tabby-rdp 0.2.5 → 0.2.6
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +8 -0
- package/dist/fileTransfer.js +20 -3
- package/dist/fileTransfer.js.map +1 -1
- package/package.json +1 -1
package/CHANGELOG.md
CHANGED
|
@@ -1,5 +1,13 @@
|
|
|
1
1
|
# Changelog
|
|
2
2
|
|
|
3
|
+
## 0.2.6
|
|
4
|
+
|
|
5
|
+
**Security**
|
|
6
|
+
- Files copied on the remote desktop are saved inside the folder you save them to (Downloads). Their names come from
|
|
7
|
+
the remote, and a name with `../` and forward slashes could be written elsewhere, such as a folder where macOS
|
|
8
|
+
starts programs at login. Now every part of the path is checked, and a file that would land outside is refused.
|
|
9
|
+
Update if you use **Save to Downloads** with machines you don't fully trust.
|
|
10
|
+
|
|
3
11
|
## 0.2.5
|
|
4
12
|
|
|
5
13
|
**New**
|
package/dist/fileTransfer.js
CHANGED
|
@@ -1,6 +1,7 @@
|
|
|
1
1
|
"use strict";
|
|
2
2
|
Object.defineProperty(exports, "__esModule", { value: true });
|
|
3
3
|
exports.FileTransfer = exports.STYLE = void 0;
|
|
4
|
+
exports.savePath = savePath;
|
|
4
5
|
const fs = require("fs");
|
|
5
6
|
const os = require("os");
|
|
6
7
|
const path = require("path");
|
|
@@ -96,13 +97,11 @@ class FileTransfer {
|
|
|
96
97
|
this.toast(`Saving ${plural(files.filter(f => !f.isDirectory).length, 'file')}…`, [], 0);
|
|
97
98
|
try {
|
|
98
99
|
for (const [index, file] of files.entries()) {
|
|
99
|
-
// Relative paths use `\` (the wire convention); never let one leave the target folder.
|
|
100
|
-
const parts = [...(file.path ?? '').split('\\'), file.name].filter(p => p && p !== '.' && p !== '..');
|
|
101
100
|
if (file.isDirectory) {
|
|
102
101
|
continue;
|
|
103
102
|
}
|
|
103
|
+
const target = uniquePath(savePath(dir, file.path, file.name));
|
|
104
104
|
const blob = await this.provider.downloadFile(file, index).completion;
|
|
105
|
-
const target = uniquePath(path.join(dir, ...parts));
|
|
106
105
|
await fs.promises.mkdir(path.dirname(target), { recursive: true });
|
|
107
106
|
await fs.promises.writeFile(target, Buffer.from(await blob.arrayBuffer()));
|
|
108
107
|
saved.push(target);
|
|
@@ -158,6 +157,24 @@ class FileTransfer {
|
|
|
158
157
|
}
|
|
159
158
|
}
|
|
160
159
|
exports.FileTransfer = FileTransfer;
|
|
160
|
+
/**
|
|
161
|
+
* Where a file the remote offered goes under `dir`, keeping its folder structure. The names come from the remote
|
|
162
|
+
* (a server or anything on it can put them on the clipboard), so every component is cut at both separators (`\\` is
|
|
163
|
+
* the wire convention, but a name may hold `/`), `.`, `..` and drive letters are dropped, and the result must stay
|
|
164
|
+
* inside `dir`: a name like `../../Library/LaunchAgents/x.plist` must not land outside Downloads.
