isValid,
+                isSvg,
+                isValid
+            }),
+        hasNonSvgRoot: ()=>rootElementSeen && !isSvg,
+        markInvalid: ()=>{
+            isValid = false;
+        },
+        write: (value)=>parser.write(value)
+    };
+};
+export function inspectSvg(buffer) {
+    const inspector = createSvgInspector();
+    const decoder = getXMLDecoder(buffer);
     try {
-        const content = buffer.toString('utf8');
-        const dangerousPatterns = [
-            // Script tags
-            /<script[\s>]/i,
-            /<\/script>/i,
-            // Event handlers (onclick, onload, onerror, etc.)
-            /\son\w+\s*=/i,
-            // JavaScript URLs
-            /javascript:/i,
-            /data:text\/html/i,
-            // Foreign objects (can embed HTML)
-            /<foreignObject[\s>]/i,
-            // Embedded iframes
-            /<iframe[\s>]/i,
-            // Embedded objects and embeds
-            /<object[\s>]/i,
-            /<embed[\s>]/i,
-            // Base64 encoded scripts (common obfuscation technique)
-            /data:image\/svg\+xml;base64,[\w+/]*PHNjcmlwdA/i,
-            // XLink href with javascript (deprecated but still dangerous)
-            /xlink:href\s*=\s*["']javascript:/i,
-            // Import statements
-            /@import/i,
-            // External resource references that could be dangerous
-            /<!ENTITY/i,
-            /<!DOCTYPE[^>]*\[/i,
-            // Attempt to use CDATA to hide scripts
-            /<!\[CDATA\[[\s\S]*<script/i
-        ];
-        for (const pattern of dangerousPatterns){
-            if (pattern.test(content)) {
-                return false;
-            }
-        }
-        return true;
+        for(let offset = 0; offset < buffer.length; offset += 64 * 1024){
+            inspector.write(decoder.decode(buffer.subarray(offset, offset + 64 * 1024), {
+                stream: true
+            }));
+            if (inspector.hasNonSvgRoot()) {
+                return inspector.getResult();
+            }
+        }
+        inspector.write(decoder.decode());
+        inspector.close();
+        return inspector.getResult();
     } catch (_error) {
-        return false;
+        inspector.markInvalid();
+        return {
+            ...inspector.getResult(),
+            isSafe: false
+        };
     }
 }
+export async function inspectSvgFile(filePath, options) {
+    const inspector = createSvgInspector();
+    let decoder = null;
+    let prefix = Buffer.alloc(0);
+    try {
+        for await (const chunk of createReadStream(filePath, options)){
+            let content = chunk;
+            if (!decoder) {
+                prefix = Buffer.concat([
+                    prefix,
+                    content
+                ]);
+                if (prefix.length < 4) {
+                    continue;
+                }
+                decoder = getXMLDecoder(prefix);
+                content = prefix;
+            }
