@docubook/flame 1.3.5 → 1.3.7

package/.docu/node/build.ts

@@ -220,7 +220,7 @@ async function build() {
 
   const hasPlugins = !!docuConfig.plugins?.length;
   const builder = hasPlugins ? new BuildPluginBuilder(docuConfig) : null;
-  if (hasPlugins && builder) {
+  if (builder) {
     const plugins = await loadPlugins(docuConfig.plugins!);
     for (const plugin of plugins) {
       await plugin.setup(builder);

package/.docu/node/plugin-loader.ts

@@ -2,13 +2,15 @@ import { resolve } from "node:path";
 import { PROJECT_ROOT } from "./paths";
 import type { DocuBookPlugin, PluginEntry } from "./plugin";
 
+const NPM_PACKAGE_RE = /^(?:@[a-z0-9-~][a-z0-9-._~]*\/)?[a-z0-9-~][a-z0-9-._~]*$/;
+
 /**
  * Resolve a plugin specifier to an absolute path or npm package name.
  *
  * Resolution rules:
  * 1. Relative path (starts with `.`) → resolve from project root, guard traversal
  * 2. Absolute path (starts with `/`) → guard traversal
- * 3. Anything else → treat as npm package name (handled by Bun's import)
+ * 3. Anything else → validate as npm package name, then pass to Bun's import
  *
  * Path traversal protection:
  * - All file-system paths (relative & absolute) must resolve within PROJECT_ROOT.
@@ -25,7 +27,12 @@ export function resolveSpecifier(specifier: string): string {
     // Absolute path → use as-is
     resolved = specifier;
   } else {
-    // npm package name → handled by Bun's import
+    // npm package name → validate format, then handled by Bun's import
+    if (!NPM_PACKAGE_RE.test(specifier)) {
+      throw new Error(
+        `[plugin-loader] Invalid plugin specifier "${specifier}": must be a valid npm package name, relative path, or absolute path`
+      );
+    }
     return specifier;
   }
 

package/.docu/node/plugin.ts

@@ -198,7 +198,7 @@ export interface PluginBuilder {
 
   /**
    * Register additional remark (Markdown) plugins for the MDX compilation pipeline.
-   * Plugins from all plugins are merged and applied **after** the default set.
+   * Plugins from all registered callbacks are merged and applied **after** the default set.
    *
    * @example
    * build.remarkPlugins(() => [require("remark-custom-heading-id")]);
@@ -207,7 +207,7 @@ export interface PluginBuilder {
 
   /**
    * Register additional rehype (HTML) plugins for the MDX compilation pipeline.
-   * Plugins from all plugins are merged and applied **after** the default set.
+   * Plugins from all registered callbacks are merged and applied **after** the default set.
    *
    * @example
    * build.rehypePlugins(() => [require("rehype-autolink-headings")]);

package/.docu/node/security.ts

@@ -89,6 +89,40 @@ export function injectNonce(html: string, nonce: string): string {
   });
 }
 
+export interface PluginResponseLike {
+  status: number;
+  statusText?: string;
+  headers: Headers;
+  body: BodyInit | null;
+}
+
+/**
+ * Wrap a plugin response with security headers.
+ * - Fills in SECURITY_HEADERS defaults where plugin hasn't set a value
+ * - Adds Content-Security-Policy for HTML responses (with optional unsafe-eval)
+ * - Preserves plugin body, status, statusText unchanged
+ */
+export function wrapPluginResponse(
+  pluginResponse: PluginResponseLike,
+  allowEval = false
+): Response {
+  const securedHeaders = new Headers(pluginResponse.headers);
+  for (const [key, value] of Object.entries(SECURITY_HEADERS)) {
+    if (!securedHeaders.has(key)) {
+      securedHeaders.set(key, value);
+    }
+  }
+  const contentType = securedHeaders.get("Content-Type") || "";
+  if (contentType.includes("text/html") && !securedHeaders.has("Content-Security-Policy")) {
+    securedHeaders.set("Content-Security-Policy", cspHeader(generateNonce(), allowEval));
+  }
+  return new Response(pluginResponse.body, {
+    status: pluginResponse.status,
+    statusText: pluginResponse.statusText,
+    headers: securedHeaders,
+  });
+}
+
 export function htmlResponse(
   html: string,
   nonce: string,

package/.docu/node/server-routes.ts

@@ -1,5 +1,5 @@
 import { readFile } from "node:fs/promises";
-import { resolve, join } from "node:path";
+import { resolve } from "node:path";
 import { statSync } from "node:fs";
 import React, { type ReactNode } from "react";
 import { renderToString } from "react-dom/server";
@@ -62,19 +62,26 @@ async function getDocsForSlug(
   if (!isSlugSafe(slug, DOCS_DIR)) return null;
 
   const paths = [
-    join(DOCS_DIR, slug, "index.mdx"),
-    join(DOCS_DIR, `${slug}.mdx`),
-    join(DOCS_DIR, slug, "index.md"),
-    join(DOCS_DIR, `${slug}.md`),
+    resolve(DOCS_DIR, slug, "index.mdx"),
+    resolve(DOCS_DIR, `${slug}.mdx`),
+    resolve(DOCS_DIR, slug, "index.md"),
+    resolve(DOCS_DIR, `${slug}.md`),
   ];
 
