vona-core 5.0.90 → 5.0.92

package/dist/lib/core/logger/appLogger.js

@@ -61,7 +61,7 @@ export class AppLogger extends BeanSimple {
         }, Winston);
     }
     createTransportFile(fileName, clientInfo, options) {
-        const dirname = this.app.config.server.loggerDir;
+        const dirname = this.app.config.logger.baseDir;
         if (!fse.existsSync(dirname)) {
             const [_, err] = catchErrorSync(() => {
                 fse.ensureDirSync(dirname);

package/dist/lib/utils/util.d.ts

@@ -32,11 +32,11 @@ export declare class AppUtil extends BeanSimple {
     combineApiPathControllerAndActionRaw(moduleName: ModuleInfo.IModuleInfo | string, controllerPath: string | undefined, actionPath: RegExp | string | undefined, simplify?: boolean): string;
     combineApiPathControllerAndAction(moduleName: ModuleInfo.IModuleInfo | string, controllerPath: string | undefined, actionPath: RegExp | string | undefined, prefix?: string | boolean, simplify?: boolean): string;
     combineApiPath(path: string | undefined, moduleName?: ModuleInfo.IModuleInfo | string, prefix?: string | boolean, simplify?: boolean): string;
-    combineStaticPath(path: string | undefined, moduleName?: ModuleInfo.IModuleInfo | string): string;
+    combineStaticPath(staticPath: string | undefined, moduleName?: ModuleInfo.IModuleInfo | string): string;
     combineResourceName(resourceName: string | undefined, moduleName: ModuleInfo.IModuleInfo | string, simplify?: boolean, simplifyProviderId?: boolean): string;
     getPublicPathPhysical(subdir?: string, ensure?: boolean): Promise<string>;
     get prodRootPath(): string;
-    getAssetPathPhysical(moduleName: ModuleInfo.IModuleInfo | string, scene: keyof IModuleAssetSceneRecord, assetPath?: string): string | undefined;
+    getAssetPathPhysical(moduleName: ModuleInfo.IModuleInfo | string, scene: keyof IModuleAssetSceneRecord, assetPath?: string): string;
     createError(data: any, returnObject?: boolean): any;
     monkeyModule(ebAppMonkey: any, ebModulesMonkey: any, monkeyName: TypeMonkeyName, moduleTarget?: IModule, ...monkeyData: any[]): Promise<void>;
     monkeyModuleSync(ebAppMonkey: any, ebModulesMonkey: any, monkeyName: TypeMonkeyName, moduleTarget?: IModule, ...monkeyData: any[]): void;
@@ -62,5 +62,5 @@ export declare function prepareEnv(env: Partial<NodeJS.ProcessEnv>): VonaConfigE
 export declare function beanFullNameFromOnionName(onionName: string, sceneName: keyof IBeanSceneRecord): keyof IBeanRecord;
 export declare function onionNameFromBeanFullName(beanFullName: string, sceneName: keyof IBeanSceneRecord): string;
 export declare function filterHeaders(headers: object | undefined, whitelist: string[]): {} | undefined;
-export declare function combineFilePathSafe(dir: string, file: string): string | undefined;
+export declare function combineFilePathSafe(dir: string, file: string): string;
 export {};

package/dist/lib/utils/util.js

@@ -40,16 +40,20 @@ export class AppUtil extends BeanSimple {
     combineApiPath(path, moduleName, prefix, simplify) {
         return combineApiPath(path, moduleName, prefix, simplify, this.app.config.server.globalPrefix);
     }
-    combineStaticPath(path, moduleName) {
+    combineStaticPath(staticPath, moduleName) {
         const globalPrefix = '/api/static';
-        if (!path)
-            path = '';
+        if (!staticPath)
+            staticPath = '';
+        // safe
+        staticPath = path.normalize(staticPath);
+        if (staticPath.includes('..'))
+            throw new Error(`unsafe path: ${staticPath}`);
         // ignore globalPrefix
-        if (path.startsWith('//'))
-            return path.substring(1);
+        if (staticPath.startsWith('//'))
+            return staticPath.substring(1);
         // ignore module path
-        if (path.startsWith('/'))
-            return `${globalPrefix}${path}`;
+        if (staticPath.startsWith('/'))
+            return `${globalPrefix}${staticPath}`;
         // globalPrefix + module path + arg
         if (!moduleName)
             throw new Error('should specify the moduleName');
@@ -57,7 +61,7 @@ export class AppUtil extends BeanSimple {
             moduleName = moduleName.relativeName;
         const parts = moduleName.split('-');
         // path
-        return `${globalPrefix}/${parts[0]}/${parts[1]}/${path}`;
+        return `${globalPrefix}/${parts[0]}/${parts[1]}/${staticPath}`;
     }
     combineResourceName(resourceName, moduleName, simplify, simplifyProviderId) {
         return combineResourceName(resourceName, moduleName, simplify, simplifyProviderId);
@@ -300,6 +304,6 @@ export function combineFilePathSafe(dir, file) {
     const fullPath = path.normalize(path.join(dir, file));
     // files that can be accessd should be under options.dir
     if (fullPath.indexOf(dir) !== 0)
-        return;
+        throw new Error(`unsafe dir: ${dir}`);
     return fullPath;
 }

package/dist/types/config/config.d.ts

@@ -7,7 +7,6 @@ export interface VonaConfig {
         keys: string[];
         globalPrefix: string;
         publicDir: string;
-        loggerDir: string;
         subdomainOffset: number;
         workers: number;
         listen: {

package/dist/types/interface/logger.d.ts

@@ -16,6 +16,7 @@ export interface ILoggerRotateConfig {
     options: TypeLoggerRotateOptions;
 }
 export interface ConfigLogger {
+    baseDir: string;
     base: TypeLoggerOptions;
     clients: Record<keyof ILoggerClientRecord, TypeLoggerOptions>;
     rotate: ILoggerRotateConfig;

package/dist/types/utils/env.d.ts

@@ -6,13 +6,13 @@ export interface VonaConfigEnv {
     SERVER_KEYS: string | undefined;
     SERVER_GLOBALPREFIX: string | undefined;
     SERVER_PUBLICDIR: string | undefined;
-    SERVER_LOGGERDIR: string | undefined;
     SERVER_SUBDOMAINOFFSET: string | undefined;
     SERVER_WORKERS: string | undefined;
     SERVER_LISTEN_HOSTNAME: string | undefined;
     SERVER_LISTEN_PORT: string | undefined;
     SERVER_LISTEN_DISABLE: 'true' | 'false' | undefined;
     TEST_WHYISNODERUNNING: string | undefined;
+    LOGGER_DIR: string | undefined;
     LOGGER_DUMMY: 'true' | 'false' | undefined;
     LOGGER_ROTATE_ENABLE: 'true' | 'false' | undefined;
     LOGGER_ROTATE_FILENAME: string | undefined;

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "vona-core",
   "type": "module",
-  "version": "5.0.90",
+  "version": "5.0.92",
   "description": "vona",
   "publishConfig": {
     "access": "public"