+            inspector.write(decoder.decode(content, {
+                stream: true
+            }));
+            if (inspector.hasNonSvgRoot()) {
+                return inspector.getResult();
+            }
+        }
+        decoder ??= getXMLDecoder(prefix);
+        if (prefix.length > 0 && prefix.length < 4) {
+            inspector.write(decoder.decode(prefix, {
+                stream: true
+            }));
+        }
+        inspector.write(decoder.decode());
+        inspector.close();
+        return inspector.getResult();
+    } catch (_error) {
+        inspector.markInvalid();
+        return {
+            ...inspector.getResult(),
+            isSafe: false
+        };
+    }
+}
+/** Validate SVG content by parsing its XML structure and rejecting active content. */ export function validateSvg(buffer) {
+    return inspectSvg(buffer).isSafe;
+}
 
 //# sourceMappingURL=validateSvg.js.map

package/dist/uploads/validateSvg.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/uploads/validateSvg.ts"],"sourcesContent":["/**\n * Validate SVG content for security vulnerabilities\n * Detects and blocks malicious patterns commonly used in SVG-based attacks\n */\nexport function validateSvg(buffer: Buffer): boolean {\n  try {\n    const content = buffer.toString('utf8')\n\n    const dangerousPatterns = [\n      // Script tags\n      /<script[\\s>]/i,\n      /<\\/script>/i,\n\n      // Event handlers (onclick, onload, onerror, etc.)\n      /\\son\\w+\\s*=/i,\n\n      // JavaScript URLs\n      /javascript:/i,\n      /data:text\\/html/i,\n\n      // Foreign objects (can embed HTML)\n      /<foreignObject[\\s>]/i,\n\n      // Embedded iframes\n      /<iframe[\\s>]/i,\n\n      // Embedded objects and embeds\n      /<object[\\s>]/i,\n      /<embed[\\s>]/i,\n\n      // Base64 encoded scripts (common obfuscation technique)\n      /data:image\\/svg\\+xml;base64,[\\w+/]*PHNjcmlwdA/i, // <script in base64\n\n      // XLink href with javascript (deprecated but still dangerous)\n      /xlink:href\\s*=\\s*[\"']javascript:/i,\n\n      // Import statements\n      /@import/i,\n\n      // External resource references that could be dangerous\n      /<!ENTITY/i,\n      /<!DOCTYPE[^>]*\\[/i, // DOCTYPE with internal subset\n\n      // Attempt to use CDATA to hide scripts\n      /<!\\[CDATA\\[[\\s\\S]*<script/i,\n    ]\n\n    for (const pattern of dangerousPatterns) {\n      if (pattern.test(content)) {\n        return false\n      }\n    }\n\n    return true\n  } catch (_error) {\n    return false\n  }\n}\n"],"names":["validateSvg","buffer","content","toString","dangerousPatterns","pattern","test","_error"],"mappings":"AAAA;;;CAGC,GACD,OAAO,SAASA,YAAYC,MAAc;IACxC,IAAI;QACF,MAAMC,UAAUD,OAAOE,QAAQ,CAAC;QAEhC,MAAMC,oBAAoB;YACxB,cAAc;YACd;YACA;YAEA,kDAAkD;YAClD;YAEA,kBAAkB;YAClB;YACA;YAEA,mCAAmC;YACnC;YAEA,mBAAmB;YACnB;YAEA,8BAA8B;YAC9B;YACA;YAEA,wDAAwD;YACxD;YAEA,8DAA8D;YAC9D;YAEA,oBAAoB;YACpB;YAEA,uDAAuD;YACvD;YACA;YAEA,uCAAuC;YACvC;SACD;QAED,KAAK,MAAMC,WAAWD,kBAAmB;YACvC,IAAIC,QAAQC,IAAI,CAACJ,UAAU;gBACzB,OAAO;YACT;QACF;QAEA,OAAO;IACT,EAAE,OAAOK,QAAQ;QACf,OAAO;IACT;AACF"}
