@docubook/flame 1.2.0 → 1.2.1

package/.docu/node/preview.ts

@@ -3,19 +3,10 @@ import { resolve } from "node:path";
 import { logger } from "./logger";
 import { DIST_DIR } from "./paths";
 import { getContentType } from "./utils";
+import { SECURITY_HEADERS, generateNonce, cspHeader, injectNonce } from "./security";
 
 const PORT = process.env.PORT || "4173";
 
-const SECURITY_HEADERS: Record<string, string> = {
-  "Strict-Transport-Security": "max-age=63072000; includeSubDomains; preload",
-  "X-Frame-Options": "DENY",
-  "X-Content-Type-Options": "nosniff",
-  "Referrer-Policy": "strict-origin-when-cross-origin",
-  "Permissions-Policy": "camera=(), microphone=(), geolocation=()",
-  "Content-Security-Policy":
-    "default-src 'self'; script-src 'self' 'sha256-4XrQ+xtH2goQdpEv7dRmUWACF3uhF9KRPpgayFex7QU=' 'unsafe-eval'; style-src 'self' 'unsafe-inline'; img-src 'self' https: data:; font-src 'self' data:; connect-src 'self' https:; frame-src https://www.youtube-nocookie.com; frame-ancestors 'none'",
-};
-
 logger.buildStart();
 
 if (!existsSync(DIST_DIR)) {
@@ -50,22 +41,42 @@ const notFoundPath = resolve(DIST_DIR, "404.html");
 const server = Bun.serve({
   port: PORT,
 
-  fetch(req) {
+  async fetch(req) {
     const url = new URL(req.url);
     const pathname = decodeURIComponent(url.pathname);
 
     const filePath = resolveFile(pathname);
+
     if (filePath) {
       const contentType = getContentType(filePath);
-      const headers: Record<string, string> = { "Content-Type": contentType };
-      if (contentType === "text/html") Object.assign(headers, SECURITY_HEADERS);
-      return new Response(Bun.file(filePath), { headers });
+      if (contentType === "text/html") {
+        const nonce = generateNonce();
+        const html = await Bun.file(filePath).text();
+        const modified = injectNonce(html, nonce);
+        return new Response(modified, {
+          headers: {
+            "Content-Type": "text/html",
+            ...SECURITY_HEADERS,
+            "Content-Security-Policy": cspHeader(nonce, true),
+          },
+        });
+      }
+      return new Response(Bun.file(filePath), {
+        headers: { "Content-Type": contentType },
+      });
     }
 
     if (existsSync(notFoundPath)) {
-      return new Response(Bun.file(notFoundPath), {
+      const nonce = generateNonce();
+      const html = await Bun.file(notFoundPath).text();
+      const modified = injectNonce(html, nonce);
+      return new Response(modified, {
         status: 404,
-        headers: { "Content-Type": "text/html", ...SECURITY_HEADERS },
+        headers: {
+          "Content-Type": "text/html",
+          ...SECURITY_HEADERS,
+          "Content-Security-Policy": cspHeader(nonce, true),
+        },
       });
     }
 

package/.docu/node/security.ts

@@ -1,3 +1,5 @@
+import { resolve } from "node:path";
+
 export const SECURITY_HEADERS: Record<string, string> = {
   "Strict-Transport-Security": "max-age=63072000; includeSubDomains; preload",
   "X-Frame-Options": "DENY",
@@ -10,10 +12,13 @@ export function generateNonce(): string {
   return crypto.randomUUID();
 }
 
-export function cspHeader(nonce: string): string {
+export function cspHeader(nonce: string, allowEval = false): string {
+  const scriptSrc = allowEval
+    ? `script-src 'self' 'nonce-${nonce}' 'unsafe-eval'`
+    : `script-src 'self' 'nonce-${nonce}'`;
   return [
     "default-src 'self'",
-    `script-src 'self' 'nonce-${nonce}' 'unsafe-eval'`,
+    scriptSrc,
     "style-src 'self' 'unsafe-inline'",
     "img-src 'self' https: data:",
     "font-src 'self' data:",
@@ -23,13 +28,38 @@ export function cspHeader(nonce: string): string {
   ].join("; ");
 }
 
