payload 4.0.0-internal.bc5cf8c → 4.0.0-internal.bf4bcce

package/dist/uploads/checkFileRestrictions.d.ts

@@ -3,5 +3,15 @@ import type { checkFileRestrictionsParams, FileAllowList } from './types.js';
  * Restricted file types and their extensions.
  */
 export declare const RESTRICTED_FILE_EXT_AND_TYPES: FileAllowList;
-export declare const checkFileRestrictions: ({ collection, file, req, }: checkFileRestrictionsParams) => Promise<void>;
+export declare const checkFileRestrictions: ({ checkFileContents, collection, file, req, }: checkFileRestrictionsParams) => Promise<{
+    ext: string;
+    mime: string;
+} | undefined>;
+export declare const checkFileMetadataRestrictions: ({ collection, filename, filesize, mimeType, req, }: {
+    collection: checkFileRestrictionsParams['collection'];
+    filename: string;
+    filesize?: number;
+    mimeType: string;
+    req: checkFileRestrictionsParams['req'];
+}) => Promise<void>;
 //# sourceMappingURL=checkFileRestrictions.d.ts.map

package/dist/uploads/checkFileRestrictions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"checkFileRestrictions.d.ts","sourceRoot":"","sources":["../../src/uploads/checkFileRestrictions.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,2BAA2B,EAAE,aAAa,EAAE,MAAM,YAAY,CAAA;AAS5E;;GAEG;AACH,eAAO,MAAM,6BAA6B,EAAE,aAgC3C,CAAA;AAED,eAAO,MAAM,qBAAqB,GAAU,4BAIzC,2BAA2B,KAAG,OAAO,CAAC,IAAI,CAyJ5C,CAAA"}
+{"version":3,"file":"checkFileRestrictions.d.ts","sourceRoot":"","sources":["../../src/uploads/checkFileRestrictions.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,2BAA2B,EAAE,aAAa,EAAE,MAAM,YAAY,CAAA;AAsB5E;;GAEG;AACH,eAAO,MAAM,6BAA6B,EAAE,aAiC3C,CAAA;AAED,eAAO,MAAM,qBAAqB,kDAK/B,2BAA2B,KAAG,OAAO,CAAC;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,CAgNjF,CAAA;AAED,eAAO,MAAM,6BAA6B,uDAMvC;IACD,UAAU,EAAE,2BAA2B,CAAC,YAAY,CAAC,CAAA;IACrD,QAAQ,EAAE,MAAM,CAAA;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,QAAQ,EAAE,MAAM,CAAA;IAChB,GAAG,EAAE,2BAA2B,CAAC,KAAK,CAAC,CAAA;CACxC,KAAG,OAAO,CAAC,IAAI,CAYf,CAAA"}

package/dist/uploads/checkFileRestrictions.js

@@ -3,9 +3,12 @@ import fs from 'fs/promises';
 import { ValidationError } from '../errors/index.js';
 import { validateMimeType } from '../utilities/validateMimeType.js';
 import { validatePDF } from '../utilities/validatePDF.js';
-import { detectSvgFromXml } from './detectSvgFromXml.js';
 import { getFileTypeFallback } from './getFileTypeFallback.js';
-import { validateSvg } from './validateSvg.js';
+import { getFileExtension, getMimeTypeEssence, getSanitizedUploadFilename, isSvgUpload, isXmlUpload } from './getFileTypeIdentity.js';
+import { hasFullFileContents } from './hasFullFileContents.js';
+import { isProcessableImage } from './isProcessableImage.js';
+import { isISOBaseMediaMimeType, validateISOBaseMediaBuffer, validateISOBaseMediaFile } from './validateISOBaseMediaFile.js';
+import { inspectSvg, inspectSvgFile } from './validateSvg.js';
 /**
  * Restricted file types and their extensions.
  */ export const RESTRICTED_FILE_EXT_AND_TYPES = [
@@ -111,6 +114,10 @@ import { validateSvg } from './validateSvg.js';
         ],
         mimeType: 'text/html'
     },
+    {
+        extensions: [],
+        mimeType: 'application/xhtml+xml'
+    },
     {
         extensions: [
             'php',
@@ -219,7 +226,7 @@ import { validateSvg } from './validateSvg.js';
         mimeType: 'application/x-command'
     }
 ];
-export const checkFileRestrictions = async ({ collection, file, req })=>{
+export const checkFileRestrictions = async ({ checkFileContents = true, collection, file, req })=>{
     const errors = [];
     const { upload: uploadConfig } = collection;
     const configMimeTypes = uploadConfig && typeof uploadConfig === 'object' && 'mimeTypes' in uploadConfig && Array.isArray(uploadConfig.mimeTypes) ? uploadConfig.mimeTypes : [];
@@ -236,16 +243,28 @@ export const checkFileRestrictions = async ({ collection, file, req })=>{
         }
         return mimeType.startsWith('image/') || mimeType.startsWith('video/') || mimeType.startsWith('audio/') || mimeType === 'application/pdf';
     };
-    // Skip validation if `allowRestrictedFileTypes` is true
-    if (allowRestrictedFileTypes) {
+    const typeFromExtension = getFileExtension(getSanitizedUploadFilename(file.name));
+    const mimeTypeEssence = getMimeTypeEssence(file.mimetype);
+    if (!checkFileContents) {
+        const isAllowed = configMimeTypes.length ? validateMimeType(file.mimetype, configMimeTypes) : !RESTRICTED_FILE_EXT_AND_TYPES.some(({ extensions, mimeType })=>mimeType === mimeTypeEssence || extensions.includes(typeFromExtension.toLowerCase()));
+        if (!isAllowed) {
+            throw new ValidationError({
+                errors: [
+                    {
+                        message: `File type '${file.mimetype}' is not allowed.`,
+                        path: 'file'
+                    }
+                ]
+            });
+        }
         return;
     }
     // For temp files, use fileTypeFromFile so large files (e.g. video) are never loaded into memory
-    // just for detection. For content validation (SVG safety, PDF integrity), the full buffer is
-    // loaded lazily and only when the file type actually requires it.
+    // just for detection. Content validation streams SVG/XML temp files and only loads a full
+    // temp-file buffer for PDF integrity checks.
     const { tempFilePath } = file;
     const isTempFile = !!tempFilePath && (!file.data || file.data.length === 0);
-    // Lazily reads the full file — only reached for small text-based types (SVG, PDF).
+    // Lazily reads the full file — only reached for PDF validation.
     let _fileBuffer;
     const getFileBuffer = async ()=>{
         if (_fileBuffer) {
@@ -268,12 +287,20 @@ export const checkFileRestrictions = async ({ collection, file, req })=>{
             });
         }
     };
-    // Secondary mimetype check to assess file type from buffer
-    if (configMimeTypes.length > 0) {
-        let detected;
-        try {
-            detected = isTempFile && tempFilePath ? await fileTypeFromFile(tempFilePath) : await fileTypeFromBuffer(file.data);
-        } catch  {
+    let isSvg = isSvgUpload({
+        filename: file.name,
+        mimeType: file.mimetype
+    });
+    let svgInspection;
+    const getSvgInspection = async ()=>{
+        svgInspection ??= isTempFile && tempFilePath ? await inspectSvgFile(tempFilePath) : inspectSvg(file.data);
+        return svgInspection;
+    };
+    let detected;
+    try {
+        detected = isTempFile && tempFilePath ? await fileTypeFromFile(tempFilePath) : await fileTypeFromBuffer(file.data);
+    } catch  {
+        if (configMimeTypes.length > 0) {
             throw new ValidationError({
                 errors: [
                     {
@@ -283,10 +310,35 @@ export const checkFileRestrictions = async ({ collection, file, req })=>{
                 ]
             });
         }
-        const typeFromExtension = file.name.split('.').pop() || '';
+    }
+    if (isSvg || isXmlUpload({
+        filename: file.name,
+        mimeType: file.mimetype
+    }) || detected?.mime === 'application/xml' || !detected && isProcessableImage(file.mimetype)) {
+        const inspection = await getSvgInspection();
+        isSvg = inspection.isSvg;
+        if (inspection.isSvg) {
+            detected = {
+                ext: 'svg',
+                mime: 'image/svg+xml'
+            };
+        } else if (inspection.isValid && !detected) {
+            detected = {
+                ext: 'xml',
+                mime: 'application/xml'
+            };
+        }
+    }
+    if (detected && isISOBaseMediaMimeType(detected.mime) && (hasFullFileContents(file) || configMimeTypes.length > 0)) {
+        const isValidISOBaseMedia = isTempFile && tempFilePath ? await validateISOBaseMediaFile(tempFilePath) : await validateISOBaseMediaBuffer(file.data);
+        if (!isValidISOBaseMedia) {
+            errors.push('Invalid or corrupted ISO base media file.');
+        }
+    }
+    // Secondary mimetype check to assess file type from buffer
+    if (configMimeTypes.length > 0) {
         // Handle SVG files that are detected as XML due to <?xml declarations
         if (detected?.mime === 'application/xml' && configMimeTypes.some((type)=>type.includes('image/') && (type.includes('svg') || type === 'image/*'))) {
-            const isSvg = detectSvgFromXml(await getFileBuffer());
             if (isSvg) {
                 detected = {
                     ext: 'svg',
@@ -300,13 +352,6 @@ export const checkFileRestrictions = async ({ collection, file, req })=>{
             if (!extIsValid) {
                 errors.push(`File type ${mimeTypeFromExtension} (from extension ${typeFromExtension}) is not allowed.`);
             } else {
-                // SVG security check (text-based files not detectable by buffer)
-                if (typeFromExtension.toLowerCase() === 'svg') {
-                    const isSafeSvg = validateSvg(await getFileBuffer());
-                    if (!isSafeSvg) {
-                        errors.push('SVG file contains potentially harmful content.');
-                    }
-                }
                 // PDF validation
                 if (mimeTypeFromExtension === 'application/pdf') {
                     const isValidPDF = validatePDF(await getFileBuffer());
@@ -329,16 +374,22 @@ export const checkFileRestrictions = async ({ collection, file, req })=>{
         if (detected && !passesMimeTypeCheck) {
             errors.push(`Invalid MIME type: ${detected.mime}.`);
         }
-    } else {
+    } else if (!allowRestrictedFileTypes) {
         const isRestricted = RESTRICTED_FILE_EXT_AND_TYPES.some((type)=>{
-            const hasRestrictedExt = type.extensions.some((ext)=>file.name.toLowerCase().endsWith(ext));
-            const hasRestrictedMime = type.mimeType === file.mimetype;
+            const hasRestrictedExt = type.extensions.includes(typeFromExtension.toLowerCase());
+            const hasRestrictedMime = type.mimeType === mimeTypeEssence;
             return hasRestrictedExt || hasRestrictedMime;
         });
         if (isRestricted) {
             errors.push(`File type '${file.mimetype}' not allowed ${file.name}: Restricted file type detected -- set 'allowRestrictedFileTypes' to true to skip this check for this Collection.`);
         }
     }
+    if (isSvg) {
+        const isSafeSvg = (await getSvgInspection()).isSafe;
+        if (!isSafeSvg) {
+            errors.push('SVG file contains potentially harmful content.');
+        }
+    }
     if (errors.length > 0) {
         req.payload.logger.error(errors.join(', '));
         throw new ValidationError({
@@ -350,6 +401,20 @@ export const checkFileRestrictions = async ({ collection, file, req })=>{
             ]
         });
     }
+    return detected;
+};
+export const checkFileMetadataRestrictions = async ({ collection, filename, filesize = 0, mimeType, req })=>{
+    await checkFileRestrictions({
+        checkFileContents: false,
+        collection,
+        file: {
+            name: filename,
+            data: Buffer.alloc(0),
+            mimetype: mimeType,
+            size: filesize
+        },
+        req
+    });
 };
 