+{"version":3,"sources":["../../src/uploads/validateSvg.ts"],"sourcesContent":["import { createReadStream } from 'fs'\nimport sax, { type SAXOptions } from 'sax'\nimport { TextDecoder } from 'util'\n\nconst SVG_NAMESPACE = 'http://www.w3.org/2000/svg'\n\nconst blockedElements = new Set(['embed', 'foreignobject', 'iframe', 'object', 'script'])\nconst animationElements = new Set(['animate', 'animatemotion', 'animatetransform', 'set'])\nconst animationValueAttributes = new Set(['by', 'from', 'to', 'values'])\nconst urlAttributes = new Set(['data', 'href', 'src'])\nconst urlFunctionAttributes = new Set([\n  'clip-path',\n  'cursor',\n  'fill',\n  'filter',\n  'marker',\n  'marker-end',\n  'marker-mid',\n  'marker-start',\n  'mask',\n  'stroke',\n])\n\nconst getLocalName = (name: string): string => {\n  const separator = name.lastIndexOf(':')\n  return (separator === -1 ? name : name.slice(separator + 1)).toLowerCase()\n}\n\nconst getPrefix = (name: string): string => {\n  const separator = name.indexOf(':')\n  return separator === -1 ? '' : name.slice(0, separator)\n}\n\nconst hasBlockedURL = (value: string): boolean => {\n  let normalizedValue = ''\n\n  for (const character of value) {\n    const codePoint = character.codePointAt(0)\n    if (codePoint && codePoint > 0x20 && codePoint !== 0x7f) {\n      normalizedValue += character\n    }\n  }\n\n  normalizedValue = normalizedValue.toLowerCase()\n\n  return (\n    normalizedValue.includes('javascript:') ||\n    normalizedValue.includes('data:text/html') ||\n    normalizedValue.includes('data:image/svg+xml')\n  )\n}\n\nconst decodeCSSValue = (value: string): string =>\n  value\n    .replace(/\\/\\*[\\s\\S]*?\\*\\//g, '')\n    .replace(/\\\\\\r\\n|\\\\[\\n\\r\\f]/g, '')\n    .replace(/\\\\([\\da-f]{1,6})\\s?|\\\\(.)/gi, (_match, hexadecimal, escapedCharacter) => {\n      if (hexadecimal) {\n        const codePoint = Number.parseInt(hexadecimal, 16)\n        return codePoint > 0 && codePoint <= 0x10ffff ? String.fromCodePoint(codePoint) : ''\n      }\n\n      return escapedCharacter || ''\n    })\n\nconst hasBlockedStyles = (value: string): boolean => {\n  const decodedValue = decodeCSSValue(value)\n\n  return decodedValue.toLowerCase().includes('@import') || hasBlockedURL(decodedValue)\n}\n\nexport type SvgInspection = {\n  isSafe: boolean\n  isSvg: boolean\n  isValid: boolean\n}\n\nconst getXMLDecoder = (buffer: Buffer): TextDecoder => {\n  if (\n    (buffer[0] === 0xff && buffer[1] === 0xfe) ||\n    (buffer[0] === 0x3c && buffer[1] === 0x00 && buffer[2] === 0x3f && buffer[3] === 0x00)\n  ) {\n    return new TextDecoder('utf-16le')\n  }\n\n  if (\n    (buffer[0] === 0xfe && buffer[1] === 0xff) ||\n    (buffer[0] === 0x00 && buffer[1] === 0x3c && buffer[2] === 0x00 && buffer[3] === 0x3f)\n  ) {\n    return new TextDecoder('utf-16be')\n  }\n\n  return new TextDecoder('utf-8')\n}\n\nconst createSvgInspector = () => {\n  // sax's namespace mode walks prototype chains at every close tag. Payload only needs to resolve\n  // the root SVG namespace; active descendants and attributes are checked by local name.