webvas 0.3.1 → 0.3.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 8a2023d01aad96f20ed9938d18ddedf254edd56ba69c2dc0383a84d00c2efd03
-  data.tar.gz: 4ad4fbd5919583226a281186a717d59eb038a0d1aac25e79716ccd8cc5775fb9
+  metadata.gz: 23e89d8e5afb08ea67551ec3be09d3481ba59795bb3580f3cde32c180a06f4c3
+  data.tar.gz: fb7dc400c269810d05ea2ad5ac186d8571bd54e521c0dc12d4aa169e674561e6
 SHA512:
-  metadata.gz: 034c1b98ebf7a2607d8b985c21e63394ccca5b228bf99fc39dc74bb710ea6ae4e72b2ae13968e7b8108f3f3a71280c0119ab025290274d1b8b877b3bba3aeb78
-  data.tar.gz: affd813bbbbf4ab437bfa794c5d56dd54187c27e4c6315bec9ad76b40bde5f9fae4dfa6941641e668f56f8a32506c40efe9c0e7983a5b5da32206a03209f1439
+  metadata.gz: 8c4d31e781969e8bf9bd441e655e794198fd9eff6ac79f80dfdc663dc82629d1d93b974bf13ba12a9fb825c0c96cd60ff71cbe139c0431165213ac46b99068bb
+  data.tar.gz: 23c452946ffeef36cde2e5dadbd6383b888419aed2dd52aa90be66e6294cf1ee94476ebfb0f41c9ed93acdb6b74016e42e3dc6281245faeb1a6eb543ad8d4620

data/CHANGELOG.md

@@ -1,12 +1,18 @@
 # Changelog
 
+## [0.3.2] - 2026-09-26
+
+### Fixed
+
+- Reject build output paths that resolve through symlinks into the project or its assets.
+
 ## [0.3.1] - 2026-09-25
 
 ### Fixed
 
-- Build the current WebAssembly runtime before browser tests and Pages deployment.
-- Include the CLI executable and runtime build inputs in the gem.
-- Require a Gesso release that supports browser sketches.
+- Include the `webvas` command and runtime build files in the installed gem.
+- Use the current WebAssembly runtime on the published playground.
+- Install a Gesso version that supports browser sketches.
 
 ## [0.3.0] - 2026-09-25
 

data/lib/webvas/cli.rb

@@ -100,11 +100,18 @@ module Webvas
 
       source = File.realpath(options[:root])
       destination = File.expand_path(options[:output], source)
-      raise Error, "Build output cannot overwrite the project." if destination == source
-      if destination == File.join(source, "assets") || destination.start_with?(File.join(source, "assets") + File::SEPARATOR)
+      ancestor = destination
+      suffix = []
+      until File.exist?(ancestor) || File.symlink?(ancestor)
+        ancestor, name = File.dirname(ancestor), File.basename(ancestor)
+        suffix.unshift(name)
+      end
+      resolved_destination = File.join(File.realpath(ancestor), *suffix)
+      raise Error, "Build output cannot overwrite the project." if resolved_destination == source
+      if resolved_destination == File.join(source, "assets") || resolved_destination.start_with?(File.join(source, "assets") + File::SEPARATOR)
         raise Error, "Build output cannot be inside the project's assets directory."
       end
-      raise Error, "Build output cannot contain the project." if source.start_with?(destination + File::SEPARATOR)
+      raise Error, "Build output cannot contain the project." if source.start_with?(resolved_destination + File::SEPARATOR)
       raise Error, "Project is missing index.html or app.rb." unless %w[index.html app.rb].all? { |file| File.file?(File.join(source, file)) }
 
       FileUtils.mkdir_p(destination)

data/lib/webvas/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Webvas
-  VERSION = "0.3.1"
+  VERSION = "0.3.2"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: webvas
 version: !ruby/object:Gem::Version
-  version: 0.3.1
+  version: 0.3.2
 platform: ruby
 authors:
 - Yudai Takada