 //# sourceMappingURL=checkFileRestrictions.js.map

package/dist/uploads/checkFileRestrictions.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/uploads/checkFileRestrictions.ts"],"sourcesContent":["import { fileTypeFromBuffer, fileTypeFromFile } from 'file-type'\nimport fs from 'fs/promises'\n\nimport type { checkFileRestrictionsParams, FileAllowList } from './types.js'\n\nimport { ValidationError } from '../errors/index.js'\nimport { validateMimeType } from '../utilities/validateMimeType.js'\nimport { validatePDF } from '../utilities/validatePDF.js'\nimport { detectSvgFromXml } from './detectSvgFromXml.js'\nimport { getFileTypeFallback } from './getFileTypeFallback.js'\nimport { validateSvg } from './validateSvg.js'\n\n/**\n * Restricted file types and their extensions.\n */\nexport const RESTRICTED_FILE_EXT_AND_TYPES: FileAllowList = [\n  { extensions: ['exe', 'dll'], mimeType: 'application/x-msdownload' },\n  { extensions: ['exe', 'com', 'app', 'action'], mimeType: 'application/x-executable' },\n  { extensions: ['bat', 'cmd'], mimeType: 'application/x-msdos-program' },\n  { extensions: ['exe', 'com'], mimeType: 'application/x-ms-dos-executable' },\n  { extensions: ['dmg'], mimeType: 'application/x-apple-diskimage' },\n  { extensions: ['deb'], mimeType: 'application/x-debian-package' },\n  { extensions: ['rpm'], mimeType: 'application/x-redhat-package-manager' },\n  { extensions: ['exe', 'dll'], mimeType: 'application/vnd.microsoft.portable-executable' },\n  { extensions: ['msi'], mimeType: 'application/x-msi' },\n  { extensions: ['jar', 'ear', 'war'], mimeType: 'application/java-archive' },\n  { extensions: ['desktop'], mimeType: 'application/x-desktop' },\n  { extensions: ['cpl'], mimeType: 'application/x-cpl' },\n  { extensions: ['lnk'], mimeType: 'application/x-ms-shortcut' },\n  { extensions: ['pkg'], mimeType: 'application/x-apple-installer' },\n  { extensions: ['htm', 'html', 'shtml', 'xhtml'], mimeType: 'text/html' },\n  { extensions: ['php', 'phtml'], mimeType: 'application/x-httpd-php' },\n  { extensions: ['js', 'jse'], mimeType: 'text/javascript' },\n  { extensions: ['jsp'], mimeType: 'application/x-jsp' },\n  { extensions: ['py'], mimeType: 'text/x-python' },\n  { extensions: ['rb'], mimeType: 'text/x-ruby' },\n  { extensions: ['pl'], mimeType: 'text/x-perl' },\n  { extensions: ['ps1', 'psc1', 'psd1', 'psh', 'psm1'], mimeType: 'application/x-powershell' },\n  { extensions: ['vbe', 'vbs'], mimeType: 'application/x-vbscript' },\n  { extensions: ['ws', 'wsc', 'wsf', 'wsh'], mimeType: 'application/x-ms-wsh' },\n  { extensions: ['scr'], mimeType: 'application/x-msdownload' },\n  { extensions: ['asp', 'aspx'], mimeType: 'application/x-asp' },\n  { extensions: ['hta'], mimeType: 'application/x-hta' },\n  { extensions: ['reg'], mimeType: 'application/x-registry' },\n  { extensions: ['url'], mimeType: 'application/x-url' },\n  { extensions: ['workflow'], mimeType: 'application/x-workflow' },\n  { extensions: ['command'], mimeType: 'application/x-command' },\n]\n\nexport const checkFileRestrictions = async ({\n  collection,\n  file,\n  req,\n}: checkFileRestrictionsParams): Promise<void> => {\n  const errors: string[] = []\n  const { upload: uploadConfig } = collection\n  const configMimeTypes =\n    uploadConfig &&\n    typeof uploadConfig === 'object' &&\n    'mimeTypes' in uploadConfig &&\n    Array.isArray(uploadConfig.mimeTypes)\n      ? uploadConfig.mimeTypes\n      : []\n\n  const allowRestrictedFileTypes =\n    uploadConfig && typeof uploadConfig === 'object' && 'allowRestrictedFileTypes' in uploadConfig\n      ? (uploadConfig as { allowRestrictedFileTypes?: boolean }).allowRestrictedFileTypes\n      : false\n\n  const expectsDetectableType = (mimeType: string): boolean => {\n    const textBasedTypes = ['/svg', 'image/svg+xml', 'image/x-xbitmap', 'image/x-xpixmap']\n\n    if (textBasedTypes.includes(mimeType)) {\n      return false\n    }\n\n    return (\n      mimeType.startsWith('image/') ||\n      mimeType.startsWith('video/') ||\n      mimeType.startsWith('audio/') ||\n      mimeType === 'application/pdf'\n    )\n  }\n\n  // Skip validation if `allowRestrictedFileTypes` is true\n  if (allowRestrictedFileTypes) {\n    return\n  }\n\n  // For temp files, use fileTypeFromFile so large files (e.g. video) are never loaded into memory\n  // just for detection. For content validation (SVG safety, PDF integrity), the full buffer is\n  // loaded lazily and only when the file type actually requires it.\n  const { tempFilePath } = file\n  const isTempFile = !!tempFilePath && (!file.data || file.data.length === 0)\n\n  // Lazily reads the full file — only reached for small text-based types (SVG, PDF).\n  let _fileBuffer: Buffer | undefined\n  const getFileBuffer = async (): Promise<Buffer> => {\n    if (_fileBuffer) {\n      return _fileBuffer\n    }\n    if (!isTempFile || !tempFilePath) {\n      return (_fileBuffer = file.data)\n    }\n    try {\n      _fileBuffer = await fs.readFile(tempFilePath)\n      return _fileBuffer\n    } catch {\n      throw new ValidationError({\n        errors: [{ message: 'Could not read uploaded file for validation.', path: 'file' }],\n      })\n    }\n  }\n\n  // Secondary mimetype check to assess file type from buffer\n  if (configMimeTypes.length > 0) {\n    let detected\n    try {\n      detected =\n        isTempFile && tempFilePath\n          ? await fileTypeFromFile(tempFilePath)\n          : await fileTypeFromBuffer(file.data)\n    } catch {\n      throw new ValidationError({\n        errors: [{ message: 'Could not read uploaded file for type detection.', path: 'file' }],\n      })\n    }\n    const typeFromExtension = file.name.split('.').pop() || ''\n\n    // Handle SVG files that are detected as XML due to <?xml declarations\n    if (\n      detected?.mime === 'application/xml' &&\n      configMimeTypes.some(\n        (type) => type.includes('image/') && (type.includes('svg') || type === 'image/*'),\n      )\n    ) {\n      const isSvg = detectSvgFromXml(await getFileBuffer())\n      if (isSvg) {\n        detected = { ext: 'svg', mime: 'image/svg+xml' }\n      }\n    }\n\n    if (!detected) {\n      const mimeTypeFromExtension = getFileTypeFallback(file.name).mime\n      const extIsValid = validateMimeType(mimeTypeFromExtension, configMimeTypes)\n\n      if (!extIsValid) {\n        errors.push(\n          `File type ${mimeTypeFromExtension} (from extension ${typeFromExtension}) is not allowed.`,\n        )\n      } else {\n        // SVG security check (text-based files not detectable by buffer)\n        if (typeFromExtension.toLowerCase() === 'svg') {\n          const isSafeSvg = validateSvg(await getFileBuffer())\n          if (!isSafeSvg) {\n            errors.push('SVG file contains potentially harmful content.')\n          }\n        }\n\n        // PDF validation\n        if (mimeTypeFromExtension === 'application/pdf') {\n          const isValidPDF = validatePDF(await getFileBuffer())\n          if (!isValidPDF) {\n            errors.push('Invalid or corrupted PDF file.')\n          }\n        }\n      }\n\n      if (expectsDetectableType(mimeTypeFromExtension)) {\n        req.payload.logger.warn(\n          `File buffer returned no detectable MIME type for ${file.name}. Falling back to extension-based validation.`,\n        )\n      }\n    }\n\n    const passesMimeTypeCheck = detected?.mime && validateMimeType(detected.mime, configMimeTypes)\n\n    if (passesMimeTypeCheck && detected?.mime === 'application/pdf') {\n      const isValidPDF = validatePDF(await getFileBuffer())\n      if (!isValidPDF) {\n        errors.push('Invalid PDF file.')\n      }\n    }\n\n    if (detected && !passesMimeTypeCheck) {\n      errors.push(`Invalid MIME type: ${detected.mime}.`)\n    }\n  } else {\n    const isRestricted = RESTRICTED_FILE_EXT_AND_TYPES.some((type) => {\n      const hasRestrictedExt = type.extensions.some((ext) => file.name.toLowerCase().endsWith(ext))\n      const hasRestrictedMime = type.mimeType === file.mimetype\n      return hasRestrictedExt || hasRestrictedMime\n    })\n    if (isRestricted) {\n      errors.push(\n        `File type '${file.mimetype}' not allowed ${file.name}: Restricted file type detected -- set 'allowRestrictedFileTypes' to true to skip this check for this Collection.