@allurereport/static-server 3.3.1 → 3.4.0

package/dist/index.js

@@ -1,12 +1,12 @@
-import watchDirectory from "@allurereport/directory-watcher";
 import * as console from "node:console";
 import { createReadStream } from "node:fs";
 import { readFile, readdir, stat } from "node:fs/promises";
 import { createServer } from "node:http";
 import { basename, extname, join, resolve } from "node:path";
 import { cwd } from "node:process";
+import watchDirectory from "@allurereport/directory-watcher";
 import openUrl from "open";
-import { TYPES_BY_EXTENSION, identity, injectLiveReloadScript } from "./utils.js";
+import { TYPES_BY_EXTENSION, identity, injectLiveReloadScript, resolveUrlPathnameUnderServeRoot } from "./utils.js";
 export const renderDirectory = async (entries, dirPath) => {
     const links = [];
     const files = [];
@@ -68,7 +68,12 @@ export const serve = async (options) => {
             });
             return;
         }
-        let fsPath = join(pathToServe, decodeURI(pathname));
+        const resolvedPublic = resolveUrlPathnameUnderServeRoot(pathToServe, pathname);
+        if (resolvedPublic === null) {
+            res.writeHead(404);
+            return res.end();
+        }
+        let fsPath = resolvedPublic;
         let stats;
         try {
             stats = await stat(fsPath);

package/dist/utils.d.ts

@@ -2,3 +2,4 @@ export declare const EXTENSIONS_BY_TYPE: Record<string, string>;
 export declare const TYPES_BY_EXTENSION: Record<string, string>;
 export declare const identity: <T>(value?: T) => T | undefined;
 export declare const injectLiveReloadScript: (html: string) => string;
+export declare function resolveUrlPathnameUnderServeRoot(rootDir: string, urlPathname: string): string | null;

package/dist/utils.js

@@ -1,3 +1,4 @@
+import { resolve, sep } from "node:path";
 const ALLURE_LIVE_RELOAD_HASH_STORAGE_KEY = "__allure_report_live_reload_hash__";
 export const EXTENSIONS_BY_TYPE = {
     "application/andrew-inset": ".ez",
@@ -913,3 +914,34 @@ export const injectLiveReloadScript = (html) => {
   `;
     return html.replace("</body>", `${liveReloadScript}</body>`);
 };
+function isPathContainedInServeRoot(rootDir, candidatePath) {
+    const rootResolved = resolve(rootDir);
+    const candidateResolved = resolve(candidatePath);
+    if (process.platform === "win32") {
+        const rootLower = rootResolved.toLowerCase();
+        const candLower = candidateResolved.toLowerCase();
+        const prefix = rootLower.endsWith("\\") ? rootLower : `${rootLower}\\`;
+        return candLower === rootLower || candLower.startsWith(prefix);
+    }
+    const prefix = rootResolved.endsWith(sep) ? rootResolved : `${rootResolved}${sep}`;
+    return candidateResolved === rootResolved || candidateResolved.startsWith(prefix);
+}
+export function resolveUrlPathnameUnderServeRoot(rootDir, urlPathname) {
+    let decoded;
+    try {
+        decoded = decodeURI(urlPathname);
+    }
+    catch {
+        return null;
+    }
+    if (decoded.includes("\0")) {
+        return null;
+    }
+    const relative = decoded.replace(/^[/\\]+/, "");
+    const rootResolved = resolve(rootDir);
+    const candidate = resolve(rootResolved, relative);
+    if (!isPathContainedInServeRoot(rootResolved, candidate)) {
+        return null;
+    }
+    return candidate;
+}

package/package.json

@@ -1,60 +1,49 @@
 {
   "name": "@allurereport/static-server",
-  "version": "3.3.1",
+  "version": "3.4.0",
   "description": "Minimalistic web-server for serving static files",
   "keywords": [
     "allure",
-    "testing",
-    "web",
     "http",
-    "server"
+    "server",
+    "testing",
+    "web"
   ],
-  "repository": "https://github.com/allure-framework/allure3",
   "license": "Apache-2.0",
   "author": "Qameta Software",
+  "repository": "https://github.com/allure-framework/allure3",
+  "files": [
+    "dist"
+  ],
   "type": "module",
+  "module": "dist/index.js",
+  "types": "dist/index.d.ts",
   "exports": {
     ".": "./dist/index.js"
   },
-  "module": "dist/index.js",
-  "types": "dist/index.d.ts",
-  "files": [
-    "dist"
-  ],
   "scripts": {
     "build": "run clean && tsc --project ./tsconfig.json",
     "clean": "rimraf ./dist",
     "pretest": "rimraf ./out",
     "test": "run-p 'test:*'",
     "test:unit": "vitest run",
-    "eslint": "eslint ./src/**/*.{js,jsx,ts,tsx}",
-    "eslint:format": "eslint --fix ./src/**/*.{js,jsx,ts,tsx}",
-    "test:e2e": "playwright test"
+    "test:e2e": "playwright test",
+    "lint": "oxlint --import-plugin src test features stories",
+    "lint:fix": "oxlint --import-plugin --fix src test features stories"
   },
   "dependencies": {
-    "@allurereport/directory-watcher": "3.3.1",
+    "@allurereport/directory-watcher": "3.4.0",
     "open": "^10.1.0"
   },
   "devDependencies": {
     "@playwright/test": "^1.56.1",
-    "@stylistic/eslint-plugin": "^2.6.1",
-    "@types/eslint": "^8.56.11",
     "@types/node": "^20.17.9",
-    "@typescript-eslint/eslint-plugin": "^8.0.0",
-    "@typescript-eslint/parser": "^8.0.0",
     "@vitest/runner": "^2.1.9",
     "@vitest/snapshot": "^2.1.9",
     "allure-js-commons": "^3.3.3",
     "allure-playwright": "^3.3.3",
     "allure-vitest": "^3.3.3",
     "axios": "^1.13.5",
-    "eslint": "^8.57.0",
-    "eslint-config-prettier": "^9.1.0",
-    "eslint-plugin-import": "^2.29.1",
-    "eslint-plugin-jsdoc": "^50.0.0",
-    "eslint-plugin-n": "^17.10.1",
-    "eslint-plugin-no-null": "^1.0.2",
-    "eslint-plugin-prefer-arrow": "^1.2.3",
     "get-port": "^7.1.0",
     "npm-run-all2": "^7.0.1",
     "rimraf": "^6.0.1",