@effectstream/midnight-contracts 0.103.2 → 0.103.3

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@effectstream/midnight-contracts",
-  "version": "0.103.2",
+  "version": "0.103.3",
   "license": "(MIT OR Apache-2.0)",
   "homepage": "https://effectstream.github.io/docs/",
   "repository": {
@@ -21,7 +21,7 @@
     "./types": "./src/types.ts"
   },
   "dependencies": {
-    "@effectstream/utils": "0.103.2",
+    "@effectstream/utils": "0.103.3",
     "@scure/bip39": "^2.0.1",
     "dotenv": "^16.4.7",
     "rxjs": "^7.8.2",

package/src/dust-state.ts

@@ -19,10 +19,17 @@ const log = console;
  * Uses first 16 hex chars of the seed as a stable identifier — the seed
  * deterministically maps to a dust address, so this is a unique key per wallet
  * that is available before building the facade.
+ *
+ * `networkId` is stripped to a safe character set before it reaches
+ * `path.join`. No caller currently passes untrusted input here (`networkId`
+ * comes from the wallet SDK's own enum or a local CLI env var), but nothing
+ * upstream enforces that, and a `networkId` containing `../` would otherwise
+ * let the resulting path escape `baseDir`.
  */
 export function getDustStatePath(baseDir: string, networkId: string, seed: string): string {
   const seedKey = seed.slice(0, 16);
-  return path.join(baseDir, `${networkId}-${seedKey}.json`);
+  const safeNetworkId = networkId.replace(/[^a-zA-Z0-9_-]/g, "_");
+  return path.join(baseDir, `${safeNetworkId}-${seedKey}.json`);
 }
 
 function isUndeployedNetwork(networkId: string): boolean {