`,\n      )\n    }\n  }\n\n  if (errors.length > 0) {\n    req.payload.logger.error(errors.join(', '))\n    throw new ValidationError({\n      errors: [{ message: errors.join(', '), path: 'file' }],\n    })\n  }\n}\n"],"names":["fileTypeFromBuffer","fileTypeFromFile","fs","ValidationError","validateMimeType","validatePDF","detectSvgFromXml","getFileTypeFallback","validateSvg","RESTRICTED_FILE_EXT_AND_TYPES","extensions","mimeType","checkFileRestrictions","collection","file","req","errors","upload","uploadConfig","configMimeTypes","Array","isArray","mimeTypes","allowRestrictedFileTypes","expectsDetectableType","textBasedTypes","includes","startsWith","tempFilePath","isTempFile","data","length","_fileBuffer","getFileBuffer","readFile","message","path","detected","typeFromExtension","name","split","pop","mime","some","type","isSvg","ext","mimeTypeFromExtension","extIsValid","push","toLowerCase","isSafeSvg","isValidPDF","payload","logger","warn","passesMimeTypeCheck","isRestricted","hasRestrictedExt","endsWith","hasRestrictedMime","mimetype","error","join"],"mappings":"AAAA,SAASA,kBAAkB,EAAEC,gBAAgB,QAAQ,YAAW;AAChE,OAAOC,QAAQ,cAAa;AAI5B,SAASC,eAAe,QAAQ,qBAAoB;AACpD,SAASC,gBAAgB,QAAQ,mCAAkC;AACnE,SAASC,WAAW,QAAQ,8BAA6B;AACzD,SAASC,gBAAgB,QAAQ,wBAAuB;AACxD,SAASC,mBAAmB,QAAQ,2BAA0B;AAC9D,SAASC,WAAW,QAAQ,mBAAkB;AAE9C;;CAEC,GACD,OAAO,MAAMC,gCAA+C;IAC1D;QAAEC,YAAY;YAAC;YAAO;SAAM;QAAEC,UAAU;IAA2B;IACnE;QAAED,YAAY;YAAC;YAAO;YAAO;YAAO;SAAS;QAAEC,UAAU;IAA2B;IACpF;QAAED,YAAY;YAAC;YAAO;SAAM;QAAEC,UAAU;IAA8B;IACtE;QAAED,YAAY;YAAC;YAAO;SAAM;QAAEC,UAAU;IAAkC;IAC1E;QAAED,YAAY;YAAC;SAAM;QAAEC,UAAU;IAAgC;IACjE;QAAED,YAAY;YAAC;SAAM;QAAEC,UAAU;IAA+B;IAChE;QAAED,YAAY;YAAC;SAAM;QAAEC,UAAU;IAAuC;IACxE;QAAED,YAAY;YAAC;YAAO;SAAM;QAAEC,UAAU;IAAgD;IACxF;QAAED,YAAY;YAAC;SAAM;QAAEC,UAAU;IAAoB;IACrD;QAAED,YAAY;YAAC;YAAO;YAAO;SAAM;QAAEC,UAAU;IAA2B;IAC1E;QAAED,YAAY;YAAC;SAAU;QAAEC,UAAU;IAAwB;IAC7D;QAAED,YAAY;YAAC;SAAM;QAAEC,UAAU;IAAoB;IACrD;QAAED,YAAY;YAAC;SAAM;QAAEC,UAAU;IAA4B;IAC7D;QAAED,YAAY;YAAC;SAAM;QAAEC,UAAU;IAAgC;IACjE;QAAED,YAAY;YAAC;YAAO;YAAQ;YAAS;SAAQ;QAAEC,UAAU;IAAY;IACvE;QAAED,YAAY;YAAC;YAAO;SAAQ;QAAEC,UAAU;IAA0B;IACpE;QAAED,YAAY;YAAC;YAAM;SAAM;QAAEC,UAAU;IAAkB;IACzD;QAAED,YAAY;YAAC;SAAM;QAAEC,UAAU;IAAoB;IACrD;QAAED,YAAY;YAAC;SAAK;QAAEC,UAAU;IAAgB;IAChD;QAAED,YAAY;YAAC;SAAK;QAAEC,UAAU;IAAc;IAC9C;QAAED,YAAY;YAAC;SAAK;QAAEC,UAAU;IAAc;IAC9C;QAAED,YAAY;YAAC;YAAO;YAAQ;YAAQ;YAAO;SAAO;QAAEC,UAAU;IAA2B;IAC3F;QAAED,YAAY;YAAC;YAAO;SAAM;QAAEC,UAAU;IAAyB;IACjE;QAAED,YAAY;YAAC;YAAM;YAAO;YAAO;SAAM;QAAEC,UAAU;IAAuB;IAC5E;QAAED,YAAY;YAAC;SAAM;QAAEC,UAAU;IAA2B;IAC5D;QAAED,YAAY;YAAC;YAAO;SAAO;QAAEC,UAAU;IAAoB;IAC7D;QAAED,YAAY;YAAC;SAAM;QAAEC,UAAU;IAAoB;IACrD;QAAED,YAAY;YAAC;SAAM;QAAEC,UAAU;IAAyB;IAC1D;QAAED,YAAY;YAAC;SAAM;QAAEC,UAAU;IAAoB;IACrD;QAAED,YAAY;YAAC;SAAW;QAAEC,UAAU;IAAyB;IAC/D;QAAED,YAAY;YAAC;SAAU;QAAEC,UAAU;IAAwB;CAC9D,CAAA;AAED,OAAO,MAAMC,wBAAwB,OAAO,EAC1CC,UAAU,EACVC,IAAI,EACJC,GAAG,EACyB;IAC5B,MAAMC,SAAmB,EAAE;IAC3B,MAAM,EAAEC,QAAQC,YAAY,EAAE,GAAGL;IACjC,MAAMM,kBACJD,gBACA,OAAOA,iBAAiB,YACxB,eAAeA,gBACfE,MAAMC,OAAO,CAACH,aAAaI,SAAS,IAChCJ,aAAaI,SAAS,GACtB,EAAE;IAER,MAAMC,2BACJL,gBAAgB,OAAOA,iBAAiB,YAAY,8BAA8BA,eAC9E,AAACA,aAAwDK,wBAAwB,GACjF;IAEN,MAAMC,wBAAwB,CAACb;QAC7B,MAAMc,iBAAiB;YAAC;YAAQ;YAAiB;YAAmB;SAAkB;QAEtF,IAAIA,eAAeC,QAAQ,CAACf,WAAW;YACrC,OAAO;QACT;QAEA,OACEA,SAASgB,UAAU,CAAC,aACpBhB,SAASgB,UAAU,CAAC,aACpBhB,SAASgB,UAAU,CAAC,aACpBhB,aAAa;IAEjB;IAEA,wDAAwD;IACxD,IAAIY,0BAA0B;QAC5B;IACF;IAEA,gGAAgG;IAChG,6FAA6F;IAC7F,kEAAkE;IAClE,MAAM,EAAEK,YAAY,EAAE,GAAGd;IACzB,MAAMe,aAAa,CAAC,CAACD,gBAAiB,CAAA,CAACd,KAAKgB,IAAI,IAAIhB,KAAKgB,IAAI,CAACC,MAAM,KAAK,CAAA;IAEzE,mFAAmF;IACnF,IAAIC;IACJ,MAAMC,gBAAgB;QACpB,IAAID,aAAa;YACf,OAAOA;QACT;QACA,IAAI,CAACH,cAAc,CAACD,cAAc;YAChC,OAAQI,cAAclB,KAAKgB,IAAI;QACjC;QACA,IAAI;YACFE,cAAc,MAAM9B,GAAGgC,QAAQ,CAACN;YAChC,OAAOI;QACT,EAAE,OAAM;YACN,MAAM,IAAI7B,gBAAgB;gBACxBa,QAAQ;oBAAC;wBAAEmB,SAAS;wBAAgDC,MAAM;oBAAO;iBAAE;YACrF;QACF;IACF;IAEA,2DAA2D;IAC3D,IAAIjB,gBAAgBY,MAAM,GAAG,GAAG;QAC9B,IAAIM;QACJ,IAAI;YACFA,WACER,cAAcD,eACV,MAAM3B,iBAAiB2B,gBACvB,MAAM5B,mBAAmBc,KAAKgB,IAAI;QAC1C,EAAE,OAAM;YACN,MAAM,IAAI3B,gBAAgB;gBACxBa,QAAQ;oBAAC;wBAAEmB,SAAS;wBAAoDC,MAAM;oBAAO;iBAAE;YACzF;QACF;QACA,MAAME,oBAAoBxB,KAAKyB,IAAI,CAACC,KAAK,CAAC,KAAKC,GAAG,MAAM;QAExD,sEAAsE;QACtE,IACEJ,UAAUK,SAAS,qBACnBvB,gBAAgBwB,IAAI,CAClB,CAACC,OAASA,KAAKlB,QAAQ,CAAC,aAAckB,CAAAA,KAAKlB,QAAQ,CAAC,UAAUkB,SAAS,SAAQ,IAEjF;YACA,MAAMC,QAAQvC,iBAAiB,MAAM2B;YACrC,IAAIY,OAAO;gBACTR,WAAW;oBAAES,KAAK;oBAAOJ,MAAM;gBAAgB;YACjD;QACF;QAEA,IAAI,CAACL,UAAU;YACb,MAAMU,wBAAwBxC,oBAAoBO,KAAKyB,IAAI,EAAEG,IAAI;YACjE,MAAMM,aAAa5C,iBAAiB2C,uBAAuB5B;YAE3D,IAAI,CAAC6B,YAAY;gBACfhC,OAAOiC,IAAI,CACT,CAAC,UAAU,EAAEF,sBAAsB,iBAAiB,EAAET,kBAAkB,iBAAiB,CAAC;YAE9F,OAAO;gBACL,iEAAiE;gBACjE,IAAIA,kBAAkBY,WAAW,OAAO,OAAO;oBAC7C,MAAMC,YAAY3C,YAAY,MAAMyB;oBACpC,IAAI,CAACkB,WAAW;wBACdnC,OAAOiC,IAAI,CAAC;oBACd;gBACF;gBAEA,iBAAiB;gBACjB,IAAIF,0BAA0B,mBAAmB;oBAC/C,MAAMK,aAAa/C,YAAY,MAAM4B;oBACrC,IAAI,CAACmB,YAAY;wBACfpC,OAAOiC,IAAI,CAAC;oBACd;gBACF;YACF;YAEA,IAAIzB,sBAAsBuB,wBAAwB;gBAChDhC,IAAIsC,OAAO,CAACC,MAAM,CAACC,IAAI,CACrB,CAAC,iDAAiD,EAAEzC,KAAKyB,IAAI,CAAC,6CAA6C,CAAC;YAEhH;QACF;QAEA,MAAMiB,sBAAsBnB,UAAUK,QAAQtC,iBAAiBiC,SAASK,IAAI,EAAEvB;QAE9E,IAAIqC,uBAAuBnB,UAAUK,SAAS,mBAAmB;YAC/D,MAAMU,aAAa/C,YAAY,MAAM4B;YACrC,IAAI,CAACmB,YAAY;gBACfpC,OAAOiC,IAAI,CAAC;YACd;QACF;QAEA,IAAIZ,YAAY,CAACmB,qBAAqB;YACpCxC,OAAOiC,IAAI,CAAC,CAAC,mBAAmB,EAAEZ,SAASK,IAAI,CAAC,CAAC,CAAC;QACpD;IACF,OAAO;QACL,MAAMe,eAAehD,8BAA8BkC,IAAI,CAAC,CAACC;YACvD,MAAMc,mBAAmBd,KAAKlC,UAAU,CAACiC,IAAI,CAAC,CAACG,MAAQhC,KAAKyB,IAAI,CAACW,WAAW,GAAGS,QAAQ,CAACb;YACxF,MAAMc,oBAAoBhB,KAAKjC,QAAQ,KAAKG,KAAK+C,QAAQ;YACzD,OAAOH,oBAAoBE;QAC7B;QACA,IAAIH,cAAc;YAChBzC,OAAOiC,IAAI,CACT,CAAC,WAAW,EAAEnC,KAAK+C,QAAQ,CAAC,cAAc,EAAE/C,KAAKyB,IAAI,CAAC,iHAAiH,CAAC;QAE5K;IACF;IAEA,IAAIvB,OAAOe,MAAM,GAAG,GAAG;QACrBhB,IAAIsC,OAAO,CAACC,MAAM,CAACQ,KAAK,CAAC9C,OAAO+C,IAAI,CAAC;QACrC,MAAM,IAAI5D,gBAAgB;YACxBa,QAAQ;gBAAC;oBAAEmB,SAASnB,OAAO+C,IAAI,CAAC;oBAAO3B,MAAM;gBAAO;aAAE;QACxD;IACF;AACF,EAAC"}
+{"version":3,"sources":["../../src/uploads/checkFileRestrictions.ts"],"sourcesContent":["import { fileTypeFromBuffer, fileTypeFromFile } from 'file-type'\nimport fs from 'fs/promises'\n\nimport type { checkFileRestrictionsParams, FileAllowList } from './types.js'\n\nimport { ValidationError } from '../errors/index.js'\nimport { validateMimeType } from '../utilities/validateMimeType.js'\nimport { validatePDF } from '../utilities/validatePDF.js'\nimport { getFileTypeFallback } from './getFileTypeFallback.js'\nimport {\n  getFileExtension,\n  getMimeTypeEssence,\n  getSanitizedUploadFilename,\n  isSvgUpload,\n  isXmlUpload,\n} from './getFileTypeIdentity.js'\nimport { hasFullFileContents } from './hasFullFileContents.js'\nimport { isProcessableImage } from './isProcessableImage.js'\nimport {\n  isISOBaseMediaMimeType,\n  validateISOBaseMediaBuffer,\n  validateISOBaseMediaFile,\n} from './validateISOBaseMediaFile.js'\nimport { inspectSvg, inspectSvgFile } from './validateSvg.js'\n\n/**\n * Restricted file types and their extensions.