|
|
165
|
+
*/
|
|
166
|
+
function savePath(dir, folder, name) {
|
|
167
|
+
const parts = [folder ?? '', name]
|
|
168
|
+
.flatMap(p => String(p).split(/[\\/]+/))
|
|
169
|
+
.map(p => p.replace(/[\u0000-\u001f]/g, '').replace(/^[A-Za-z]:$/, '').trim())
|
|
170
|
+
.filter(p => p && p !== '.' && p !== '..');
|
|
171
|
+
const root = path.resolve(dir);
|
|
172
|
+
const target = path.resolve(root, ...parts.length ? parts : ['file']);
|
|
173
|
+
if (!target.startsWith(root + path.sep)) {
|
|
174
|
+
throw new Error(`refused a file name that leaves the folder: ${JSON.stringify(name)}`);
|
|
175
|
+
}
|
|
176
|
+
return target;
|
|
177
|
+
}
|
|
161
178
|
/** `file.txt`, or `file 2.txt`, `file 3.txt`… if taken. */
|
|
162
179
|
function uniquePath(target) {
|
|
163
180
|
if (!fs.existsSync(target)) {
|
package/dist/fileTransfer.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"fileTransfer.js","sourceRoot":"","sources":["../src/fileTransfer.ts"],"names":[],"mappings":";;;
|
|
1
|
+
{"version":3,"file":"fileTransfer.js","sourceRoot":"","sources":["../src/fileTransfer.ts"],"names":[],"mappings":";;;AAkLA,4BAWC;AA7LD,yBAAwB;AACxB,yBAAwB;AACxB,6BAA4B;AAUf,QAAA,KAAK,GAAG;;;;;;;;;CASpB,CAAA;AAED,MAAM,MAAM,GAAG,CAAC,CAAS,EAAE,GAAW,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE,CAAA;AAE7E;;;;GAIG;AACH,MAAa,YAAY;IASrB,YAAa,GAAQ,EAAU,OAAoB,EAAU,GAA0B;QAAxD,YAAO,GAAP,OAAO,CAAa;QAAU,QAAG,GAAH,GAAG,CAAuB;QAP/E,YAAO,GAAuB,IAAI,CAAA;QAE1C,0DAA0D;QAC1D,YAAO,GAAiB,EAAE,CAAA;QAC1B,iEAAiE;QACjE,cAAS,GAAa,EAAE,CAAA;QAGpB,IAAI,CAAC,QAAQ,GAAG,IAAI,GAAG,CAAC,uBAAuB,CAAC,EAAE,cAAc,EAAE,MAAM,EAAE,CAAC,CAAA;QAC3E,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,iBAAiB,EAAE,CAAC,KAAmB,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAA;QAC/E,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,CAAM,EAAE,EAAE;YACjC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,OAAO,IAAI,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAA;YACrD,IAAI,CAAC,KAAK,CAAC,yBAAyB,CAAC,EAAE,OAAO,IAAI,eAAe,EAAE,CAAC,CAAA;QACxE,CAAC,CAAC,CAAA;QAEF,+FAA+F;QAC/F,iCAAiC;QACjC,OAAO,CAAC,gBAAgB,CAAC,UAAU,EAAE,KAAK,CAAC,EAAE;YACzC,IAAI,KAAK,CAAC,YAAY,EAAE,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC9C,KAAK,CAAC,cAAc,EAAE,CAAA;gBACtB,KAAK,CAAC,eAAe,EAAE,CAAA;gBACvB,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAA;YAC5C,CAAC;QACL,CAAC,CAAC,CAAA;QACF,OAAO,CAAC,gBAAgB,CAAC,WAAW,EAAE,KAAK,CAAC,EAAE;YAC1C,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,aAAqB,CAAC,EAAE,CAAC;gBACjD,OAAO,CAAC,SAAS,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAA;YAC/C,CAAC;QACL,CAAC,CAAC,CAAA;QACF,OAAO,CAAC,gBAAgB,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE;YACrC,OAAO,CAAC,SAAS,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAA;YAC3C,IAAI,CAAC,KAAK,CAAC,YAAY,EAAE,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC/C,OAAM;YACV,CAAC;YACD,KAAK,CAAC,cAAc,EAAE,CAAA;YACtB,KAAK,CAAC,eAAe,EAAE,CAAA;YACvB,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,OAAc,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAM,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,oCAAoC,CAAC,EAAE,OAAO,IAAI,CAAC,EAAE,CAAC,CAAC,CAAA;QAC/J,CAAC,EAAE,IAAI,CAAC,CAAA;IACZ,CAAC;IAED,0GAA0G;IAC1G,IAAI,CAAE,KAAY;QACd,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,MAAM,CAAA;QACtD,IAAI,CAAC,KAAK,EAAE,CAAC;YACT,OAAM;QACV,CAAC;QACD,IAAI,CAAC;YACD,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,KAAK,CAAC,CAAA;YAC/C,IAAI,CAAC,GAAG,CAAC,kBAAkB,KAAK,gBAAgB,CAAC,CAAA;YACjD,IAAI,CAAC,KAAK,CAAC,GAAG,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,oDAAoD,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,QAAQ,EAAE,EAAE,EAAE,CAAC,CAAC,CAAA;YAClI,MAAM,CAAC,UAAU,CAAC,IAAI,CAClB,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,6BAA6B,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,wBAAwB,CAAC,CAAA,CAAC,CAAC,EACtH,CAAC,CAAM,EAAE,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,kBAAkB,CAAC,EAAE,OAAO,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,yCAAyC,CAAC,EAAE,OAAO,IAAI,CAAC,EAAE,CAAC,CAAA,CAAC,CAAC,CACxI,CAAA;QACL,CAAC;QAAC,OAAO,CAAM,EAAE,CAAC;YACd,IAAI,CAAC,KAAK,CAAC,6BAA6B,CAAC,EAAE,OAAO,IAAI,CAAC,EAAE,CAAC,CAAA;QAC9D,CAAC;IACL,CAAC;IAED,sCAAsC;IACtC,KAAK,CAAC,WAAW;QACb,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAA;QACpE,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IACpB,CAAC;IAED,gEAAgE;IACxD,KAAK,CAAE,KAAmB;QAC9B,IAAI,CAAC,OAAO,GAAG,KAAK,CAAA;QACpB,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,MAAM,CAAA;QACtD,IAAI,CAAC,GAAG,CAAC,4BAA4B,KAAK,EAAE,CAAC,CAAA;QAC7C,IAAI,KAAK,EAAE,CAAC;YACR,IAAI,CAAC,KAAK,CAAC,GAAG,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,+BAA+B,EAAE,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,CAAC,EAAE,KAAK,CAAC,CAAA;QAC3I,CAAC;IACL,CAAC;IAED,6GAA6G;IAC7G,KAAK,CAAC,OAAO,CAAE,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,WAAW,CAAC;QACrD,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAA;QAC1B,MAAM,KAAK,GAAa,EAAE,CAAA;QAC1B,IAAI,CAAC,KAAK,CAAC,UAAU,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,EAAE,EAAE,EAAE,CAAC,CAAC,CAAA;QACxF,IAAI,CAAC;YACD,KAAK,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC;gBAC1C,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;oBACnB,SAAQ;gBACZ,CAAC;gBACD,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAA;gBAC9D,MAAM,IAAI,GAAS,MAAM,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,UAAU,CAAA;gBAC3E,MAAM,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;gBAClE,MAAM,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAA;gBAC1E,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;YACtB,CAAC;YACD,IAAI,CAAC,SAAS,GAAG,KAAK,CAAA;YACtB,IAAI,CAAC,GAAG,CAAC,gBAAgB,KAAK,CAAC,MAAM,EAAE,CAAC,CAAA;YACxC,IAAI,CAAC,KAAK,CAAC,SAAS,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,CAAC,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;oBACzF,KAAK,EAAE,gBAAgB;oBACvB,GAAG,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,KAAK,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;iBAClE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAA;QACZ,CAAC;QAAC,OAAO,CAAM,EAAE,CAAC;YACd,IAAI,CAAC,GAAG,CAAC,gBAAgB,CAAC,EAAE,OAAO,IAAI,CAAC,EAAE,CAAC,CAAA;YAC3C,IAAI,CAAC,KAAK,CAAC,kBAAkB,CAAC,EAAE,OAAO,IAAI,CAAC,EAAE,CAAC,CAAA;QACnD,CAAC;QACD,OAAO,KAAK,CAAA;IAChB,CAAC;IAED,wFAAwF;IAChF,KAAK,CAAE,IAAY,EAAE,UAAgD,EAAE,EAAE,SAAS,GAAG,IAAI;QAC7F,YAAY,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;QAC7B,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,CAAA;QACtB,MAAM,EAAE,GAAG,QAAQ,CAAC,aAAa,CAAC,KAAK,CAAC,CAAA;QACxC,EAAE,CAAC,SAAS,GAAG,WAAW,CAAA;QAC1B,MAAM,KAAK,GAAG,QAAQ,CAAC,aAAa,CAAC,KAAK,CAAC,CAAA;QAC3C,KAAK,CAAC,SAAS,GAAG,gBAAgB,CAAA;QAClC,KAAK,CAAC,WAAW,GAAG,IAAI,CAAA;QACxB,EAAE,CAAC,MAAM,CAAC,KAAK,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE;YACrC,MAAM,MAAM,GAAG,QAAQ,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAA;YAC/C,MAAM,CAAC,SAAS,GAAG,iBAAiB,CAAA;YACpC,MAAM,CAAC,WAAW,GAAG,MAAM,CAAC,KAAK,CAAA;YACjC,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,CAAA;YACpD,OAAO,MAAM,CAAA;QACjB,CAAC,CAAC,CAAC,CAAA;QACH,MAAM,KAAK,GAAG,QAAQ,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAA;QAC9C,KAAK,CAAC,SAAS,GAAG,cAAc,CAAA;QAChC,KAAK,CAAC,WAAW,GAAG,GAAG,CAAA;QACvB,KAAK,CAAC,KAAK,GAAG,SAAS,CAAA;QACvB,KAAK,CAAC,gBAAgB,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,CAAA;QAClD,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;QAChB,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC,CAAA;QAC5B,IAAI,CAAC,OAAO,GAAG,EAAE,CAAA;QACjB,IAAI,SAAS,EAAE,CAAC;YACZ,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,SAAS,CAAC,CAAA;QAC9D,CAAC;IACL,CAAC;IAED,OAAO;QACH,YAAY,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;QAC7B,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,CAAA;QACtB,IAAI,CAAC;YAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAA;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,CAAC;IAC7C,CAAC;CACJ;AA5ID,oCA4IC;AAED;;;;;GAKG;AACH,SAAgB,QAAQ,CAAE,GAAW,EAAE,MAA0B,EAAE,IAAY;IAC3E,MAAM,KAAK,GAAG,CAAC,MAAM,IAAI,EAAE,EAAE,IAAI,CAAC;SAC7B,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;SACvC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,kBAAkB,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;SAC7E,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,CAAC,CAAA;IAC9C,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;IAC9B,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAA;IACrE,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACtC,MAAM,IAAI,KAAK,CAAC,+CAA+C,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;IAC1F,CAAC;IACD,OAAO,MAAM,CAAA;AACjB,CAAC;AAED,2DAA2D;AAC3D,SAAS,UAAU,CAAE,MAAc;IAC/B,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QACzB,OAAO,MAAM,CAAA;IACjB,CAAC;IACD,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;IAC7C,KAAK,IAAI,CAAC,GAAG,CAAC,GAAI,CAAC,EAAE,EAAE,CAAC;QACpB,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,IAAI,CAAC,GAAG,GAAG,EAAE,CAAC,CAAA;QACtD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YAC5B,OAAO,SAAS,CAAA;QACpB,CAAC;IACL,CAAC;AACL,CAAC"}
|
package/package.json
CHANGED