+  const resolvedDocsDir = resolve(DOCS_DIR);
   let filePath: string | null = null;
   let raw: string | null = null;
   for (const p of paths) {
-    if (!p.startsWith(DOCS_DIR)) continue;
+    const resolvedCandidate = resolve(p);
+    if (
+      resolvedCandidate !== resolvedDocsDir &&
+      !resolvedCandidate.startsWith(resolvedDocsDir + "/")
+    ) {
+      continue;
+    }
     try {
-      raw = await readFile(p, "utf-8");
-      filePath = p;
+      raw = await readFile(resolvedCandidate, "utf-8");
+      filePath = resolvedCandidate;
       break;
     } catch (err) {
       if ((err as NodeJS.ErrnoException).code !== "ENOENT") throw err;
@@ -231,8 +238,13 @@ export function handleNotFound(state: ServerState, depth = 0): Response {
 }
 
 export function serveStatic(pathname: string): Response | null {
+  let decoded: string;
+  try {
+    decoded = decodeURIComponent(pathname);
+  } catch {
+    return null;
+  }
   if (!isPathSafe(pathname, DIST_DIR)) return null;
-  const decoded = decodeURIComponent(pathname);
   const assetPath = resolve(DIST_DIR, decoded.slice(1));
   try {
     const s = statSync(assetPath);
@@ -246,10 +258,11 @@ export function serveStatic(pathname: string): Response | null {
   }
 
   if (decoded.startsWith("/docs/assets/")) {
-    const docsAsset = resolve(DOCS_DIR, "assets", decoded.replace("/docs/assets/", ""));
     const docsAssetsDir = resolve(DOCS_DIR, "assets");
-    const docsAssetsDirSlash = docsAssetsDir.endsWith("/") ? docsAssetsDir : docsAssetsDir + "/";
-    if (docsAsset !== docsAssetsDir && !docsAsset.startsWith(docsAssetsDirSlash)) return null;
+    const requestedRelative = decoded.slice("/docs/assets/".length);
+    const docsAsset = resolve(docsAssetsDir, requestedRelative);
+    const docsAssetsDirWithSep = docsAssetsDir.endsWith("/") ? docsAssetsDir : docsAssetsDir + "/";
+    if (docsAsset !== docsAssetsDir && !docsAsset.startsWith(docsAssetsDirWithSep)) return null;
     try {
       const s = statSync(docsAsset);
       if (s.isFile()) {

package/.docu/node/server.ts

@@ -15,11 +15,12 @@ import {
   serverErrorResponse,
   type ServerState,
 } from "./server-routes";
-import { SECURITY_HEADERS, cspHeader, generateNonce } from "./security";
+import { wrapPluginResponse } from "./security";
 
 const docuConfig = loadDocuConfig();
 
-const PORT = process.env.PORT ?? "3000";
+const parsedPort = parseInt(process.env.PORT ?? "3000", 10);
+const PORT = Number.isInteger(parsedPort) && parsedPort > 0 && parsedPort <= 65535 ? parsedPort : 3000;
 
 logger.buildStart();
 
@@ -42,7 +43,7 @@ logger.routes();
 // Plugin setup — all hooks active (onLoad, remark/rehype, frontmatter, head/body, html transform, handleRequest)
 const hasPlugins = !!docuConfig.plugins?.length;
 const builder = hasPlugins ? new BuildPluginBuilder(docuConfig) : null;
-if (hasPlugins && builder) {
+if (builder) {
   const plugins = await loadPlugins(docuConfig.plugins!);
   for (const plugin of plugins) {
     await plugin.setup(builder);
@@ -103,28 +104,14 @@ const server = Bun.serve({
     const startTime = performance.now();
 
     if (builder) {
+      const serverPort = server.port ?? PORT;
+      const serverHostname = server.hostname ?? "localhost";
       const pluginResponse = await builder.runHandleRequest(req, {
-        port: server.port!,
-        hostname: server.hostname!,
+        port: serverPort,
+        hostname: serverHostname,
       });
       if (pluginResponse) {
-        // Wrap plugin response with security headers.
-        // Plugin's own headers take precedence over defaults.
-        const securedHeaders = new Headers(pluginResponse.headers);
-        for (const [key, value] of Object.entries(SECURITY_HEADERS)) {
-          if (!securedHeaders.has(key)) {
-            securedHeaders.set(key, value);
-          }
-        }
-        const contentType = securedHeaders.get("Content-Type") || "";
-        if (contentType.includes("text/html") && !securedHeaders.has("Content-Security-Policy")) {
-          securedHeaders.set("Content-Security-Policy", cspHeader(generateNonce(), true));
-        }
-        const securedResponse = new Response(pluginResponse.body, {
-          status: pluginResponse.status,
-          statusText: pluginResponse.statusText,
-          headers: securedHeaders,
-        });
+        const securedResponse = wrapPluginResponse(pluginResponse, true);
         logger.request(
           req.method,
           pathname,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@docubook/flame",
-  "version": "1.3.5",
+  "version": "1.3.7",
   "description": "A blazing-fast React + MDX framework powered by Bun, built for modern documentation experiences.",
   "type": "module",
   "bin": {
@@ -53,9 +53,9 @@
     "react-dom": "^19.2.7",
     "unified": "^11.0.0",
     "@docubook/core": "^1.7.2",
+    "@docubook/mdx-content": "^3.2.2",
     "@docubook/themes-colors": "^0.10.2",
-    "@docubook/ui-react": "^0.1.4",
-    "@docubook/mdx-content": "^3.2.2"
+    "@docubook/ui-react": "^0.1.4"
   },
   "peerDependencies": {
     "@sentry/bun": "^10.0.0"