\n */\nexport const RESTRICTED_FILE_EXT_AND_TYPES: FileAllowList = [\n  { extensions: ['exe', 'dll'], mimeType: 'application/x-msdownload' },\n  { extensions: ['exe', 'com', 'app', 'action'], mimeType: 'application/x-executable' },\n  { extensions: ['bat', 'cmd'], mimeType: 'application/x-msdos-program' },\n  { extensions: ['exe', 'com'], mimeType: 'application/x-ms-dos-executable' },\n  { extensions: ['dmg'], mimeType: 'application/x-apple-diskimage' },\n  { extensions: ['deb'], mimeType: 'application/x-debian-package' },\n  { extensions: ['rpm'], mimeType: 'application/x-redhat-package-manager' },\n  { extensions: ['exe', 'dll'], mimeType: 'application/vnd.microsoft.portable-executable' },\n  { extensions: ['msi'], mimeType: 'application/x-msi' },\n  { extensions: ['jar', 'ear', 'war'], mimeType: 'application/java-archive' },\n  { extensions: ['desktop'], mimeType: 'application/x-desktop' },\n  { extensions: ['cpl'], mimeType: 'application/x-cpl' },\n  { extensions: ['lnk'], mimeType: 'application/x-ms-shortcut' },\n  { extensions: ['pkg'], mimeType: 'application/x-apple-installer' },\n  { extensions: ['htm', 'html', 'shtml', 'xhtml'], mimeType: 'text/html' },\n  { extensions: [], mimeType: 'application/xhtml+xml' },\n  { extensions: ['php', 'phtml'], mimeType: 'application/x-httpd-php' },\n  { extensions: ['js', 'jse'], mimeType: 'text/javascript' },\n  { extensions: ['jsp'], mimeType: 'application/x-jsp' },\n  { extensions: ['py'], mimeType: 'text/x-python' },\n  { extensions: ['rb'], mimeType: 'text/x-ruby' },\n  { extensions: ['pl'], mimeType: 'text/x-perl' },\n  { extensions: ['ps1', 'psc1', 'psd1', 'psh', 'psm1'], mimeType: 'application/x-powershell' },\n  { extensions: ['vbe', 'vbs'], mimeType: 'application/x-vbscript' },\n  { extensions: ['ws', 'wsc', 'wsf', 'wsh'], mimeType: 'application/x-ms-wsh' },\n  { extensions: ['scr'], mimeType: 'application/x-msdownload' },\n  { extensions: ['asp', 'aspx'], mimeType: 'application/x-asp' },\n  { extensions: ['hta'], mimeType: 'application/x-hta' },\n  { extensions: ['reg'], mimeType: 'application/x-registry' },\n  { extensions: ['url'], mimeType: 'application/x-url' },\n  { extensions: ['workflow'], mimeType: 'application/x-workflow' },\n  { extensions: ['command'], mimeType: 'application/x-command' },\n]\n\nexport const checkFileRestrictions = async ({\n  checkFileContents = true,\n  collection,\n  file,\n  req,\n}: checkFileRestrictionsParams): Promise<{ ext: string; mime: string } | undefined> => {\n  const errors: string[] = []\n  const { upload: uploadConfig } = collection\n  const configMimeTypes =\n    uploadConfig &&\n    typeof uploadConfig === 'object' &&\n    'mimeTypes' in uploadConfig &&\n    Array.isArray(uploadConfig.mimeTypes)\n      ? uploadConfig.mimeTypes\n      : []\n\n  const allowRestrictedFileTypes =\n    uploadConfig && typeof uploadConfig === 'object' && 'allowRestrictedFileTypes' in uploadConfig\n      ? (uploadConfig as { allowRestrictedFileTypes?: boolean }).allowRestrictedFileTypes\n      : false\n\n  const expectsDetectableType = (mimeType: string): boolean => {\n    const textBasedTypes = ['/svg', 'image/svg+xml', 'image/x-xbitmap', 'image/x-xpixmap']\n\n    if (textBasedTypes.includes(mimeType)) {\n      return false\n    }\n\n    return (\n      mimeType.startsWith('image/') ||\n      mimeType.startsWith('video/') ||\n      mimeType.startsWith('audio/') ||\n      mimeType === 'application/pdf'\n    )\n  }\n\n  const typeFromExtension = getFileExtension(getSanitizedUploadFilename(file.name))\n  const mimeTypeEssence = getMimeTypeEssence(file.mimetype)\n\n  if (!checkFileContents) {\n    const isAllowed = configMimeTypes.length\n      ? validateMimeType(file.mimetype, configMimeTypes)\n      : !RESTRICTED_FILE_EXT_AND_TYPES.some(\n          ({ extensions, mimeType }) =>\n            mimeType === mimeTypeEssence || extensions.includes(typeFromExtension.toLowerCase()),\n        )\n\n    if (!isAllowed) {\n      throw new ValidationError({\n        errors: [{ message: `File type '${file.mimetype}' is not allowed.`, path: 'file' }],\n      })\n    }\n\n    return\n  }\n\n  // For temp files, use fileTypeFromFile so large files (e.g. video) are never loaded into memory\n  // just for detection. Content validation streams SVG/XML temp files and only loads a full\n  // temp-file buffer for PDF integrity checks.\n  const { tempFilePath } = file\n  const isTempFile = !!tempFilePath && (!file.data || file.data.length === 0)\n\n  // Lazily reads the full file — only reached for PDF validation.\n  let _fileBuffer: Buffer | undefined\n  const getFileBuffer = async (): Promise<Buffer> => {\n    if (_fileBuffer) {\n      return _fileBuffer\n    }\n    if (!isTempFile || !tempFilePath) {\n      return (_fileBuffer = file.data)\n    }\n    try {\n      _fileBuffer = await fs.readFile(tempFilePath)\n      return _fileBuffer\n    } catch {\n      throw new ValidationError({\n        errors: [{ message: 'Could not read uploaded file for validation.', path: 'file' }],\n      })\n    }\n  }\n\n  let isSvg = isSvgUpload({ filename: file.name, mimeType: file.mimetype })\n  let svgInspection: Awaited<ReturnType<typeof inspectSvgFile>> | undefined\n\n  const getSvgInspection = async () => {\n    svgInspection ??=\n      isTempFile && tempFilePath ? await inspectSvgFile(tempFilePath) : inspectSvg(file.data)\n    return svgInspection\n  }\n\n  let detected\n  try {\n    detected =\n      isTempFile && tempFilePath\n        ? await fileTypeFromFile(tempFilePath)\n        : await fileTypeFromBuffer(file.data)\n  } catch {\n    if (configMimeTypes.length > 0) {\n      throw new ValidationError({\n        errors: [{ message: 'Could not read uploaded file for type detection.', path: 'file' }],\n      })\n    }\n  }\n\n  if (\n    isSvg ||\n    isXmlUpload({ filename: file.name, mimeType: file.mimetype }) ||\n    detected?.mime === 'application/xml' ||\n    (!detected && isProcessableImage(file.mimetype))\n  ) {\n    const inspection = await getSvgInspection()\n    isSvg = inspection.isSvg\n    if (inspection.isSvg) {\n      detected = { ext: 'svg', mime: 'image/svg+xml' }\n    } else if (inspection.isValid && !detected) {\n      detected = { ext: 'xml', mime: 'application/xml' }\n    }\n  }\n\n  if (\n    detected &&\n    isISOBaseMediaMimeType(detected.mime) &&\n    (hasFullFileContents(file) || configMimeTypes.length > 0)\n  ) {\n    const isValidISOBaseMedia =\n      isTempFile && tempFilePath\n        ? await validateISOBaseMediaFile(tempFilePath)\n        : await validateISOBaseMediaBuffer(file.data)\n\n    if (!isValidISOBaseMedia) {\n      errors.push('Invalid or corrupted ISO base media file.')\n    }\n  }\n\n  // Secondary mimetype check to assess file type from buffer\n  if (configMimeTypes.length > 0) {\n    // Handle SVG files that are detected as XML due to <?xml declarations\n    if (\n      detected?.mime === 'application/xml' &&\n      configMimeTypes.some(\n        (type) => type.includes('image/') && (type.includes('svg') || type === 'image/*'),\n      )\n    ) {\n      if (isSvg) {\n        detected = { ext: 'svg', mime: 'image/svg+xml' }\n      }\n    }\n\n    if (!detected) {\n      const mimeTypeFromExtension = getFileTypeFallback(file.name).mime\n      const extIsValid = validateMimeType(mimeTypeFromExtension, configMimeTypes)\n\n      if (!extIsValid) {\n        errors.push(\n          `File type ${mimeTypeFromExtension} (from extension ${typeFromExtension}) is not allowed.`,\n        )\n      } else {\n        // PDF validation\n        if (mimeTypeFromExtension === 'application/pdf') {\n          const isValidPDF = validatePDF(await getFileBuffer())\n          if (!isValidPDF) {\n            errors.push('Invalid or corrupted PDF file.')\n          }\n        }\n      }\n\n      if (expectsDetectableType(mimeTypeFromExtension)) {\n        req.payload.logger.warn(\n          `File buffer returned no detectable MIME type for ${file.name}. Falling back to extension-based validation.`,\n        )\n      }\n    }\n\n    const passesMimeTypeCheck = detected?.mime && validateMimeType(detected.mime, configMimeTypes)\n\n    if (passesMimeTypeCheck && detected?.mime === 'application/pdf') {\n      const isValidPDF = validatePDF(await getFileBuffer())\n      if (!isValidPDF) {\n        errors.push('Invalid PDF file.')\n      }\n    }\n\n    if (detected && !passesMimeTypeCheck) {\n      errors.push(`Invalid MIME type: ${detected.mime}.`)\n    }\n  } else if (!allowRestrictedFileTypes) {\n    const isRestricted = RESTRICTED_FILE_EXT_AND_TYPES.some((type) => {\n      const hasRestrictedExt = type.extensions.includes(typeFromExtension.toLowerCase())\n      const hasRestrictedMime = type.mimeType === mimeTypeEssence\n      return hasRestrictedExt || hasRestrictedMime\n    })\n    if (isRestricted) {\n      errors.push(\n        `File type '${file.mimetype}' not allowed ${file.name}: Restricted file type detected -- set 'allowRestrictedFileTypes' to true to skip this check for this Collection.`,\n      )\n    }\n  }\n\n  if (isSvg) {\n    const isSafeSvg = (await getSvgInspection()).isSafe\n    if (!isSafeSvg) {\n      errors.push('SVG file contains potentially harmful content.')