Browse Source

chore: Manually add recent change after merge

Based on commit 85452679
Michael Bromley 1 year ago
parent
commit
f56ce3acde
1 changed files with 9 additions and 1 deletions
  1. 9 1
      packages/asset-server-plugin/src/asset-server.ts

+ 9 - 1
packages/asset-server-plugin/src/asset-server.ts

@@ -7,6 +7,7 @@ import path from 'path';
 
 import { getValidFormat } from './common';
 import { ImageTransformParameters, ImageTransformStrategy } from './config/image-transform-strategy';
+import { S3AssetStorageStrategy } from './config/s3-asset-storage-strategy';
 import { ASSET_SERVER_PLUGIN_INIT_OPTIONS, DEFAULT_CACHE_HEADER, loggerCtx } from './constants';
 import { transformImage } from './transform-image';
 import { AssetServerOptions, ImageTransformMode, ImageTransformPreset } from './types';
@@ -257,7 +258,14 @@ export class AssetServer {
             Logger.error((e.message as string) + ': ' + filePath, loggerCtx);
             return '';
         }
-        return path.normalize(decodedPath).replace(/(\.\.[\/\\])+/, '');
+        if (!(this.assetStorageStrategy instanceof S3AssetStorageStrategy)) {
+            // For S3 storage, we don't need to sanitize the path because
+            // directory traversal attacks are not possible, and modifying the
+            // path in this way can s3 files to be not found.
+            return path.normalize(decodedPath).replace(/(\.\.[\/\\])+/, '');
+        } else {
+            return decodedPath;
+        }
     }
 
     private md5(input: string): string {