\n  const saxWithBufferLength = sax as { MAX_BUFFER_LENGTH: number } & typeof sax\n  const maxBufferLength = saxWithBufferLength.MAX_BUFFER_LENGTH\n  let parser: ReturnType<typeof sax.parser>\n  try {\n    saxWithBufferLength.MAX_BUFFER_LENGTH = Number.POSITIVE_INFINITY\n    parser = sax.parser(true, {\n      position: false,\n      strictEntities: true,\n      xmlns: false,\n    } as { strictEntities: boolean } & SAXOptions)\n  } finally {\n    saxWithBufferLength.MAX_BUFFER_LENGTH = maxBufferLength\n  }\n\n  let attributes: Array<{ name: string; value: string }> = []\n  const elementNames: string[] = []\n  let isSafe = true\n  let isSvg = false\n  let isValid = true\n  let rootElementSeen = false\n  let styleContent: null | string = null\n  let styleElementDepth = 0\n\n  parser.onerror = (error) => {\n    throw error\n  }\n\n  parser.onprocessinginstruction = ({ name }) => {\n    if (name.toLowerCase() === 'xml-stylesheet') {\n      isSafe = false\n    }\n  }\n\n  parser.ondoctype = (doctype) => {\n    if (doctype.includes('[') || /<!entity/i.test(doctype)) {\n      isSafe = false\n    }\n  }\n\n  parser.onopentagstart = (tag) => {\n    attributes = []\n\n    // sax stores attributes in a normal object and calls its hasOwnProperty method. Use a guarded\n    // null-prototype object so valid XML attributes with object-property names remain supported.\n    const saxAttributes = Object.create(null) as typeof tag.attributes\n    tag.attributes = new Proxy(saxAttributes, {\n      get: (target, property, receiver) => {\n        if (property === 'hasOwnProperty') {\n          return (name: string) => Object.prototype.hasOwnProperty.call(target, name)\n        }\n\n        return Reflect.get(target, property, receiver)\n      },\n    })\n  }\n\n  parser.onattribute = (attribute) => {\n    attributes.push(attribute)\n  }\n\n  parser.onopentag = (tag) => {\n    const localName = getLocalName(tag.name)\n    elementNames.push(localName)\n\n    if (!rootElementSeen) {\n      rootElementSeen = true\n      const prefix = getPrefix(tag.name)\n      const namespaceAttribute = prefix ? `xmlns:${prefix}` : 'xmlns'\n      const namespace = attributes.find(({ name }) => name === namespaceAttribute)?.value\n      isSvg = localName === 'svg' && namespace === SVG_NAMESPACE\n      if (!isSvg) {\n        isSafe = false\n      }\n    }\n\n    if (blockedElements.has(localName)) {\n      isSafe = false\n    }\n\n    if (localName === 'style') {\n      styleElementDepth += 1\n      if (styleElementDepth === 1) {\n        styleContent = ''\n      }\n    }\n\n    if (animationElements.has(localName)) {\n      const targetAttribute = attributes\n        .find(({ name }) => getLocalName(name).toLowerCase() === 'attributename')\n        ?.value.trim()\n      const