\n    }\n  }\n\n  if (errors.length > 0) {\n    req.payload.logger.error(errors.join(', '))\n    throw new ValidationError({\n      errors: [{ message: errors.join(', '), path: 'file' }],\n    })\n  }\n\n  return detected\n}\n\nexport const checkFileMetadataRestrictions = async ({\n  collection,\n  filename,\n  filesize = 0,\n  mimeType,\n  req,\n}: {\n  collection: checkFileRestrictionsParams['collection']\n  filename: string\n  filesize?: number\n  mimeType: string\n  req: checkFileRestrictionsParams['req']\n}): Promise<void> => {\n  await checkFileRestrictions({\n    checkFileContents: false,\n    collection,\n    file: {\n      name: filename,\n      data: Buffer.alloc(0),\n      mimetype: mimeType,\n      size: filesize,\n    },\n    req,\n  })\n}\n"],"names":["fileTypeFromBuffer","fileTypeFromFile","fs","ValidationError","validateMimeType","validatePDF","getFileTypeFallback","getFileExtension","getMimeTypeEssence","getSanitizedUploadFilename","isSvgUpload","isXmlUpload","hasFullFileContents","isProcessableImage","isISOBaseMediaMimeType","validateISOBaseMediaBuffer","validateISOBaseMediaFile","inspectSvg","inspectSvgFile","RESTRICTED_FILE_EXT_AND_TYPES","extensions","mimeType","checkFileRestrictions","checkFileContents","collection","file","req","errors","upload","uploadConfig","configMimeTypes","Array","isArray","mimeTypes","allowRestrictedFileTypes","expectsDetectableType","textBasedTypes","includes","startsWith","typeFromExtension","name","mimeTypeEssence","mimetype","isAllowed","length","some","toLowerCase","message","path","tempFilePath","isTempFile","data","_fileBuffer","getFileBuffer","readFile","isSvg","filename","svgInspection","getSvgInspection","detected","mime","inspection","ext","isValid","isValidISOBaseMedia","push","type","mimeTypeFromExtension","extIsValid","isValidPDF","payload","logger","warn","passesMimeTypeCheck","isRestricted","hasRestrictedExt","hasRestrictedMime","isSafeSvg","isSafe","error","join","checkFileMetadataRestrictions","filesize","Buffer","alloc","size"],"mappings":"AAAA,SAASA,kBAAkB,EAAEC,gBAAgB,QAAQ,YAAW;AAChE,OAAOC,QAAQ,cAAa;AAI5B,SAASC,eAAe,QAAQ,qBAAoB;AACpD,SAASC,gBAAgB,QAAQ,mCAAkC;AACnE,SAASC,WAAW,QAAQ,8BAA6B;AACzD,SAASC,mBAAmB,QAAQ,2BAA0B;AAC9D,SACEC,gBAAgB,EAChBC,kBAAkB,EAClBC,0BAA0B,EAC1BC,WAAW,EACXC,WAAW,QACN,2BAA0B;AACjC,SAASC,mBAAmB,QAAQ,2BAA0B;AAC9D,SAASC,kBAAkB,QAAQ,0BAAyB;AAC5D,SACEC,sBAAsB,EACtBC,0BAA0B,EAC1BC,wBAAwB,QACnB,gCAA+B;AACtC,SAASC,UAAU,EAAEC,cAAc,QAAQ,mBAAkB;AAE7D;;CAEC,GACD,OAAO,MAAMC,gCAA+C;IAC1D;QAAEC,YAAY;YAAC;YAAO;SAAM;QAAEC,UAAU;IAA2B;IACnE;QAAED,YAAY;YAAC;YAAO;YAAO;YAAO;SAAS;QAAEC,UAAU;IAA2B;IACpF;QAAED,YAAY;YAAC;YAAO;SAAM;QAAEC,UAAU;IAA8B;IACtE;QAAED,YAAY;YAAC;YAAO;SAAM;QAAEC,UAAU;IAAkC;IAC1E;QAAED,YAAY;YAAC;SAAM;QAAEC,UAAU;IAAgC;IACjE;QAAED,YAAY;YAAC;SAAM;QAAEC,UAAU;IAA+B;IAChE;QAAED,YAAY;YAAC;SAAM;QAAEC,UAAU;IAAuC;IACxE;QAAED,YAAY;YAAC;YAAO;SAAM;QAAEC,UAAU;IAAgD;IACxF;QAAED,YAAY;YAAC;SAAM;QAAEC,UAAU;IAAoB;IACrD;QAAED,YAAY;YAAC;YAAO;YAAO;SAAM;QAAEC,UAAU;IAA2B;IAC1E;QAAED,YAAY;YAAC;SAAU;QAAEC,UAAU;IAAwB;IAC7D;QAAED,YAAY;YAAC;SAAM;QAAEC,UAAU;IAAoB;IACrD;QAAED,YAAY;YAAC;SAAM;QAAEC,UAAU;IAA4B;IAC7D;QAAED,YAAY;YAAC;SAAM;QAAEC,UAAU;IAAgC;IACjE;QAAED,YAAY;YAAC;YAAO;YAAQ;YAAS;SAAQ;QAAEC,UAAU;IAAY;IACvE;QAAED,YAAY,EAAE;QAAEC,UAAU;IAAwB;IACpD;QAAED,YAAY;YAAC;YAAO;SAAQ;QAAEC,UAAU;IAA0B;IACpE;QAAED,YAAY;YAAC;YAAM;SAAM;QAAEC,UAAU;IAAkB;IACzD;QAAED,YAAY;YAAC;SAAM;QAAEC,UAAU;IAAoB;IACrD;QAAED,YAAY;YAAC;SAAK;QAAEC,UAAU;IAAgB;IAChD;QAAED,YAAY;YAAC;SAAK;QAAEC,UAAU;IAAc;IAC9C;QAAED,YAAY;YAAC;SAAK;QAAEC,UAAU;IAAc;IAC9C;QAAED,YAAY;YAAC;YAAO;YAAQ;YAAQ;YAAO;SAAO;QAAEC,UAAU;IAA2B;IAC3F;QAAED,YAAY;YAAC;YAAO;SAAM;QAAEC,UAAU;IAAyB;IACjE;QAAED,YAAY;YAAC;YAAM;YAAO;YAAO;SAAM;QAAEC,UAAU;IAAuB;IAC5E;QAAED,YAAY;YAAC;SAAM;QAAEC,UAAU;IAA2B;IAC5D;QAAED,YAAY;YAAC;YAAO;SAAO;QAAEC,UAAU;IAAoB;IAC7D;QAAED,YAAY;YAAC;SAAM;QAAEC,UAAU;IAAoB;IACrD;QAAED,YAAY;YAAC;SAAM;QAAEC,UAAU;IAAyB;IAC1D;QAAED,YAAY;YAAC;SAAM;QAAEC,UAAU;IAAoB;IACrD;QAAED,YAAY;YAAC;SAAW;QAAEC,UAAU;IAAyB;IAC/D;QAAED,YAAY;YAAC;SAAU;QAAEC,UAAU;IAAwB;CAC9D,CAAA;AAED,OAAO,MAAMC,wBAAwB,OAAO,EAC1CC,oBAAoB,IAAI,EACxBC,UAAU,EACVC,IAAI,EACJC,GAAG,EACyB;IAC5B,MAAMC,SAAmB,EAAE;IAC3B,MAAM,EAAEC,QAAQC,YAAY,EAAE,GAAGL;IACjC,MAAMM,kBACJD,gBACA,OAAOA,iBAAiB,YACxB,eAAeA,gBACfE,MAAMC,OAAO,CAACH,aAAaI,SAAS,IAChCJ,aAAaI,SAAS,GACtB,EAAE;IAER,MAAMC,2BACJL,gBAAgB,OAAOA,iBAAiB,YAAY,8BAA8BA,eAC9E,AAACA,aAAwDK,wBAAwB,GACjF;IAEN,MAAMC,wBAAwB,CAACd;QAC7B,MAAMe,iBAAiB;YAAC;YAAQ;YAAiB;YAAmB;SAAkB;QAEtF,IAAIA,eAAeC,QAAQ,CAAChB,WAAW;YACrC,OAAO;QACT;QAEA,OACEA,SAASiB,UAAU,CAAC,aACpBjB,SAASiB,UAAU,CAAC,aACpBjB,SAASiB,UAAU,CAAC,aACpBjB,aAAa;IAEjB;IAEA,MAAMkB,oBAAoBhC,iBAAiBE,2BAA2BgB,KAAKe,IAAI;IAC/E,MAAMC,kBAAkBjC,mBAAmBiB,KAAKiB,QAAQ;IAExD,IAAI,CAACnB,mBAAmB;QACtB,MAAMoB,YAAYb,gBAAgBc,MAAM,GACpCxC,iBAAiBqB,KAAKiB,QAAQ,EAAEZ,mBAChC,CAACX,8BAA8B0B,IAAI,CACjC,CAAC,EAAEzB,UAAU,EAAEC,QAAQ,EAAE,GACvBA,aAAaoB,mBAAmBrB,WAAWiB,QAAQ,CAACE,kBAAkBO,WAAW;QAGzF,IAAI,CAACH,WAAW;YACd,MAAM,IAAIxC,gBAAgB;gBACxBwB,QAAQ;oBAAC;wBAAEoB,SAAS,CAAC,WAAW,EAAEtB,KAAKiB,QAAQ,CAAC,iBAAiB,CAAC;wBAAEM,MAAM;oBAAO;iBAAE;YACrF;QACF;QAEA;IACF;IAEA,gGAAgG;IAChG,0FAA0F;IAC1F,6CAA6C;IAC7C,MAAM,EAAEC,YAAY,EAAE,GAAGxB;IACzB,MAAMyB,aAAa,CAAC,CAACD,gBAAiB,CAAA,CAACxB,KAAK0B,IAAI,IAAI1B,KAAK0B,IAAI,CAACP,MAAM,KAAK,CAAA;IAEzE,gEAAgE;IAChE,IAAIQ;IACJ,MAAMC,gBAAgB;QACpB,IAAID,aAAa;YACf,OAAOA;QACT;QACA,IAAI,CAACF,cAAc,CAACD,cAAc;YAChC,OAAQG,cAAc3B,KAAK0B,IAAI;QACjC;QACA,IAAI;YACFC,cAAc,MAAMlD,GAAGoD,QAAQ,CAACL;YAChC,OAAOG;QACT,EAAE,OAAM;YACN,MAAM,IAAIjD,gBAAgB;gBACxBwB,QAAQ;oBAAC;wBAAEoB,SAAS;wBAAgDC,MAAM;oBAAO;iBAAE;YACrF;QACF;IACF;IAEA,IAAIO,QAAQ7C,YAAY;QAAE8C,UAAU/B,KAAKe,IAAI;QAAEnB,UAAUI,KAAKiB,QAAQ;IAAC;IACvE,IAAIe;IAEJ,MAAMC,mBAAmB;QACvBD,kBACEP,cAAcD,eAAe,MAAM/B,eAAe+B,gBAAgBhC,WAAWQ,KAAK0B,IAAI;QACxF,OAAOM;IACT;IAEA,IAAIE;IACJ,IAAI;QACFA,WACET,cAAcD,eACV,MAAMhD,iBAAiBgD,gBACvB,MAAMjD,mBAAmByB,KAAK0B,IAAI;IAC1C,EAAE,OAAM;QACN,IAAIrB,gBAAgBc,MAAM,GAAG,GAAG;YAC9B,MAAM,IAAIzC,gBAAgB;gBACxBwB,QAAQ;oBAAC;wBAAEoB,SAAS;wBAAoDC,MAAM;oBAAO;iBAAE;YACzF;QACF;IACF;IAEA,IACEO,SACA5C,YAAY;QAAE6C,UAAU/B,KAAKe,IAAI;QAAEnB,UAAUI,KAAKiB,QAAQ;IAAC,MAC3DiB,UAAUC,SAAS,qBAClB,CAACD,YAAY9C,mBAAmBY,KAAKiB,QAAQ,GAC9C;QACA,MAAMmB,aAAa,MAAMH;QACzBH,QAAQM,WAAWN,KAAK;QACxB,IAAIM,WAAWN,KAAK,EAAE;YACpBI,WAAW;gBAAEG,KAAK;gBAAOF,MAAM;YAAgB;QACjD,OAAO,IAAIC,WAAWE,OAAO,IAAI,CAACJ,UAAU;YAC1CA,WAAW;gBAAEG,KAAK;gBAAOF,MAAM;YAAkB;QACnD;IACF;IAEA,IACED,YACA7C,uBAAuB6C,SAASC,IAAI,KACnChD,CAAAA,oBAAoBa,SAASK,gBAAgBc,MAAM,GAAG,CAAA,GACvD;QACA,MAAMoB,sBACJd,cAAcD,eACV,MAAMjC,yBAAyBiC,gBAC/B,MAAMlC,2BAA2BU,KAAK0B,IAAI;QAEhD,IAAI,CAACa,qBAAqB;YACxBrC,OAAOsC,IAAI,CAAC;QACd;IACF;IAEA,2DAA2D;IAC3D,IAAInC,gBAAgBc,MAAM,GAAG,GAAG;QAC9B,sEAAsE;QACtE,IACEe,UAAUC,SAAS,qBACnB9B,gBAAgBe,IAAI,CAClB,CAACqB,OAASA,KAAK7B,QAAQ,CAAC,aAAc6B,CAAAA,KAAK7B,QAAQ,CAAC,UAAU6B,SAAS,SAAQ,IAEjF;YACA,IAAIX,OAAO;gBACTI,WAAW;oBAAEG,KAAK;oBAAOF,MAAM;gBAAgB;YACjD;QACF;QAEA,IAAI,CAACD,UAAU;YACb,MAAMQ,wBAAwB7D,oBAAoBmB,KAAKe,IAAI,EAAEoB,IAAI;YACjE,MAAMQ,aAAahE,iBAAiB+D,uBAAuBrC;YAE3D,IAAI,CAACsC,YAAY;gBACfzC,OAAOsC,IAAI,CACT,CAAC,UAAU,EAAEE,sBAAsB,iBAAiB,EAAE5B,kBAAkB,iBAAiB,CAAC;YAE9F,OAAO;gBACL,iBAAiB;gBACjB,IAAI4B,0BAA0B,mBAAmB;oBAC/C,MAAME,aAAahE,YAAY,MAAMgD;oBACrC,IAAI,CAACgB,YAAY;wBACf1C,OAAOsC,IAAI,CAAC;oBACd;gBACF;YACF;YAEA,IAAI9B,sBAAsBgC,wBAAwB;gBAChDzC,IAAI4C,OAAO,CAACC,MAAM,CAACC,IAAI,CACrB,CAAC,iDAAiD,EAAE/C,KAAKe,IAAI,CAAC,6CAA6C,CAAC;YAEhH;QACF;QAEA,MAAMiC,sBAAsBd,UAAUC,QAAQxD,iBAAiBuD,SAASC,IAAI,EAAE9B;QAE9E,IAAI2C,uBAAuBd,UAAUC,SAAS,mBAAmB;YAC/D,MAAMS,aAAahE,YAAY,MAAMgD;YACrC,IAAI,CAACgB,YAAY;gBACf1C,OAAOsC,IAAI,CAAC;YACd;QACF;QAEA,IAAIN,YAAY,CAACc,qBAAqB;YACpC9C,OAAOsC,IAAI,CAAC,CAAC,mBAAmB,EAAEN,SAASC,IAAI,CAAC,CAAC,CAAC;QACpD;IACF,OAAO,IAAI,CAAC1B,0BAA0B;QACpC,MAAMwC,eAAevD,8BAA8B0B,IAAI,CAAC,CAACqB;YACvD,MAAMS,mBAAmBT,KAAK9C,UAAU,CAACiB,QAAQ,CAACE,kBAAkBO,WAAW;YAC/E,MAAM8B,oBAAoBV,KAAK7C,QAAQ,KAAKoB;YAC5C,OAAOkC,oBAAoBC;QAC7B;QACA,IAAIF,cAAc;YAChB/C,OAAOsC,IAAI,CACT,CAAC,WAAW,EAAExC,KAAKiB,QAAQ,CAAC,cAAc,EAAEjB,KAAKe,IAAI,CAAC,iHAAiH,CAAC;QAE5K;IACF;IAEA,IAAIe,OAAO;QACT,MAAMsB,YAAY,AAAC,CAAA,MAAMnB,kBAAiB,EAAGoB,MAAM;QACnD,IAAI,CAACD,WAAW;YACdlD,OAAOsC,IAAI,CAAC;QACd;IACF;IAEA,IAAItC,OAAOiB,MAAM,GAAG,GAAG;QACrBlB,IAAI4C,OAAO,CAACC,MAAM,CAACQ,KAAK,CAACpD,OAAOqD,IAAI,CAAC;QACrC,MAAM,IAAI7E,gBAAgB;YACxBwB,QAAQ;gBAAC;oBAAEoB,SAASpB,OAAOqD,IAAI,CAAC;oBAAOhC,MAAM;gBAAO;aAAE;QACxD;IACF;IAEA,OAAOW;AACT,EAAC;AAED,OAAO,MAAMsB,gCAAgC,OAAO,EAClDzD,UAAU,EACVgC,QAAQ,EACR0B,WAAW,CAAC,EACZ7D,QAAQ,EACRK,GAAG,EAOJ;IACC,MAAMJ,sBAAsB;QAC1BC,mBAAmB;QACnBC;QACAC,MAAM;YACJe,MAAMgB;YACNL,MAAMgC,OAAOC,KAAK,CAAC;YACnB1C,UAAUrB;YACVgE,MAAMH;QACR;QACAxD;IACF;AACF,EAAC"}

