@abtnode/core 1.17.8-beta-20260119-034126-467341b7 → 1.17.8-beta-20260121-102603-f9d0176f

package/lib/blocklet/manager/disk/settings-manager.js

@@ -65,7 +65,11 @@ async function getBlockletBlurhash(manager, { did }) {
  * @param {Object} context
  * @returns {Promise<Object>}
  */
-async function updateBlockletSettings(manager, { did, enableSessionHardening, invite, gateway, aigne, org }, context) {
+async function updateBlockletSettings(
+  manager,
+  { did, enableSessionHardening, invite, gateway, aigne, org, subService },
+  context
+) {
   const params = {};
   if (!isNil(enableSessionHardening)) {
     params.enableSessionHardening = enableSessionHardening;
@@ -98,6 +102,37 @@ async function updateBlockletSettings(manager, { did, enableSessionHardening, in
     };
   }
 
+  if (!isNil(subService)) {
+    // Security: Validate subService configuration to prevent path traversal
+    const SUB_SERVICE_SCHEMA = Joi.object({
+      enabled: Joi.boolean().required(),
+      domain: Joi.when('enabled', {
+        is: true,
+        then: Joi.string().required(),
+        otherwise: Joi.string().optional().allow(''),
+      }),
+      staticRoot: Joi.when('enabled', {
+        is: true,
+        then: Joi.string()
+          .required()
+          // Reject paths containing ".." or starting with "/"
+          .pattern(/^[^/]/, { name: 'no-absolute-path' })
+          .pattern(/^(?!.*\.\.).*$/, { name: 'no-parent-reference' })
+          .messages({
+            'string.pattern.name': 'Invalid path. Path cannot contain ".." or start with "/"',
+          }),
+        otherwise: Joi.string().optional().allow(''),
+      }),
+    });
+
+    const { error } = SUB_SERVICE_SCHEMA.validate(subService);
+    if (error) {
+      throw new CustomError(400, error.message);
+    }
+
+    params.subService = subService;
+  }
+
   let shouldRotateSession = false;
   if (!isNil(org)) {
     const ORG_SCHEMA = Joi.object({

package/lib/blocklet/manager/disk.js

@@ -826,10 +826,10 @@ class DiskBlockletManager extends BaseBlockletManager {
     return summary;
   }
 
-  updateBlockletSettings({ did, enableSessionHardening, invite, gateway, aigne, org }, context) {
+  updateBlockletSettings({ did, enableSessionHardening, invite, gateway, aigne, org, subService }, context) {
     return settingsManager.updateBlockletSettings(
       this,
-      { did, enableSessionHardening, invite, gateway, aigne, org },
+      { did, enableSessionHardening, invite, gateway, aigne, org, subService },
       context
     );
   }