-export function htmlResponse(html: string, nonce: string, status = 200): Response {
+export function isPathSafe(pathname: string, baseDir: string): boolean {
+  const decoded = decodeURIComponent(pathname);
+  const resolved = resolve(baseDir, decoded.slice(1));
+  const baseDirSlash = baseDir.endsWith("/") ? baseDir : baseDir + "/";
+  return resolved === baseDir || resolved.startsWith(baseDirSlash);
+}
+
+export function isSlugSafe(slug: string, docsDir: string): boolean {
+  const resolved = resolve(docsDir, slug);
+  const docsDirSlash = docsDir.endsWith("/") ? docsDir : docsDir + "/";
+  return resolved === docsDir || resolved.startsWith(docsDirSlash);
+}
+
+export function injectNonce(html: string, nonce: string): string {
+  return html.replace(/<script\b(?![^>]*\bsrc\s*=)([^>]*)>/gi, (match) => {
+    if (/nonce\s*=/i.test(match)) return match;
+    return match.replace(/>$/, ` nonce="${nonce}">`);
+  });
+}
+
+export function htmlResponse(
+  html: string,
+  nonce: string,
+  status = 200,
+  allowEval = false
+): Response {
   return new Response(html, {
     status,
     headers: {
       "Content-Type": "text/html",
       ...SECURITY_HEADERS,
-      "Content-Security-Policy": cspHeader(nonce),
+      "Content-Security-Policy": cspHeader(nonce, allowEval),
     },
   });
 }

package/.docu/node/server.ts

@@ -15,7 +15,7 @@ import { buildClientBundle, computeInlineThemeCss } from "./hydrate";
 import { generateSearchIndex } from "./search-indexer";
 import { logger } from "./logger";
 import { initSentry, captureException } from "./sentry";
-import { SECURITY_HEADERS, generateNonce, htmlResponse } from "./security";
+import { SECURITY_HEADERS, generateNonce, isPathSafe, isSlugSafe, htmlResponse } from "./security";
 import { htmlShell as createHtmlShell, hmrScript } from "./html";
 
 const docuConfig = loadDocuConfig();
@@ -95,12 +95,11 @@ function createHtmlResponse(
     extraScripts: hmrScript(nonce),
     themeCss: inlineThemeCss,
   });
-  return htmlResponse(html, nonce, status);
+  return htmlResponse(html, nonce, status, process.env.NODE_ENV !== "production");
 }
 
 async function getDocsForSlug(slug: string) {
-  const resolved = resolve(DOCS_DIR, slug);
-  if (!resolved.startsWith(DOCS_DIR)) return null;
+  if (!isSlugSafe(slug, DOCS_DIR)) return null;
 
   const paths = [
     join(DOCS_DIR, slug, "index.mdx"),
@@ -218,9 +217,9 @@ function handleIndex(): Response {
 }
 
 function serveStatic(pathname: string): Response | null {
+  if (!isPathSafe(pathname, DIST_DIR)) return null;
   const decoded = decodeURIComponent(pathname);
   const assetPath = resolve(DIST_DIR, decoded.slice(1));
-  if (!assetPath.startsWith(DIST_DIR)) return null;
   try {
     const s = statSync(assetPath);
     if (s.isFile()) {
@@ -234,7 +233,9 @@ function serveStatic(pathname: string): Response | null {
 
   if (decoded.startsWith("/docs/assets/")) {
     const docsAsset = resolve(DOCS_DIR, "assets", decoded.replace("/docs/assets/", ""));
-    if (!docsAsset.startsWith(resolve(DOCS_DIR, "assets"))) return null;
+    const docsAssetsDir = resolve(DOCS_DIR, "assets");
+    const docsAssetsDirSlash = docsAssetsDir.endsWith("/") ? docsAssetsDir : docsAssetsDir + "/";
+    if (docsAsset !== docsAssetsDir && !docsAsset.startsWith(docsAssetsDirSlash)) return null;
     try {
       const s = statSync(docsAsset);
       if (s.isFile()) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@docubook/flame",
-  "version": "1.2.0",
+  "version": "1.2.1",
   "description": "A blazing-fast React + MDX framework powered by Bun, built for modern documentation experiences.",
   "type": "module",
   "bin": {
@@ -51,10 +51,10 @@
     "lucide-react": "^1.14.0",
     "react": "^19.0.0",
     "react-dom": "^19.0.0",
-    "@docubook/core": "^1.7.0",
     "@docubook/mdx-content": "^3.2.1",
-    "@docubook/ui-react": "^0.1.3",
-    "@docubook/themes-colors": "^0.10.0"
+    "@docubook/core": "^1.7.0",
+    "@docubook/themes-colors": "^0.10.1",
+    "@docubook/ui-react": "^0.1.3"
   },
   "peerDependencies": {
     "@sentry/bun": "^9.0.0"