package/dist/uploads/clientUploadReceipt.d.ts

@@ -0,0 +1,29 @@
+import type { PayloadRequest } from '../types/index.js';
+type ClientUploadReceipt = {
+    _objectKey?: string;
+    allowOverwrite?: boolean;
+    collectionSlug: string;
+    expiresAt: number;
+    filename: string;
+    filePrefix: string;
+    storageFilePath: string;
+    userCollection: null | string;
+    userID: null | number | string;
+};
+export declare const createClientUploadReceipt: ({ _objectKey, allowOverwrite, collectionSlug, filename, filePrefix, req, storageFilePath, }: {
+    _objectKey?: string;
+    allowOverwrite?: boolean;
+    collectionSlug: string;
+    filename: string;
+    filePrefix: string;
+    req: PayloadRequest;
+    storageFilePath: string;
+}) => `${string}.${string}`;
+export declare const verifyClientUploadReceipt: ({ collectionSlug, filename, req, signedReceipt, }: {
+    collectionSlug?: string;
+    filename?: string;
+    req: PayloadRequest;
+    signedReceipt: unknown;
+}) => ClientUploadReceipt;
+export {};
+//# sourceMappingURL=clientUploadReceipt.d.ts.map

package/dist/uploads/clientUploadReceipt.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"clientUploadReceipt.d.ts","sourceRoot":"","sources":["../../src/uploads/clientUploadReceipt.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAA;AAIvD,KAAK,mBAAmB,GAAG;IACzB,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,cAAc,CAAC,EAAE,OAAO,CAAA;IACxB,cAAc,EAAE,MAAM,CAAA;IACtB,SAAS,EAAE,MAAM,CAAA;IACjB,QAAQ,EAAE,MAAM,CAAA;IAChB,UAAU,EAAE,MAAM,CAAA;IAClB,eAAe,EAAE,MAAM,CAAA;IACvB,cAAc,EAAE,IAAI,GAAG,MAAM,CAAA;IAC7B,MAAM,EAAE,IAAI,GAAG,MAAM,GAAG,MAAM,CAAA;CAC/B,CAAA;AAOD,eAAO,MAAM,yBAAyB,gGAQnC;IACD,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,cAAc,CAAC,EAAE,OAAO,CAAA;IACxB,cAAc,EAAE,MAAM,CAAA;IACtB,QAAQ,EAAE,MAAM,CAAA;IAChB,UAAU,EAAE,MAAM,CAAA;IAClB,GAAG,EAAE,cAAc,CAAA;IACnB,eAAe,EAAE,MAAM,CAAA;CACxB,KAAG,GAAG,MAAM,IAAI,MAAM,EActB,CAAA;AAED,eAAO,MAAM,yBAAyB,sDAKnC;IACD,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,GAAG,EAAE,cAAc,CAAA;IACnB,aAAa,EAAE,OAAO,CAAA;CACvB,KAAG,mBA+BH,CAAA"}

package/dist/uploads/clientUploadReceipt.js

@@ -0,0 +1,76 @@
+import crypto from 'node:crypto';
+import { APIError } from '../errors/APIError.js';
+// Longer than the longest provider upload URL (GCS: five hours).
+const LIFETIME_MS = 6 * 60 * 60 * 1000;
+// Separates these signatures from any future receipt format.
+const DOMAIN = 'payload-client-upload-receipt-v1';
+export const createClientUploadReceipt = ({ _objectKey, allowOverwrite, collectionSlug, filename, filePrefix, req, storageFilePath })=>{
+    const data = {
+        ..._objectKey !== undefined && {
+            _objectKey
+        },
+        ...allowOverwrite && {
+            allowOverwrite: true
+        },
+        collectionSlug,
+        expiresAt: Date.now() + LIFETIME_MS,
+        filename,
+        filePrefix,
+        storageFilePath,
+        ...getUser(req)
+    };
+    const encodedReceipt = Buffer.from(JSON.stringify(data)).toString('base64url');
+    return `${encodedReceipt}.${sign({
+        encodedReceipt,
+        secret: req.payload.secret
+    })}`;
+};
+export const verifyClientUploadReceipt = ({ collectionSlug, filename, req, signedReceipt })=>{
+    if (typeof signedReceipt !== 'string') {
+        throwInvalidReference();
+    }
+    const [encodedReceipt, signature, extra] = signedReceipt.split('.');
+    const expected = encodedReceipt ? sign({
+        encodedReceipt,
+        secret: req.payload.secret
+    }) : '';
+    if (!encodedReceipt || !signature || extra || !equal({
+        actual: signature,
+        expected
+    })) {
+        throwInvalidReference();
+    }
+    let decodedReceipt;
+    try {
+        decodedReceipt = JSON.parse(Buffer.from(encodedReceipt, 'base64url').toString());
+    } catch  {
+        throwInvalidReference();
+    }
+    const user = getUser(req);
+    if (!isReceipt(decodedReceipt) || decodedReceipt.expiresAt <= Date.now() || decodedReceipt.userCollection !== user.userCollection || decodedReceipt.userID !== user.userID || collectionSlug !== undefined && decodedReceipt.collectionSlug !== collectionSlug || filename !== undefined && decodedReceipt.filename !== filename) {
+        throwInvalidReference();
+    }
+    return decodedReceipt;
+};
+function throwInvalidReference() {
+    throw new APIError('Invalid upload reference.', 400);
+}
+const getUser = (req)=>({
+        userCollection: req.user?.collection ?? null,
+        userID: req.user?.id ?? null
+    });
+const sign = ({ encodedReceipt, secret })=>crypto.createHmac('sha256', `${DOMAIN}:${secret}`).update(encodedReceipt).digest('base64url');
+const equal = ({ actual, expected })=>{
+    const actualBuffer = Buffer.from(actual);
+    const expectedBuffer = Buffer.from(expected);
+    return actualBuffer.length === expectedBuffer.length && crypto.timingSafeEqual(actualBuffer, expectedBuffer);
+};
+const isReceipt = (value)=>{
+    if (!value || typeof value !== 'object') {
+        return false;
+    }
+    const data = value;
+    return (data._objectKey === undefined || typeof data._objectKey === 'string') && (data.allowOverwrite === undefined || typeof data.allowOverwrite === 'boolean') && typeof data.collectionSlug === 'string' && typeof data.expiresAt === 'number' && Number.isFinite(data.expiresAt) && typeof data.storageFilePath === 'string' && typeof data.filePrefix === 'string' && typeof data.filename === 'string' && (data.userCollection === null || typeof data.userCollection === 'string') && (data.userID === null || typeof data.userID === 'string' || typeof data.userID === 'number' && Number.isFinite(data.userID));
+};
+
+//# sourceMappingURL=clientUploadReceipt.js.map

package/dist/uploads/clientUploadReceipt.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/uploads/clientUploadReceipt.ts"],"sourcesContent":["import crypto from 'node:crypto'\n\nimport type { PayloadRequest } from '../types/index.js'\n\nimport { APIError } from '../errors/APIError.js'\n\ntype ClientUploadReceipt = {\n  _objectKey?: string\n  allowOverwrite?: boolean\n  collectionSlug: string\n  expiresAt: number\n  filename: string\n  filePrefix: string\n  storageFilePath: string\n  userCollection: null | string\n  userID: null | number | string\n}\n\n// Longer than the longest provider upload URL (GCS: five hours).\nconst LIFETIME_MS = 6 * 60 * 60 * 1000\n// Separates these signatures from any future receipt format.\nconst DOMAIN = 'payload-client-upload-receipt-v1'\n\nexport const createClientUploadReceipt = ({\n  _objectKey,\n  allowOverwrite,\n  collectionSlug,\n  filename,\n  filePrefix,\n  req,\n  storageFilePath,\n}: {\n  _objectKey?: string\n  allowOverwrite?: boolean\n  collectionSlug: string\n  filename: string\n  filePrefix: string\n  req: PayloadRequest\n  storageFilePath: string\n}): `${string}.${string}` => {\n  const data: ClientUploadReceipt = {\n    ...(_objectKey !== undefined && { _objectKey }),\n    ...(allowOverwrite && { allowOverwrite: true }),\n    collectionSlug,\n    expiresAt: Date.now() + LIFETIME_MS,\n    filename,\n    filePrefix,\n    storageFilePath,\n    ...getUser(req),\n  }\n  const encodedReceipt = Buffer.from(JSON.stringify(data)).toString('base64url')\n\n  return `${encodedReceipt}.${sign({ encodedReceipt, secret: req.payload.secret })}`\n}\n\nexport const verifyClientUploadReceipt = ({\n  collectionSlug,\n  filename,\n  req,\n  signedReceipt,\n}: {\n  collectionSlug?: string\n  filename?: string\n  req: PayloadRequest\n  signedReceipt: unknown\n}): ClientUploadReceipt => {\n  if (typeof signedReceipt !== 'string') {\n    throwInvalidReference()\n  }\n  const [encodedReceipt, signature, extra] = signedReceipt.split('.')\n  const expected = encodedReceipt ? sign({ encodedReceipt, secret: req.payload.secret }) : ''\n\n  if (!encodedReceipt || !signature || extra || !equal({ actual: signature, expected })) {\n    throwInvalidReference()\n  }\n\n  let decodedReceipt: unknown\n  try {\n    decodedReceipt = JSON.parse(Buffer.from(encodedReceipt, 'base64url').toString())\n  } catch {\n    throwInvalidReference()\n  }\n\n  const user = getUser(req)\n  if (\n    !isReceipt(decodedReceipt) ||\n    decodedReceipt.expiresAt <= Date.now() ||\n    decodedReceipt.userCollection !== user.userCollection ||\n    decodedReceipt.userID !== user.userID ||\n    (collectionSlug !== undefined && decodedReceipt.collectionSlug !== collectionSlug) ||\n    (filename !== undefined && decodedReceipt.filename !== filename)\n  ) {\n    throwInvalidReference()\n  }\n\n  return decodedReceipt\n}\n\nfunction throwInvalidReference(): never {\n  throw new APIError('Invalid upload reference.', 400)\n}\n\nconst getUser = (req: PayloadRequest) => ({\n  userCollection: req.user?.collection ?? null,\n  userID: req.user?.id ?? null,\n})\n\nconst sign = ({ encodedReceipt, secret }: { encodedReceipt: string; secret: string }) =>\n  crypto.createHmac('sha256', `${DOMAIN}:${secret}`).update(encodedReceipt).digest('base64url')\n\nconst equal = ({ actual, expected }: { actual: string; expected: string }) => {\n  const actualBuffer = Buffer.from(actual)\n  const expectedBuffer = Buffer.from(expected)\n  return (\n    actualBuffer.length === expectedBuffer.length &&\n    crypto.timingSafeEqual(actualBuffer, expectedBuffer)\n  )\n}\n\nconst isReceipt = (value: unknown): value is ClientUploadReceipt => {\n  if (!value || typeof value !== 'object') {\n    return false\n  }\n  const data = value as Partial<ClientUploadReceipt>\n  return (\n    (data._objectKey === undefined || typeof data._objectKey === 'string') &&\n    (data.allowOverwrite === undefined || typeof data.allowOverwrite === 'boolean') &&\n    typeof data.collectionSlug === 'string' &&\n    typeof data.expiresAt === 'number' &&\n    Number.isFinite(data.expiresAt) &&\n    typeof data.storageFilePath === 'string' &&\n    typeof data.filePrefix === 'string' &&\n    typeof data.filename === 'string' &&\n    (data.userCollection === null || typeof data.userCollection === 'string') &&\n    (data.userID === null ||\n      typeof data.userID === 'string' ||\n      (typeof data.userID === 'number' && Number.isFinite(data.userID)))\n  )\n}\n"],"names":["crypto","APIError","LIFETIME_MS","DOMAIN","createClientUploadReceipt","_objectKey","allowOverwrite","collectionSlug","filename","filePrefix","req","storageFilePath","data","undefined","expiresAt","Date","now","getUser","encodedReceipt","Buffer","from","JSON","stringify","toString","sign","secret","payload","verifyClientUploadReceipt","signedReceipt","throwInvalidReference","signature","extra","split","expected","equal","actual","decodedReceipt","parse","user","isReceipt","userCollection","userID","collection","id","createHmac","update","digest","actualBuffer","expectedBuffer","length","timingSafeEqual","value","Number","isFinite"],"mappings":"AAAA,OAAOA,YAAY,cAAa;AAIhC,SAASC,QAAQ,QAAQ,wBAAuB;AAchD,iEAAiE;AACjE,MAAMC,cAAc,IAAI,KAAK,KAAK;AAClC,6DAA6D;AAC7D,MAAMC,SAAS;AAEf,OAAO,MAAMC,4BAA4B,CAAC,EACxCC,UAAU,EACVC,cAAc,EACdC,cAAc,EACdC,QAAQ,EACRC,UAAU,EACVC,GAAG,EACHC,eAAe,EAShB;IACC,MAAMC,OAA4B;QAChC,GAAIP,eAAeQ,aAAa;YAAER;QAAW,CAAC;QAC9C,GAAIC,kBAAkB;YAAEA,gBAAgB;QAAK,CAAC;QAC9CC;QACAO,WAAWC,KAAKC,GAAG,KAAKd;QACxBM;QACAC;QACAE;QACA,GAAGM,QAAQP,IAAI;IACjB;IACA,MAAMQ,iBAAiBC,OAAOC,IAAI,CAACC,KAAKC,SAAS,CAACV,OAAOW,QAAQ,CAAC;IAElE,OAAO,GAAGL,eAAe,CAAC,EAAEM,KAAK;QAAEN;QAAgBO,QAAQf,IAAIgB,OAAO,CAACD,MAAM;IAAC,IAAI;AACpF,EAAC;AAED,OAAO,MAAME,4BAA4B,CAAC,EACxCpB,cAAc,EACdC,QAAQ,EACRE,GAAG,EACHkB,aAAa,EAMd;IACC,IAAI,OAAOA,kBAAkB,UAAU;QACrCC;IACF;IACA,MAAM,CAACX,gBAAgBY,WAAWC,MAAM,GAAGH,cAAcI,KAAK,CAAC;IAC/D,MAAMC,WAAWf,iBAAiBM,KAAK;QAAEN;QAAgBO,QAAQf,IAAIgB,OAAO,CAACD,MAAM;IAAC,KAAK;IAEzF,IAAI,CAACP,kBAAkB,CAACY,aAAaC,SAAS,CAACG,MAAM;QAAEC,QAAQL;QAAWG;IAAS,IAAI;QACrFJ;IACF;IAEA,IAAIO;IACJ,IAAI;QACFA,iBAAiBf,KAAKgB,KAAK,CAAClB,OAAOC,IAAI,CAACF,gBAAgB,aAAaK,QAAQ;IAC/E,EAAE,OAAM;QACNM;IACF;IAEA,MAAMS,OAAOrB,QAAQP;IACrB,IACE,CAAC6B,UAAUH,mBACXA,eAAetB,SAAS,IAAIC,KAAKC,GAAG,MACpCoB,eAAeI,cAAc,KAAKF,KAAKE,cAAc,IACrDJ,eAAeK,MAAM,KAAKH,KAAKG,MAAM,IACpClC,mBAAmBM,aAAauB,eAAe7B,cAAc,KAAKA,kBAClEC,aAAaK,aAAauB,eAAe5B,QAAQ,KAAKA,UACvD;QACAqB;IACF;IAEA,OAAOO;AACT,EAAC;AAED,SAASP;IACP,MAAM,IAAI5B,SAAS,6BAA6B;AAClD;AAEA,MAAMgB,UAAU,CAACP,MAAyB,CAAA;QACxC8B,gBAAgB9B,IAAI4B,IAAI,EAAEI,cAAc;QACxCD,QAAQ/B,IAAI4B,IAAI,EAAEK,MAAM;IAC1B,CAAA;AAEA,MAAMnB,OAAO,CAAC,EAAEN,cAAc,EAAEO,MAAM,EAA8C,GAClFzB,OAAO4C,UAAU,CAAC,UAAU,GAAGzC,OAAO,CAAC,EAAEsB,QAAQ,EAAEoB,MAAM,CAAC3B,gBAAgB4B,MAAM,CAAC;AAEnF,MAAMZ,QAAQ,CAAC,EAAEC,MAAM,EAAEF,QAAQ,EAAwC;IACvE,MAAMc,eAAe5B,OAAOC,IAAI,CAACe;IACjC,MAAMa,iBAAiB7B,OAAOC,IAAI,CAACa;IACnC,OACEc,aAAaE,MAAM,KAAKD,eAAeC,MAAM,IAC7CjD,OAAOkD,eAAe,CAACH,cAAcC;AAEzC;AAEA,MAAMT,YAAY,CAACY;IACjB,IAAI,CAACA,SAAS,OAAOA,UAAU,UAAU;QACvC,OAAO;IACT;IACA,MAAMvC,OAAOuC;IACb,OACE,AAACvC,CAAAA,KAAKP,UAAU,KAAKQ,aAAa,OAAOD,KAAKP,UAAU,KAAK,QAAO,KACnEO,CAAAA,KAAKN,cAAc,KAAKO,aAAa,OAAOD,KAAKN,cAAc,KAAK,SAAQ,KAC7E,OAAOM,KAAKL,cAAc,KAAK,YAC/B,OAAOK,KAAKE,SAAS,KAAK,YAC1BsC,OAAOC,QAAQ,CAACzC,KAAKE,SAAS,KAC9B,OAAOF,KAAKD,eAAe,KAAK,YAChC,OAAOC,KAAKH,UAAU,KAAK,YAC3B,OAAOG,KAAKJ,QAAQ,KAAK,YACxBI,CAAAA,KAAK4B,cAAc,KAAK,QAAQ,OAAO5B,KAAK4B,cAAc,KAAK,QAAO,KACtE5B,CAAAA,KAAK6B,MAAM,KAAK,QACf,OAAO7B,KAAK6B,MAAM,KAAK,YACtB,OAAO7B,KAAK6B,MAAM,KAAK,YAAYW,OAAOC,QAAQ,CAACzC,KAAK6B,MAAM,CAAC;AAEtE"}

