@abi-software/simulationvuer 4.0.3 → 4.0.5

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@abi-software/simulationvuer",
-  "version": "4.0.3",
+  "version": "4.0.5",
   "private": false,
   "scripts": {
     "serve": "vite serve --host --force",
@@ -21,7 +21,7 @@
   },
   "dependencies": {
     "@abi-software/plotvuer": "1.0.7",
-    "@opencor/opencor": "^0.20260803.0",
+    "@opencor/opencor": "^0.20260804.0",
     "element-plus": "2.8.4",
     "jsonschema": "^1.5.0",
     "mathjs": "^15.2.0",

package/vite.config.js

@@ -31,72 +31,109 @@ export default defineConfig(({ command, mode }) => {
         dts: "src/components.d.ts",
       }),
 
-      // Resolve the libopencor.js import URL in @opencor/opencor's opencor.es.js so that it works for all consumers
-      // (not just Vite projects) and this without server configuration.
+      // Serve libOpenCOR for OpenCOR's runtime probe.
       //
-      // In @opencor/opencor, the code uses:
-      //   new URL("./libopencor/wasm/<version>/libopencor.js", window.location.href).href
+      // In @opencor/opencor, opencor.es.js locates its glue code at runtime:
+      //   new URL("libopencor/downloads/wasm/<version>/libopencor.js", document.baseURI).href
+      // and fetches that same-origin path (HEAD) before falling back to opencor.ws. The WASM is always loaded from a
+      // hardcoded opencor.ws base via locateFile. The probe is evaluated at runtime and the glue is imported
+      // dynamically (with @vite-ignore), so there is no static URL for Vite to rewrite.
       //
-      // This resolves relative to the page URL, requiring the server to host libopencor.js at a page-relative path
-      // (which doesn't work for library consumers or static builds).
-      //
-      // We fix this by:
-      //   - Dev (serve): rewriting to "/libopencor/libopencor.js", served by the middleware below.
-      //   - Build (lib): rewriting to use import.meta.url, so the import resolves relative to simulationvuer.js's URL
-      //                  (same directory, libopencor.js is copied alongside it via closeBundle).
+      // The probe is satisfied by:
+      //   - Dev (serve): serving "/libopencor/*" from the installed package via the middleware below, so the probe
+      //                  resolves same-origin (required for pthread Workers).
+      //   - Build (lib): copying the package's libOpenCOR dir to dist/libopencor via closeBundle, so the
+      //                  document-relative probe hits when the page is served from the dist root (otherwise OpenCOR
+      //                  falls back to opencor.ws).
 
       {
         name: "opencor-libopencor",
-        transform(code, id) {
-          if (id.includes("@opencor/opencor") && id.endsWith("opencor.es.js")) {
-            const importRegex =
-              /(\/\*\s*@vite-ignore\s*\*\/[\s\n]*)(new URL\("(\.\/libopencor\/wasm\/[^/]+\/libopencor\.js)",\s*window\.location\.href\)\.href)/g;
-            const res = code.replace(
-              importRegex,
-              (_match, prefix, _urlExpr, urlPath) => {
-                if (command === "serve") {
-                  // Dev mode: absolute path served by the middleware below.
-
-                  return `${prefix}"/libopencor/libopencor.js"`;
-                }
-
-                // Build mode: resolve relative to the bundle's own URL.
-                // Note: we use replace() instead of new URL(..., import.meta.url) to avoid Vite's asset handler, which
-                //       would inline the file as a data: URL (which breaks Emscripten's pthread Worker creation). At
-                //       runtime, import.meta.url points to simulationvuer.js and the derived path correctly reaches
-                //       libopencor in the same directory (copied alongside by closeBundle).
-
-                return `${prefix}import.meta.url.replace(/[^/]*$/, "") + ${JSON.stringify(urlPath.substring(2))}`;
-              },
-            );
-
-            if (res !== code) {
-              return {
-                code: res,
-                map: null,
-              };
-            }
-          }
-        },
         configureServer(server) {
           // Serve libopencor files from @opencor/opencor during development so the dynamic import in opencor.es.js
           // resolves same-origin (required for pthread Workers).
 
