@character-foundry/character-foundry 0.4.2-dev.1765942273 → 0.4.2-dev.1765997746

package/dist/voxta.js

@@ -7212,6 +7212,22 @@ function sanitizeName(name, ext) {
   if (!safeName) safeName = "asset";
   return safeName;
 }
+function sanitizeExtension(ext) {
+  const normalized = ext.trim().replace(/^\./, "").toLowerCase();
+  if (!normalized) {
+    throw new Error("Invalid asset extension: empty extension");
+  }
+  if (normalized.length > 64) {
+    throw new Error(`Invalid asset extension: too long (${normalized.length} chars)`);
+  }
+  if (normalized.includes("/") || normalized.includes("\\") || normalized.includes("\0")) {
+    throw new Error("Invalid asset extension: path separators are not allowed");
+  }
+  if (!/^[a-z0-9][a-z0-9._-]*$/.test(normalized)) {
+    throw new Error(`Invalid asset extension: "${ext}"`);
+  }
+  return normalized;
+}
 function writeVoxta(card, assets, options = {}) {
   const { compressionLevel = 6, includePackageJson = false } = options;
   const cardData = card.data;
@@ -7300,8 +7316,9 @@ function writeVoxta(card, assets, options = {}) {
   let assetCount = 0;
   let mainThumbnail;
   for (const asset of assets) {
-    const safeName = sanitizeName(asset.name, asset.ext);
-    const finalFilename = `${safeName}.${asset.ext}`;
+    const safeExt = sanitizeExtension(asset.ext);
+    const safeName = sanitizeName(asset.name, safeExt);
+    const finalFilename = `${safeName}.${safeExt}`;
     let voxtaPath = "";
     const tags = asset.tags || [];
     const isMainIcon = asset.type === "icon" && (tags.includes("portrait-override") || asset.name === "main" || asset.isMain);