@bleedingdev/modern-js-server-core 3.5.0-ultramodern.30 → 3.5.0-ultramodern.32

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (4) hide show
  1. package/dist/cjs/adapters/node/plugins/static.js +5 -0
  2. package/dist/esm/adapters/node/plugins/static.mjs +5 -0
  3. package/dist/esm-node/adapters/node/plugins/static.mjs +5 -0
  4. package/package.json +6 -6
package/dist/cjs/adapters/node/plugins/static.js CHANGED
@@ -97,6 +97,10 @@ function createPublicMiddleware({ pwd, routes }) {
97
97
  function matchPublicRoute(req, routes) {
98
98
  for (const route of routes.sort(index_js_namespaceObject.sortRoutes))if (!route.isSSR && route.entryPath.startsWith('public') && req.path.startsWith(route.urlPath)) return route;
99
99
  }
100
+ const isPathInside = (target, root)=>{
101
+ const relative = external_path_default().relative(external_path_default().resolve(root), external_path_default().resolve(target));
102
+ return '' === relative || !relative.startsWith(`..${external_path_default().sep}`) && '..' !== relative && !external_path_default().isAbsolute(relative);
103
+ };
100
104
  const extractPathname = (url)=>{
101
105
  try {
102
106
  if (url.includes('://')) return new URL(url).pathname || '/';
@@ -176,6 +180,7 @@ function createStaticMiddleware(options) {
176
180
  const isModuleFederationAsset = moduleFederationAssetMeta.assets.has(requestPath);
177
181
  const isModuleFederationRemoteEntry = moduleFederationAssetMeta.remoteEntries.has(requestPath);
178
182
  const serveByPath = async (filepath, moduleFederationAsset = false, moduleFederationRemoteEntry = false)=>{
183
+ if (!isPathInside(filepath, pwd)) return null;
179
184
  if (!await utils_namespaceObject.fs.pathExists(filepath)) return null;
180
185
  return serveFile(c, filepath, moduleFederationAsset, moduleFederationRemoteEntry, requestPath);
181
186
  };
package/dist/esm/adapters/node/plugins/static.mjs CHANGED
@@ -53,6 +53,10 @@ function createPublicMiddleware({ pwd, routes }) {
53
53
  function matchPublicRoute(req, routes) {
54
54
  for (const route of routes.sort(sortRoutes))if (!route.isSSR && route.entryPath.startsWith('public') && req.path.startsWith(route.urlPath)) return route;
55
55
  }
56
+ const isPathInside = (target, root)=>{
57
+ const relative = path.relative(path.resolve(root), path.resolve(target));
58
+ return '' === relative || !relative.startsWith(`..${path.sep}`) && '..' !== relative && !path.isAbsolute(relative);
59
+ };
56
60
  const extractPathname = (url)=>{
57
61
  try {
58
62
  if (url.includes('://')) return new URL(url).pathname || '/';
@@ -132,6 +136,7 @@ function createStaticMiddleware(options) {
132
136
  const isModuleFederationAsset = moduleFederationAssetMeta.assets.has(requestPath);
133
137
  const isModuleFederationRemoteEntry = moduleFederationAssetMeta.remoteEntries.has(requestPath);
134
138
  const serveByPath = async (filepath, moduleFederationAsset = false, moduleFederationRemoteEntry = false)=>{
139
+ if (!isPathInside(filepath, pwd)) return null;
135
140
  if (!await fs.pathExists(filepath)) return null;
136
141
  return serveFile(c, filepath, moduleFederationAsset, moduleFederationRemoteEntry, requestPath);
137
142
  };
package/dist/esm-node/adapters/node/plugins/static.mjs CHANGED
@@ -54,6 +54,10 @@ function createPublicMiddleware({ pwd, routes }) {
54
54
  function matchPublicRoute(req, routes) {
55
55
  for (const route of routes.sort(sortRoutes))if (!route.isSSR && route.entryPath.startsWith('public') && req.path.startsWith(route.urlPath)) return route;
56
56
  }
57
+ const isPathInside = (target, root)=>{
58
+ const relative = path.relative(path.resolve(root), path.resolve(target));
59
+ return '' === relative || !relative.startsWith(`..${path.sep}`) && '..' !== relative && !path.isAbsolute(relative);
60
+ };
57
61
  const extractPathname = (url)=>{
58
62
  try {
59
63
  if (url.includes('://')) return new URL(url).pathname || '/';
@@ -133,6 +137,7 @@ function createStaticMiddleware(options) {
133
137
  const isModuleFederationAsset = moduleFederationAssetMeta.assets.has(requestPath);
134
138
  const isModuleFederationRemoteEntry = moduleFederationAssetMeta.remoteEntries.has(requestPath);
135
139
  const serveByPath = async (filepath, moduleFederationAsset = false, moduleFederationRemoteEntry = false)=>{
140
+ if (!isPathInside(filepath, pwd)) return null;
136
141
  if (!await fs.pathExists(filepath)) return null;
137
142
  return serveFile(c, filepath, moduleFederationAsset, moduleFederationRemoteEntry, requestPath);
138
143
  };
package/package.json CHANGED
@@ -17,7 +17,7 @@
17
17
  "modern",
18
18
  "modern.js"
19
19
  ],
20
- "version": "3.5.0-ultramodern.30",
20
+ "version": "3.5.0-ultramodern.32",
21
21
  "types": "./dist/types/index.d.ts",
22
22
  "main": "./dist/cjs/index.js",
23
23
  "exports": {
@@ -76,9 +76,9 @@
76
76
  "flatted": "^3.4.2",
77
77
  "hono": "^4.12.27",
78
78
  "ts-deepmerge": "8.0.0",
79
- "@modern-js/plugin": "npm:@bleedingdev/modern-js-plugin@3.5.0-ultramodern.30",
80
- "@modern-js/utils": "npm:@bleedingdev/modern-js-utils@3.5.0-ultramodern.30",
81
- "@modern-js/runtime-utils": "npm:@bleedingdev/modern-js-runtime-utils@3.5.0-ultramodern.30"
79
+ "@modern-js/plugin": "npm:@bleedingdev/modern-js-plugin@3.5.0-ultramodern.32",
80
+ "@modern-js/utils": "npm:@bleedingdev/modern-js-utils@3.5.0-ultramodern.32",
81
+ "@modern-js/runtime-utils": "npm:@bleedingdev/modern-js-runtime-utils@3.5.0-ultramodern.32"
82
82
  },
83
83
  "devDependencies": {
84
84
  "@rslib/core": "0.23.1",
@@ -87,8 +87,8 @@
87
87
  "@types/node": "^26.0.1",
88
88
  "@typescript/native-preview": "7.0.0-dev.20260628.1",
89
89
  "http-proxy-middleware": "^4.1.1",
90
- "@modern-js/types": "npm:@bleedingdev/modern-js-types@3.5.0-ultramodern.30",
91
- "@scripts/rstest-config": "2.66.0"
90
+ "@scripts/rstest-config": "2.66.0",
91
+ "@modern-js/types": "npm:@bleedingdev/modern-js-types@3.5.0-ultramodern.32"
92
92
  },
93
93
  "sideEffects": false,
94
94
  "publishConfig": {