+          // Resolve symlinks in libopencorDir once so the per-request guard compares real paths on both sides.
+
+          let realLibopencorDir;
+
+          try {
+            realLibopencorDir = fs.realpathSync(libopencorDir);
+          } catch {
+            realLibopencorDir = libopencorDir;
+          }
+
           server.middlewares.use((req, res, next) => {
-            const urlPath = req.url;
+            // Parse the URL to strip any query string, and decode it safely (malformed sequences are rejected).
+
+            let pathname;
+
+            try {
+              pathname = decodeURIComponent(
+                new URL(req.url, "http://localhost").pathname,
+              );
+            } catch {
+              next();
+
+              return;
+            }
 
-            if (!urlPath.startsWith("/libopencor/")) {
+            if (!pathname.startsWith("/libopencor/")) {
               next();
 
               return;
             }
 
-            const filePath = path.join(
-              libopencorDir,
-              urlPath.replace("/libopencor/", ""),
-            );
+            // Resolve the requested subpath and verify the result stays within libopencorDir, guarding against
+            // directory traversal (e.g., "/libopencor/../../..." or percent-encoded ".." segments) and symlink
+            // escapes (a symlink inside libopencorDir pointing outside would pass a purely lexical check).
+            // Note: realpathSync() resolves symlinks, so a symlink pointing outside libopencorDir resolves to a path
+            //       outside it, which the relative check below rejects. It also throws if the path doesn't exist.
+
+            let filePath;
+
+            try {
+              filePath = fs.realpathSync(
+                path.resolve(
+                  libopencorDir,
+                  pathname.slice("/libopencor/".length),
+                ),
+              );
+            } catch {
+              next();
+
+              return;
+            }
+
+            // Reject paths escaping the directory: exactly "..", starting with "../", or absolute (e.g., a
+            // different drive on Windows).
+            // Note: a plain startsWith("..") check would wrongly reject legitimate files like "..foo.js".
+
+            const relative = path.relative(realLibopencorDir, filePath);
+
+            if (
+              relative === "" ||
+              relative === ".." ||
+              relative.startsWith(`..${path.sep}`) ||
+              path.isAbsolute(relative)
+            ) {
+              next();
+
+              return;
+            }
+
+            // Read the file and serve it with the correct headers.
+
+            let content;
+
+            try {
+              if (!fs.statSync(filePath).isFile()) {
+                next();
+
+                return;
+              }
 
-            if (!fs.existsSync(filePath)) {
+              content = fs.readFileSync(filePath);
+            } catch {
               next();
 
               return;
@@ -107,22 +144,23 @@ export default defineConfig(({ command, mode }) => {
               "Cross-Origin-Embedder-Policy": "require-corp",
               "Cross-Origin-Resource-Policy": "same-origin",
             });
-            res.end(fs.readFileSync(filePath));
+            res.end(content);
           });
         },
         closeBundle() {
-          // Copy libopencor alongside the built JavaScript file so that the dynamic import (using import.meta.url as
-          // base) resolves correctly. App mode puts the built JavaScript file in dist/assets while lib mode puts it in
-          // dist.
+          // Copy liboOpenCOR to the dist root (dist/libopencor) so that OpenCOR's document-relative probe
+          // (`<baseURI>/libopencor/downloads/wasm/<version>/libopencor.js`) resolves: in app mode, dist is the
+          // deployment root, and in lib mode the probed files ship in the package for consumers that serve them at the
+          // page root (everyone else falls back to opencor.ws).
 
           if (!fs.existsSync(libopencorDir)) {
             return;
           }
 
-          const distDir = path.resolve(__dirname, "dist");
-          const targetDir = fs.existsSync(path.join(distDir, "assets"))
-            ? path.join(distDir, "assets", "libopencor")
-            : path.join(distDir, "libopencor");
+          const targetDir = path.join(
+            path.resolve(__dirname, "dist"),
+            "libopencor",
+          );
 
           fs.cpSync(libopencorDir, targetDir, { recursive: true, force: true });
         },