package/dist/uploads/deleteAssociatedFiles.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"deleteAssociatedFiles.d.ts","sourceRoot":"","sources":["../../src/uploads/deleteAssociatedFiles.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,gCAAgC,CAAA;AAC/E,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAA;AACzD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAA;AACvD,OAAO,KAAK,EAAY,UAAU,EAAE,MAAM,YAAY,CAAA;AAKtD,KAAK,IAAI,GAAG;IACV,gBAAgB,EAAE,yBAAyB,CAAA;IAC3C,MAAM,EAAE,eAAe,CAAA;IACvB,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAC5B,KAAK,CAAC,EAAE,UAAU,EAAE,CAAA;IACpB,cAAc,EAAE,OAAO,CAAA;IACvB,GAAG,EAAE,cAAc,CAAA;CACpB,CAAA;AAED,eAAO,MAAM,qBAAqB,EAAE,CAAC,IAAI,EAAE,IAAI,KAAK,OAAO,CAAC,IAAI,CAyC/D,CAAA"}
+{"version":3,"file":"deleteAssociatedFiles.d.ts","sourceRoot":"","sources":["../../src/uploads/deleteAssociatedFiles.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,gCAAgC,CAAA;AAC/E,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAA;AACzD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAA;AACvD,OAAO,KAAK,EAAY,UAAU,EAAE,MAAM,YAAY,CAAA;AAOtD,KAAK,IAAI,GAAG;IACV,gBAAgB,EAAE,yBAAyB,CAAA;IAC3C,MAAM,EAAE,eAAe,CAAA;IACvB,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAC5B,KAAK,CAAC,EAAE,UAAU,EAAE,CAAA;IACpB,cAAc,EAAE,OAAO,CAAA;IACvB,GAAG,EAAE,cAAc,CAAA;CACpB,CAAA;AAED,eAAO,MAAM,qBAAqB,EAAE,CAAC,IAAI,EAAE,IAAI,KAAK,OAAO,CAAC,IAAI,CA8C/D,CAAA"}

package/dist/uploads/deleteAssociatedFiles.js

@@ -1,31 +1,50 @@
 import fs from 'fs/promises';
-import { ErrorDeletingFile } from '../errors/index.js';
+import path from 'path';
+import { APIError, ErrorDeletingFile } from '../errors/index.js';
+import { httpStatus } from '../utilities/httpStatus.js';
 import { fileExists } from './fileExists.js';
-export const deleteAssociatedFiles = async ({ collectionConfig, doc, files = [], overrideDelete, req })=>{
+import { withLegacyUploadFileData } from './fileVersioning/storedFiles.js';
+export const deleteAssociatedFiles = async ({ collectionConfig, config, doc, files = [], overrideDelete, req })=>{
     if (!collectionConfig.upload) {
         return;
     }
+    const stored = withLegacyUploadFileData({
+        collection: collectionConfig,
+        config,
+        doc
+    });
+    if (collectionConfig.versions || stored.original) {
+        return;
+    }
     if (overrideDelete || files.length > 0) {
         const { staticDir: staticPath } = collectionConfig.upload;
-        const fileToDelete = `${staticPath}/${doc.filename}`;
+        const fileToDelete = resolveFilePath({
+            filename: doc.filename,
+            staticPath
+        });
         try {
-            if (await fileExists(fileToDelete)) {
-                await fs.unlink(fileToDelete);
-            }
+            await deleteFile({
+                filePath: fileToDelete,
+                staticPath
+            });
         } catch (ignore) {
             throw new ErrorDeletingFile(req.t);
         }
-        if (doc.sizes) {
-            const sizes = Object.values(doc.sizes);
+        if (doc.variants) {
+            const sizes = Object.values(doc.variants);
             // Since forEach will not wait until unlink is finished it could
             // happen that two operations will try to delete the same file.
             // To avoid this it is recommended to use "sync" instead
             for (const size of sizes){
-                const sizeToDelete = `${staticPath}/${size.filename}`;
+                const sizeToDelete = resolveFilePath({
+                    filename: size.filename,
+                    staticPath
+                });
                 try {
-                    if (await fileExists(sizeToDelete)) {
-                        await fs.unlink(sizeToDelete);
-                    }
+                    await deleteFile({
+                        filePath: sizeToDelete,
+                        staticPath
+                    });
                 } catch (ignore) {
                     throw new ErrorDeletingFile(req.t);
                 }
@@ -33,5 +52,43 @@ export const deleteAssociatedFiles = async ({ collectionConfig, doc, files = [],
         }
     }
 };
+const resolveFilePath = ({ filename, staticPath })=>{
+    if (!filename || !staticPath) {
+        return;
+    }
+    const resolvedDir = path.resolve(staticPath);
+    const filePath = path.resolve(resolvedDir, filename);
+    if (!isWithinDirectory({
+        directory: resolvedDir,
+        target: filePath
+    })) {
+        throw new APIError('Invalid filename.', httpStatus.BAD_REQUEST);
+    }
+    return filePath;
+};
+const deleteFile = async ({ filePath, staticPath })=>{
+    if (!filePath || !staticPath) {
+        return;
+    }
+    if (!await fileExists(filePath)) {
+        return;
+    }
+    const [resolvedDir, resolvedParent] = await Promise.all([
+        fs.realpath(staticPath),
+        fs.realpath(path.dirname(filePath))
+    ]);
+    const resolvedTarget = path.join(resolvedParent, path.basename(filePath));
+    if (!isWithinDirectory({
+        directory: resolvedDir,
+        target: resolvedTarget
+    })) {
+        throw new APIError('Invalid filename.', httpStatus.BAD_REQUEST);
+    }
+    await fs.unlink(filePath);
+};
+const isWithinDirectory = ({ directory, target })=>{
+    const relativePath = path.relative(directory, target);
+    return relativePath === '' || relativePath !== '..' && !relativePath.startsWith(`..${path.sep}`) && !path.isAbsolute(relativePath);
+};
 
