Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
@airteam/strapi-provider-upload-aws-s3-advanced
Advanced tools
AWS S3 provider for strapi upload with more advanced configuration options
This extends the original configurability of the provider by adding both a baseUrl
, which may be your CDN URL, which replaces the endpoint returned from AWS with a custom URL, and prefix
, which does exactly that: prefixes the object's path such that we do not strictly upload into the buckets root directory. This can be used to keep the bucket organized.
Everything else follows the regular strapi-provider-upload-aws-s3 schema.
Your configuration is passed down to the provider. (e.g: new AWS.S3(config)
). You can see the complete list of options here
See the using a provider documentation for information on installing and using a provider. And see the environment variables for setting and using environment variables in your configs.
./config/plugins.js
module.exports = ({ env }) => ({
// ...
upload: {
provider: "aws-s3-advanced",
providerOptions: {
accessKeyId: env("AWS_ACCESS_KEY_ID"),
secretAccessKey: env("AWS_ACCESS_SECRET"),
region: env("AWS_REGION"),
params: {
bucket: env("AWS_BUCKET"),
},
baseUrl: env("CDN_BASE_URL"), // e.g. https://cdn.example.com, this is stored in strapi's database to point to the file
prefix: env("BUCKET_PREFIX"), // e.g. strapi-assets, note the missing slash at the start
},
},
// ...
});
If using strapi >= 4.0.0, please use the below config:
./config/plugins.js
module.exports = ({ env }) => ({
// ...
upload: {
config: {
provider: "strapi-provider-upload-aws-s3-advanced",
providerOptions: {
accessKeyId: env("AWS_ACCESS_KEY_ID"),
secretAccessKey: env("AWS_ACCESS_SECRET"),
region: env("AWS_REGION"),
params: {
bucket: env("AWS_BUCKET"),
},
baseUrl: env("CDN_BASE_URL"), // e.g. https://cdn.example.com, this is stored in strapi's database to point to the file
prefix: env("BUCKET_PREFIX"), // e.g. strapi-assets, note the missing slash at the start
},
},
},
// ...
});
Note: If you are migrating from a pre-4.0.0 version (i.e. v3.6.8 or earlier), the
files
relation will includeaws-s3-advanced
as the provider. Previously, the prefix "strapi-upload-provider" was assumed to always be present for upload provider plugins. This is no longer the case in >= 4.0.0, hence when uploading with the newer version of this provider, strapi will insert new files with the full provider package name, i.e.,strapi-provider-upload-aws-s3-advanced
. See Migration for details on the required manual work.
To allow the thumbnails to properly populate, add the below config to
./config/middlewares.js
module.exports = ({ env }) => [
// ...
{
name: "strapi::security",
config: {
contentSecurityPolicy: {
useDefaults: true,
directives: {
"connect-src": ["'self'", "https:"],
"img-src": ["'self'", "data:", "blob:", `${env("CDN_BASE_URL")}`],
"media-src": ["'self'", "data:", "blob:", `${env("CDN_BASE_URL")}`],
upgradeInsecureRequests: null,
},
},
},
},
// ...
];
Strapi now uses the full package name as provider name, as seen in the configuration of the provider in the Example section above. This means that the relation will include different provider names when using the newer version of this provider with strapi >= 4.0.0 on data from pre-4.0.0. In particular, you will find that the pre-4.0.0 files
will have the provider aws-s3-advanved
, while the newer ones will have strapi-provider-aws-s3-advanved
. If you're not going to change the existing files in your CDN, you will not need to take any actions. The provider attribute is only used for mapping the handler for creating or deleting files to the handlers defined in this provider. Files will remain readable with the old provider and new files will be added with the new provider name. Only if you want to delete old files from the new provider, you will be required to adapt the files
table.
In strapi >= 4.0.0, only SQL databases are officially supported, so we will only provide queries for the supported backends:
UPDATE files SET provider = 'strapi-provider-upload-aws-s3-advanced' WHERE provider = 'aws-s3-advanced';
UPDATE `files` SET `provider` = `strapi-provider-upload-aws-s3-advanced` WHERE `provider` = `aws-s3-advanced`;
UPDATE files SET provider = 'strapi-provider-upload-aws-s3-advanced' WHERE provider = 'aws-s3-advanced';
FAQs
AWS S3 provider for strapi upload with more advanced configuration options
The npm package @airteam/strapi-provider-upload-aws-s3-advanced receives a total of 0 weekly downloads. As such, @airteam/strapi-provider-upload-aws-s3-advanced popularity was classified as not popular.
We found that @airteam/strapi-provider-upload-aws-s3-advanced demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 4 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.