targetName = targetAttribute ? getLocalName(targetAttribute) : ''\n      const values = attributes\n        .filter(({ name }) => animationValueAttributes.has(getLocalName(name)))\n        .map(({ value }) => value)\n        .join(';')\n\n      if (\n        /^on[a-z]/.test(targetName) ||\n        (urlAttributes.has(targetName) && hasBlockedURL(values)) ||\n        (targetName === 'style' && hasBlockedStyles(values)) ||\n        (urlFunctionAttributes.has(targetName) && hasBlockedStyles(values))\n      ) {\n        isSafe = false\n      }\n    }\n\n    for (const attribute of attributes) {\n      const attributeName = getLocalName(attribute.name)\n\n      if (/^on[a-z]/.test(attributeName)) {\n        isSafe = false\n      }\n\n      if (attributeName === 'style' && hasBlockedStyles(attribute.value)) {\n        isSafe = false\n      }\n\n      if (urlAttributes.has(attributeName) && hasBlockedURL(attribute.value)) {\n        isSafe = false\n      }\n\n      if (\n        urlFunctionAttributes.has(attributeName) &&\n        /url\\s*\\(/i.test(attribute.value) &&\n        hasBlockedStyles(attribute.value)\n      ) {\n        isSafe = false\n      }\n    }\n  }\n\n  parser.onclosetag = () => {\n    if (elementNames.pop() === 'style') {\n      if (styleElementDepth === 1 && styleContent && hasBlockedStyles(styleContent)) {\n        isSafe = false\n      }\n      styleElementDepth -= 1\n      if (styleElementDepth === 0) {\n        styleContent = null\n      }\n    }\n  }\n\n  const collectStyleContent = (value: string) => {\n    if (styleElementDepth > 0 && styleContent !== null) {\n      styleContent += value\n    }\n  }\n\n  parser.ontext = collectStyleContent\n  parser.oncdata = collectStyleContent\n\n  return {\n    close: () => {\n      parser.close()\n      if (!rootElementSeen) {\n        throw new Error('Missing root element')\n      }\n    },\n    getResult: (): SvgInspection => ({\n      isSafe: rootElementSeen && isSafe && isValid,\n      isSvg,\n      isValid,\n    }),\n    hasNonSvgRoot: (): boolean => rootElementSeen && !isSvg,\n    markInvalid: () => {\n      isValid = false\n    },\n    write: (value: string) => parser.write(value),\n  }\n}\n\nexport function inspectSvg(buffer: Buffer): SvgInspection {\n  const inspector = createSvgInspector()\n  const decoder = getXMLDecoder(buffer)\n  try {\n    for (let offset = 0; offset < buffer.length; offset += 64 * 1024) {\n      inspector.write(decoder.decode(buffer.subarray(offset, offset + 64 * 1024), { stream: true }))\n      if (inspector.hasNonSvgRoot()) {\n        return inspector.getResult()\n      }\n    }\n    inspector.write(decoder.decode())\n    inspector.close()\n    return inspector.getResult()\n  } catch (_error) {\n    inspector.markInvalid()\n    return { ...inspector.getResult(), isSafe: false }\n  }\n}\n\nexport async function inspectSvgFile(\n  filePath: string,\n  options?: { highWaterMark?: number },\n): Promise<SvgInspection> {\n  const inspector = createSvgInspector()\n  