 //# sourceMappingURL=deleteAssociatedFiles.js.map

package/dist/uploads/deleteAssociatedFiles.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/uploads/deleteAssociatedFiles.ts"],"sourcesContent":["import fs from 'fs/promises'\n\nimport type { SanitizedCollectionConfig } from '../collections/config/types.js'\nimport type { SanitizedConfig } from '../config/types.js'\nimport type { PayloadRequest } from '../types/index.js'\nimport type { FileData, FileToSave } from './types.js'\n\nimport { ErrorDeletingFile } from '../errors/index.js'\nimport { fileExists } from './fileExists.js'\n\ntype Args = {\n  collectionConfig: SanitizedCollectionConfig\n  config: SanitizedConfig\n  doc: Record<string, unknown>\n  files?: FileToSave[]\n  overrideDelete: boolean\n  req: PayloadRequest\n}\n\nexport const deleteAssociatedFiles: (args: Args) => Promise<void> = async ({\n  collectionConfig,\n  doc,\n  files = [],\n  overrideDelete,\n  req,\n}) => {\n  if (!collectionConfig.upload) {\n    return\n  }\n  if (overrideDelete || files.length > 0) {\n    const { staticDir: staticPath } = collectionConfig.upload\n\n    const fileToDelete = `${staticPath}/${doc.filename as string}`\n\n    try {\n      if (await fileExists(fileToDelete)) {\n        await fs.unlink(fileToDelete)\n      }\n    } catch (ignore) {\n      throw new ErrorDeletingFile(req.t)\n    }\n\n    if (doc.sizes) {\n      const sizes: FileData[] = Object.values(doc.sizes)\n      // Since forEach will not wait until unlink is finished it could\n      // happen that two operations will try to delete the same file.\n      // To avoid this it is recommended to use \"sync\" instead\n\n      for (const size of sizes) {\n        const sizeToDelete = `${staticPath}/${size.filename}`\n        try {\n          if (await fileExists(sizeToDelete)) {\n            await fs.unlink(sizeToDelete)\n          }\n        } catch (ignore) {\n          throw new ErrorDeletingFile(req.t)\n        }\n      }\n    }\n  }\n}\n"],"names":["fs","ErrorDeletingFile","fileExists","deleteAssociatedFiles","collectionConfig","doc","files","overrideDelete","req","upload","length","staticDir","staticPath","fileToDelete","filename","unlink","ignore","t","sizes","Object","values","size","sizeToDelete"],"mappings":"AAAA,OAAOA,QAAQ,cAAa;AAO5B,SAASC,iBAAiB,QAAQ,qBAAoB;AACtD,SAASC,UAAU,QAAQ,kBAAiB;AAW5C,OAAO,MAAMC,wBAAuD,OAAO,EACzEC,gBAAgB,EAChBC,GAAG,EACHC,QAAQ,EAAE,EACVC,cAAc,EACdC,GAAG,EACJ;IACC,IAAI,CAACJ,iBAAiBK,MAAM,EAAE;QAC5B;IACF;IACA,IAAIF,kBAAkBD,MAAMI,MAAM,GAAG,GAAG;QACtC,MAAM,EAAEC,WAAWC,UAAU,EAAE,GAAGR,iBAAiBK,MAAM;QAEzD,MAAMI,eAAe,GAAGD,WAAW,CAAC,EAAEP,IAAIS,QAAQ,EAAY;QAE9D,IAAI;YACF,IAAI,MAAMZ,WAAWW,eAAe;gBAClC,MAAMb,GAAGe,MAAM,CAACF;YAClB;QACF,EAAE,OAAOG,QAAQ;YACf,MAAM,IAAIf,kBAAkBO,IAAIS,CAAC;QACnC;QAEA,IAAIZ,IAAIa,KAAK,EAAE;YACb,MAAMA,QAAoBC,OAAOC,MAAM,CAACf,IAAIa,KAAK;YACjD,gEAAgE;YAChE,+DAA+D;YAC/D,wDAAwD;YAExD,KAAK,MAAMG,QAAQH,MAAO;gBACxB,MAAMI,eAAe,GAAGV,WAAW,CAAC,EAAES,KAAKP,QAAQ,EAAE;gBACrD,IAAI;oBACF,IAAI,MAAMZ,WAAWoB,eAAe;wBAClC,MAAMtB,GAAGe,MAAM,CAACO;oBAClB;gBACF,EAAE,OAAON,QAAQ;oBACf,MAAM,IAAIf,kBAAkBO,IAAIS,CAAC;gBACnC;YACF;QACF;IACF;AACF,EAAC"}
+{"version":3,"sources":["../../src/uploads/deleteAssociatedFiles.ts"],"sourcesContent":["import fs from 'fs/promises'\nimport path from 'path'\n\nimport type { SanitizedCollectionConfig } from '../collections/config/types.js'\nimport type { SanitizedConfig } from '../config/types.js'\nimport type { PayloadRequest } from '../types/index.js'\nimport type { FileData, FileToSave } from './types.js'\n\nimport { APIError, ErrorDeletingFile } from '../errors/index.js'\nimport { httpStatus } from '../utilities/httpStatus.js'\nimport { fileExists } from './fileExists.js'\nimport { withLegacyUploadFileData } from './fileVersioning/storedFiles.js'\n\ntype Args = {\n  collectionConfig: SanitizedCollectionConfig\n  config: SanitizedConfig\n  doc: Record<string, unknown>\n  files?: FileToSave[]\n  overrideDelete: boolean\n  req: PayloadRequest\n}\n\nexport const deleteAssociatedFiles: (args: Args) => Promise<void> = async ({\n  collectionConfig,\n  config,\n  doc,\n  files = [],\n  overrideDelete,\n  req,\n}) => {\n  if (!collectionConfig.upload) {\n    return\n  }\n  const stored = withLegacyUploadFileData({ collection: collectionConfig, config, doc })\n\n  if (collectionConfig.versions || stored.original) {\n    return\n  }\n  if (overrideDelete || files.length > 0) {\n    const { staticDir: staticPath } = collectionConfig.upload\n\n    const fileToDelete = resolveFilePath({\n      filename: doc.filename as string,\n      staticPath,\n    })\n\n    try {\n      await deleteFile({ filePath: fileToDelete, staticPath })\n    } catch (ignore) {\n      throw new ErrorDeletingFile(req.t)\n    }\n\n    if (doc.variants) {\n      const sizes: FileData[] = Object.values(doc.variants)\n      // Since forEach will not wait until unlink is finished it could\n      // happen that two operations will try to delete the same file.\n      // To avoid this it is recommended to use \"sync\" instead\n\n      for (const size of sizes) {\n        const sizeToDelete = resolveFilePath({ filename: size.filename, staticPath })\n        try {\n          await deleteFile({ filePath: sizeToDelete, staticPath })\n        } catch (ignore) {\n          throw new ErrorDeletingFile(req.t)\n        }\n      }\n    }\n  }\n}\n\nconst resolveFilePath = ({\n  filename,\n  staticPath,\n}: {\n  filename?: null | string\n  staticPath?: string\n}) => {\n  if (!filename || !staticPath) {\n    return\n  }\n\n  const resolvedDir = path.resolve(staticPath)\n  const filePath = path.resolve(resolvedDir, filename)\n\n  if (!isWithinDirectory({ directory: resolvedDir, target: filePath })) {\n    throw new APIError('Invalid filename.', httpStatus.BAD_REQUEST)\n  }\n\n  return filePath\n}\n\nconst deleteFile = async ({ filePath, staticPath }: { filePath?: string; staticPath?: string }) => {\n  if (!filePath || !staticPath) {\n    return\n  }\n\n  if (!(await fileExists(filePath))) {\n    return\n  }\n\n  const [resolvedDir, resolvedParent] = await Promise.all([\n    fs.realpath(staticPath),\n    fs.realpath(path.dirname(filePath)),\n  ])\n  const resolvedTarget = path.join(resolvedParent, path.basename(filePath))\n\n  if (!isWithinDirectory({ directory: resolvedDir, target: resolvedTarget })) {\n    throw new APIError('Invalid filename.', httpStatus.BAD_REQUEST)\n  }\n\n  await fs.unlink(filePath)\n}\n\nconst isWithinDirectory = ({ directory, target }: { directory: string; target: string }) => {\n  const relativePath = path.relative(directory, target)\n\n  return (\n    relativePath === '' ||\n    (relativePath !== '..' &&\n      !relativePath.startsWith(`..${path.sep}`) &&\n      !path.isAbsolute(relativePath))\n  )\n}\n"],"names":["fs","path","APIError","ErrorDeletingFile","httpStatus","fileExists","withLegacyUploadFileData","deleteAssociatedFiles","collectionConfig","config","doc","files","overrideDelete","req","upload","stored","collection","versions","original","length","staticDir","staticPath","fileToDelete","resolveFilePath","filename","deleteFile","filePath","ignore","t","variants","sizes","Object","values","size","sizeToDelete","resolvedDir","resolve","isWithinDirectory","directory","target","BAD_REQUEST","resolvedParent","Promise","all","realpath","dirname","resolvedTarget","join","basename","unlink","relativePath","relative","startsWith","sep","isAbsolute"],"mappings":"AAAA,OAAOA,QAAQ,cAAa;AAC5B,OAAOC,UAAU,OAAM;AAOvB,SAASC,QAAQ,EAAEC,iBAAiB,QAAQ,qBAAoB;AAChE,SAASC,UAAU,QAAQ,6BAA4B;AACvD,SAASC,UAAU,QAAQ,kBAAiB;AAC5C,SAASC,wBAAwB,QAAQ,kCAAiC;AAW1E,OAAO,MAAMC,wBAAuD,OAAO,EACzEC,gBAAgB,EAChBC,MAAM,EACNC,GAAG,EACHC,QAAQ,EAAE,EACVC,cAAc,EACdC,GAAG,EACJ;IACC,IAAI,CAACL,iBAAiBM,MAAM,EAAE;QAC5B;IACF;IACA,MAAMC,SAAST,yBAAyB;QAAEU,YAAYR;QAAkBC;QAAQC;IAAI;IAEpF,IAAIF,iBAAiBS,QAAQ,IAAIF,OAAOG,QAAQ,EAAE;QAChD;IACF;IACA,IAAIN,kBAAkBD,MAAMQ,MAAM,GAAG,GAAG;QACtC,MAAM,EAAEC,WAAWC,UAAU,EAAE,GAAGb,iBAAiBM,MAAM;QAEzD,MAAMQ,eAAeC,gBAAgB;YACnCC,UAAUd,IAAIc,QAAQ;YACtBH;QACF;QAEA,IAAI;YACF,MAAMI,WAAW;gBAAEC,UAAUJ;gBAAcD;YAAW;QACxD,EAAE,OAAOM,QAAQ;YACf,MAAM,IAAIxB,kBAAkBU,IAAIe,CAAC;QACnC;QAEA,IAAIlB,IAAImB,QAAQ,EAAE;YAChB,MAAMC,QAAoBC,OAAOC,MAAM,CAACtB,IAAImB,QAAQ;YACpD,gEAAgE;YAChE,+DAA+D;YAC/D,wDAAwD;YAExD,KAAK,MAAMI,QAAQH,MAAO;gBACxB,MAAMI,eAAeX,gBAAgB;oBAAEC,UAAUS,KAAKT,QAAQ;oBAAEH;gBAAW;gBAC3E,IAAI;oBACF,MAAMI,WAAW;wBAAEC,UAAUQ;wBAAcb;oBAAW;gBACxD,EAAE,OAAOM,QAAQ;oBACf,MAAM,IAAIxB,kBAAkBU,IAAIe,CAAC;gBACnC;YACF;QACF;IACF;AACF,EAAC;AAED,MAAML,kBAAkB,CAAC,EACvBC,QAAQ,EACRH,UAAU,EAIX;IACC,IAAI,CAACG,YAAY,CAACH,YAAY;QAC5B;IACF;IAEA,MAAMc,cAAclC,KAAKmC,OAAO,CAACf;IACjC,MAAMK,WAAWzB,KAAKmC,OAAO,CAACD,aAAaX;IAE3C,IAAI,CAACa,kBAAkB;QAAEC,WAAWH;QAAaI,QAAQb;IAAS,IAAI;QACpE,MAAM,IAAIxB,SAAS,qBAAqBE,WAAWoC,WAAW;IAChE;IAEA,OAAOd;AACT;AAEA,MAAMD,aAAa,OAAO,EAAEC,QAAQ,EAAEL,UAAU,EAA8C;IAC5F,IAAI,CAACK,YAAY,CAACL,YAAY;QAC5B;IACF;IAEA,IAAI,CAAE,MAAMhB,WAAWqB,WAAY;QACjC;IACF;IAEA,MAAM,CAACS,aAAaM,eAAe,GAAG,MAAMC,QAAQC,GAAG,CAAC;QACtD3C,GAAG4C,QAAQ,CAACvB;QACZrB,GAAG4C,QAAQ,CAAC3C,KAAK4C,OAAO,CAACnB;KAC1B;IACD,MAAMoB,iBAAiB7C,KAAK8C,IAAI,CAACN,gBAAgBxC,KAAK+C,QAAQ,CAACtB;IAE/D,IAAI,CAACW,kBAAkB;QAAEC,WAAWH;QAAaI,QAAQO;IAAe,IAAI;QAC1E,MAAM,IAAI5C,SAAS,qBAAqBE,WAAWoC,WAAW;IAChE;IAEA,MAAMxC,GAAGiD,MAAM,CAACvB;AAClB;AAEA,MAAMW,oBAAoB,CAAC,EAAEC,SAAS,EAAEC,MAAM,EAAyC;IACrF,MAAMW,eAAejD,KAAKkD,QAAQ,CAACb,WAAWC;IAE9C,OACEW,iBAAiB,MAChBA,iBAAiB,QAChB,CAACA,aAAaE,UAAU,CAAC,CAAC,EAAE,EAAEnD,KAAKoD,GAAG,EAAE,KACxC,CAACpD,KAAKqD,UAAU,CAACJ;AAEvB"}

package/dist/uploads/detectSvgFromXml.d.ts

@@ -1,5 +1,2 @@
-/**
- * Securely detect if an XML buffer contains a valid SVG document
- */
-export declare function detectSvgFromXml(buffer: Buffer): boolean;
+export declare const detectSvgFromXml: (buffer: Buffer) => boolean;
 //# sourceMappingURL=detectSvgFromXml.d.ts.map

package/dist/uploads/detectSvgFromXml.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"detectSvgFromXml.d.ts","sourceRoot":"","sources":["../../src/uploads/detectSvgFromXml.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CA6CxD"}
+{"version":3,"file":"detectSvgFromXml.d.ts","sourceRoot":"","sources":["../../src/uploads/detectSvgFromXml.ts"],"names":[],"mappings":"AAEA,eAAO,MAAM,gBAAgB,WAAY,MAAM,KAAG,OAAmC,CAAA"}