@electron-memory/monitor 0.2.1 → 0.2.2

package/dist/index.js

@@ -1142,8 +1142,18 @@ function isPathInsideRoot(filePath, root) {
   if (f === r) {
     return true;
   }
-  const sep2 = r.endsWith(path2.sep) ? r : `${r}${path2.sep}`;
-  return f.startsWith(sep2);
+  const rel = path2.relative(r, f);
+  if (!rel || rel.startsWith("..") || path2.isAbsolute(rel)) {
+    return false;
+  }
+  return true;
+}
+function corsHeaders() {
+  return {
+    "Access-Control-Allow-Origin": "*",
+    "Access-Control-Allow-Methods": "GET, OPTIONS",
+    "Access-Control-Allow-Headers": "*"
+  };
 }
 function registerDashboardSchemePrivileged() {
   if (privilegedRegistered) {
@@ -1175,15 +1185,23 @@ function ensureDashboardProtocolHandler(uiRoot) {
   handlerRegistered = true;
   const base = path2.resolve(uiRoot);
   import_electron2.protocol.handle(SCHEME, async (request) => {
+    if (request.method === "OPTIONS") {
+      return new Response(null, { status: 204, headers: corsHeaders() });
+    }
     try {
-      const { pathname } = new URL(request.url);
-      let rel = pathname.startsWith("/") ? pathname.slice(1) : pathname;
+      let pathname;
+      try {
+        pathname = decodeURIComponent(new URL(request.url).pathname);
+      } catch {
+        return new Response("Bad URL", { status: 400, headers: corsHeaders() });
+      }
+      let rel = pathname.replace(/^\/+/, "");
       if (!rel) {
         rel = "index.html";
       }
       const filePath = path2.resolve(path2.join(base, rel));
       if (!isPathInsideRoot(filePath, base)) {
-        return new Response("Forbidden", { status: 403 });
+        return new Response("Forbidden", { status: 403, headers: corsHeaders() });
       }
       const body = await (0, import_promises.readFile)(filePath);
       const ext = path2.extname(filePath).toLowerCase();
@@ -1192,12 +1210,13 @@ function ensureDashboardProtocolHandler(uiRoot) {
         status: 200,
         headers: {
           "Content-Type": mime,
-          "Cache-Control": "no-store"
+          "Cache-Control": "no-store",
+          ...corsHeaders()
         }
       });
     } catch (err) {
       const msg = err instanceof Error ? err.message : String(err);
-      return new Response(msg, { status: 404 });
+      return new Response(msg, { status: 404, headers: corsHeaders() });
     }
   });
 }