let decoder: null | TextDecoder = null\n  let prefix = Buffer.alloc(0)\n\n  try {\n    for await (const chunk of createReadStream(filePath, options)) {\n      let content: Buffer = chunk\n      if (!decoder) {\n        prefix = Buffer.concat([prefix, content])\n        if (prefix.length < 4) {\n          continue\n        }\n        decoder = getXMLDecoder(prefix)\n        content = prefix\n      }\n\n      inspector.write(decoder.decode(content, { stream: true }))\n      if (inspector.hasNonSvgRoot()) {\n        return inspector.getResult()\n      }\n    }\n    decoder ??= getXMLDecoder(prefix)\n    if (prefix.length > 0 && prefix.length < 4) {\n      inspector.write(decoder.decode(prefix, { stream: true }))\n    }\n    inspector.write(decoder.decode())\n    inspector.close()\n    return inspector.getResult()\n  } catch (_error) {\n    inspector.markInvalid()\n    return { ...inspector.getResult(), isSafe: false }\n  }\n}\n\n/** Validate SVG content by parsing its XML structure and rejecting active content. */\nexport function validateSvg(buffer: Buffer): boolean {\n  return inspectSvg(buffer).isSafe\n}\n"],"names":["createReadStream","sax","TextDecoder","SVG_NAMESPACE","blockedElements","Set","animationElements","animationValueAttributes","urlAttributes","urlFunctionAttributes","getLocalName","name","separator","lastIndexOf","slice","toLowerCase","getPrefix","indexOf","hasBlockedURL","value","normalizedValue","character","codePoint","codePointAt","includes","decodeCSSValue","replace","_match","hexadecimal","escapedCharacter","Number","parseInt","String","fromCodePoint","hasBlockedStyles","decodedValue","getXMLDecoder","buffer","createSvgInspector","saxWithBufferLength","maxBufferLength","MAX_BUFFER_LENGTH","parser","POSITIVE_INFINITY","position","strictEntities","xmlns","attributes","elementNames","isSafe","isSvg","isValid","rootElementSeen","styleContent","styleElementDepth","onerror","error","onprocessinginstruction","ondoctype","doctype","test","onopentagstart","tag","saxAttributes","Object","create","Proxy","get","target","property","receiver","prototype","hasOwnProperty","call","Reflect","onattribute","attribute","push","onopentag","localName","prefix","namespaceAttribute","namespace","find","has","targetAttribute","trim","targetName","values","filter","map","join","attributeName","onclosetag","pop","collectStyleContent","ontext","oncdata","close","Error","getResult","hasNonSvgRoot","markInvalid","write","inspectSvg","inspector","decoder","offset","length","decode","subarray","stream","_error","inspectSvgFile","filePath","options","Buffer","alloc","chunk","content","concat","validateSvg"],"mappings":"AAAA,SAASA,gBAAgB,QAAQ,KAAI;AACrC,OAAOC,SAA8B,MAAK;AAC1C,SAASC,WAAW,QAAQ,OAAM;AAElC,MAAMC,gBAAgB;AAEtB,MAAMC,kBAAkB,IAAIC,IAAI;IAAC;IAAS;IAAiB;IAAU;IAAU;CAAS;AACxF,MAAMC,oBAAoB,IAAID,IAAI;IAAC;IAAW;IAAiB;IAAoB;CAAM;AACzF,MAAME,2BAA2B,IAAIF,IAAI;IAAC;IAAM;IAAQ;IAAM;CAAS;AACvE,MAAMG,gBAAgB,IAAIH,IAAI;IAAC;IAAQ;IAAQ;CAAM;AACrD,MAAMI,wBAAwB,IAAIJ,IAAI;IACpC;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;CACD;AAED,MAAMK,eAAe,CAACC;IACpB,MAAMC,YAAYD,KAAKE,WAAW,CAAC;IACnC,OAAO,AAACD,CAAAA,cAAc,CAAC,IAAID,OAAOA,KAAKG,KAAK,CAACF,YAAY,EAAC,EAAGG,WAAW;AAC1E;AAEA,MAAMC,YAAY,CAACL;IACjB,MAAMC,YAAYD,KAAKM,OAAO,CAAC;IAC/B,OAAOL,cAAc,CAAC,IAAI,KAAKD,KAAKG,KAAK,CAAC,GAAGF;AAC/C;AAEA,MAAMM,gBAAgB,CAACC;IACrB,IAAIC,kBAAkB;IAEtB,KAAK,MAAMC,aAAaF,MAAO;QAC7B,MAAMG,YAAYD,UAAUE,WAAW,CAAC;QACxC,IAAID,aAAaA,YAAY,QAAQA,cAAc,MAAM;YACvDF,mBAAmBC;QACrB;IACF;IAEAD,kBAAkBA,gBAAgBL,WAAW;IAE7C,OACEK,gBAAgBI,QAAQ,CAAC,kBACzBJ,gBAAgBI,QAAQ,CAAC,qBACzBJ,gBAAgBI,QAAQ,CAAC;AAE7B;AAEA,MAAMC,iBAAiB,CAACN,QACtBA,MACGO,OAAO,CAAC,qBAAqB,IAC7BA,OAAO,CAAC,sBAAsB,IAC9BA,OAAO,CAAC,+BAA+B,CAACC,QAAQC,aAAaC;QAC5D,IAAID,aAAa;YACf,MAAMN,YAAYQ,OAAOC,QAAQ,CAACH,aAAa;YAC/C,OAAON,YAAY,KAAKA,aAAa,WAAWU,OAAOC,aAAa,CAACX,aAAa;QACpF;QAEA,OAAOO,oBAAoB;IAC7B;AAEJ,MAAMK,mBAAmB,CAACf;IACxB,MAAMgB,eAAeV,eAAeN;IAEpC,OAAOgB,aAAapB,WAAW,GAAGS,QAAQ,CAAC,cAAcN,cAAciB;AACzE;AAQA,MAAMC,gBAAgB,CAACC;IACrB,IACE,AAACA,MAAM,CAAC,EAAE,KAAK,QAAQA,MAAM,CAAC,EAAE,KAAK,QACpCA,MAAM,CAAC,EAAE,KAAK,QAAQA,MAAM,CAAC,EAAE,KAAK,QAAQA,MAAM,CAAC,EAAE,KAAK,QAAQA,MAAM,CAAC,EAAE,KAAK,MACjF;QACA,OAAO,IAAInC,YAAY;IACzB;IAEA,IACE,AAACmC,MAAM,CAAC,EAAE,KAAK,QAAQA,MAAM,CAAC,EAAE,KAAK,QACpCA,MAAM,CAAC,EAAE,KAAK,QAAQA,MAAM,CAAC,EAAE,KAAK,QAAQA,MAAM,CAAC,EAAE,KAAK,QAAQA,MAAM,CAAC,EAAE,KAAK,MACjF;QACA,OAAO,IAAInC,YAAY;IACzB;IAEA,OAAO,IAAIA,YAAY;AACzB;AAEA,MAAMoC,qBAAqB;IACzB,gGAAgG;IAChG,uFAAuF;IACvF,MAAMC,sBAAsBtC;IAC5B,MAAMuC,kBAAkBD,oBAAoBE,iBAAiB;IAC7D,IAAIC;IACJ,IAAI;QACFH,oBAAoBE,iBAAiB,GAAGX,OAAOa,iBAAiB;QAChED,SAASzC,IAAIyC,MAAM,CAAC,MAAM;YACxBE,UAAU;YACVC,gBAAgB;YAChBC,OAAO;QACT;IACF,SAAU;QACRP,oBAAoBE,iBAAiB,GAAGD;IAC1C;IAEA,IAAIO,aAAqD,EAAE;IAC3D,MAAMC,eAAyB,EAAE;IACjC,IAAIC,SAAS;IACb,IAAIC,QAAQ;IACZ,IAAIC,UAAU;IACd,IAAIC,kBAAkB;IACtB,IAAIC,eAA8B;IAClC,IAAIC,oBAAoB;IAExBZ,OAAOa,OAAO,GAAG,CAACC;QAChB,MAAMA;IACR;IAEAd,OAAOe,uBAAuB,GAAG,CAAC,EAAE9C,IAAI,EAAE;QACxC,IAAIA,KAAKI,WAAW,OAAO,kBAAkB;YAC3CkC,SAAS;QACX;IACF;IAEAP,OAAOgB,SAAS,GAAG,CAACC;QAClB,IAAIA,QAAQnC,QAAQ,CAAC,QAAQ,YAAYoC,IAAI,CAACD,UAAU;YACtDV,SAAS;QACX;IACF;IAEAP,OAAOmB,cAAc,GAAG,CAACC;QACvBf,aAAa,EAAE;QAEf,8FAA8F;QAC9F,6FAA6F;QAC7F,MAAMgB,gBAAgBC,OAAOC,MAAM,CAAC;QACpCH,IAAIf,UAAU,GAAG,IAAImB,MAAMH,eAAe;YACxCI,KAAK,CAACC,QAAQC,UAAUC;gBACtB,IAAID,aAAa,kBAAkB;oBACjC,OAAO,CAAC1D,OAAiBqD,OAAOO,SAAS,CAACC,cAAc,CAACC,IAAI,CAACL,QAAQzD;gBACxE;gBAEA,OAAO+D,QAAQP,GAAG,CAACC,QAAQC,UAAUC;YACvC;QACF;IACF;IAEA5B,OAAOiC,WAAW,GAAG,CAACC;QACpB7B,WAAW8B,IAAI,CAACD;IAClB;IAEAlC,OAAOoC,SAAS,GAAG,CAAChB;QAClB,MAAMiB,YAAYrE,aAAaoD,IAAInD,IAAI;QACvCqC,aAAa6B,IAAI,CAACE;QAElB,IAAI,CAAC3B,iBAAiB;YACpBA,kBAAkB;YAClB,MAAM4B,SAAShE,UAAU8C,IAAInD,IAAI;YACjC,MAAMsE,qBAAqBD,SAAS,CAAC,MAAM,EAAEA,QAAQ,GAAG;YACxD,MAAME,YAAYnC,WAAWoC,IAAI,CAAC,CAAC,EAAExE,IAAI,EAAE,GAAKA,SAASsE,qBAAqB9D;YAC9E+B,QAAQ6B,cAAc,SAASG,cAAc/E;YAC7C,IAAI,CAAC+C,OAAO;gBACVD,SAAS;YACX;QACF;QAEA,IAAI7C,gBAAgBgF,GAAG,CAACL,YAAY;YAClC9B,SAAS;QACX;QAEA,IAAI8B,cAAc,SAAS;YACzBzB,qBAAqB;YACrB,IAAIA,sBAAsB,GAAG;gBAC3BD,eAAe;YACjB;QACF;QAEA,IAAI/C,kBAAkB8E,GAAG,CAACL,YAAY;YACpC,MAAMM,kBAAkBtC,WACrBoC,IAAI,CAAC,CAAC,EAAExE,IAAI,EAAE,GAAKD,aAAaC,MAAMI,WAAW,OAAO,kBACvDI,MAAMmE;YACV,MAAMC,aAAaF,kBAAkB3E,aAAa2E,mBAAmB;YACrE,MAAMG,SAASzC,WACZ0C,MAAM,CAAC,CAAC,EAAE9E,IAAI,EAAE,GAAKJ,yBAAyB6E,GAAG,CAAC1E,aAAaC,QAC/D+E,GAAG,CAAC,CAAC,EAAEvE,KAAK,EAAE,GAAKA,OACnBwE,IAAI,CAAC;YAER,IACE,WAAW/B,IAAI,CAAC2B,eACf/E,cAAc4E,GAAG,CAACG,eAAerE,cAAcsE,WAC/CD,eAAe,WAAWrD,iBAAiBsD,WAC3C/E,sBAAsB2E,GAAG,CAACG,eAAerD,iBAAiBsD,SAC3D;gBACAvC,SAAS;YACX;QACF;QAEA,KAAK,MAAM2B,aAAa7B,WAAY;YAClC,MAAM6C,gBAAgBlF,aAAakE,UAAUjE,IAAI;YAEjD,IAAI,WAAWiD,IAAI,CAACgC,gBAAgB;gBAClC3C,SAAS;YACX;YAEA,IAAI2C,kBAAkB,WAAW1D,iBAAiB0C,UAAUzD,KAAK,GAAG;gBAClE8B,SAAS;YACX;YAEA,IAAIzC,cAAc4E,GAAG,CAACQ,kBAAkB1E,cAAc0D,UAAUzD,KAAK,GAAG;gBACtE8B,SAAS;YACX;YAEA,IACExC,sBAAsB2E,GAAG,CAACQ,kBAC1B,YAAYhC,IAAI,CAACgB,UAAUzD,KAAK,KAChCe,iBAAiB0C,UAAUzD,KAAK,GAChC;gBACA8B,SAAS;YACX;QACF;IACF;IAEAP,OAAOmD,UAAU,GAAG;QAClB,IAAI7C,aAAa8C,GAAG,OAAO,SAAS;YAClC,IAAIxC,sBAAsB,KAAKD,gBAAgBnB,iBAAiBmB,eAAe;gBAC7EJ,SAAS;YACX;YACAK,qBAAqB;YACrB,IAAIA,sBAAsB,GAAG;gBAC3BD,eAAe;YACjB;QACF;IACF;IAEA,MAAM0C,sBAAsB,CAAC5E;QAC3B,IAAImC,oBAAoB,KAAKD,iBAAiB,MAAM;YAClDA,gBAAgBlC;QAClB;IACF;IAEAuB,OAAOsD,MAAM,GAAGD;IAChBrD,OAAOuD,OAAO,GAAGF;IAEjB,OAAO;QACLG,OAAO;YACLxD,OAAOwD,KAAK;YACZ,IAAI,CAAC9C,iBAAiB;gBACpB,MAAM,IAAI+C,MAAM;YAClB;QACF;QACAC,WAAW,IAAsB,CAAA;gBAC/BnD,QAAQG,mBAAmBH,UAAUE;gBACrCD;gBACAC;YACF,CAAA;QACAkD,eAAe,IAAejD,mBAAmB,CAACF;QAClDoD,aAAa;YACXnD,UAAU;QACZ;QACAoD,OAAO,CAACpF,QAAkBuB,OAAO6D,KAAK,CAACpF;IACzC;AACF;AAEA,OAAO,SAASqF,WAAWnE,MAAc;IACvC,MAAMoE,YAAYnE;IAClB,MAAMoE,UAAUtE,cAAcC;IAC9B,IAAI;QACF,IAAK,IAAIsE,SAAS,GAAGA,SAAStE,OAAOuE,MAAM,EAAED,UAAU,KAAK,KAAM;YAChEF,UAAUF,KAAK,CAACG,QAAQG,MAAM,CAACxE,OAAOyE,QAAQ,CAACH,QAAQA,SAAS,KAAK,OAAO;gBAAEI,QAAQ;YAAK;YAC3F,IAAIN,UAAUJ,aAAa,IAAI;gBAC7B,OAAOI,UAAUL,SAAS;YAC5B;QACF;QACAK,UAAUF,KAAK,CAACG,QAAQG,MAAM;QAC9BJ,UAAUP,KAAK;QACf,OAAOO,UAAUL,SAAS;IAC5B,EAAE,OAAOY,QAAQ;QACfP,UAAUH,WAAW;QACrB,OAAO;YAAE,GAAGG,UAAUL,SAAS,EAAE;YAAEnD,QAAQ;QAAM;IACnD;AACF;AAEA,OAAO,eAAegE,eACpBC,QAAgB,EAChBC,OAAoC;IAEpC,MAAMV,YAAYnE;IAClB,IAAIoE,UAA8B;IAClC,IAAI1B,SAASoC,OAAOC,KAAK,CAAC;IAE1B,IAAI;QACF,WAAW,MAAMC,SAAStH,iBAAiBkH,UAAUC,SAAU;YAC7D,IAAII,UAAkBD;YACtB,IAAI,CAACZ,SAAS;gBACZ1B,SAASoC,OAAOI,MAAM,CAAC;oBAACxC;oBAAQuC;iBAAQ;gBACxC,IAAIvC,OAAO4B,MAAM,GAAG,GAAG;oBACrB;gBACF;gBACAF,UAAUtE,cAAc4C;gBACxBuC,UAAUvC;YACZ;YAEAyB,UAAUF,KAAK,CAACG,QAAQG,MAAM,CAACU,SAAS;gBAAER,QAAQ;YAAK;YACvD,IAAIN,UAAUJ,aAAa,IAAI;gBAC7B,OAAOI,UAAUL,SAAS;YAC5B;QACF;QACAM,YAAYtE,cAAc4C;QAC1B,IAAIA,OAAO4B,MAAM,GAAG,KAAK5B,OAAO4B,MAAM,GAAG,GAAG;YAC1CH,UAAUF,KAAK,CAACG,QAAQG,MAAM,CAAC7B,QAAQ;gBAAE+B,QAAQ;YAAK;QACxD;QACAN,UAAUF,KAAK,CAACG,QAAQG,MAAM;QAC9BJ,UAAUP,KAAK;QACf,OAAOO,UAAUL,SAAS;IAC5B,EAAE,OAAOY,QAAQ;QACfP,UAAUH,WAAW;QACrB,OAAO;YAAE,GAAGG,UAAUL,SAAS,EAAE;YAAEnD,QAAQ;QAAM;IACnD;AACF;AAEA,oFAAoF,GACpF,OAAO,SAASwE,YAAYpF,MAAc;IACxC,OAAOmE,WAAWnE,QAAQY,MAAM;AAClC"}