@electron-memory/monitor 0.2.1 → 0.2.3

package/dist/index.js

@@ -1114,6 +1114,7 @@ var path3 = __toESM(require("path"));
 var import_electron2 = require("electron");
 var import_promises = require("fs/promises");
 var path2 = __toESM(require("path"));
+var import_node_url = require("url");
 var SCHEME = "emm-dashboard";
 var privilegedRegistered = false;
 var handlerRegistered = false;
@@ -1142,8 +1143,60 @@ function isPathInsideRoot(filePath, root) {
   if (f === r) {
     return true;
   }
-  const sep2 = r.endsWith(path2.sep) ? r : `${r}${path2.sep}`;
-  return f.startsWith(sep2);
+  const rel = path2.relative(r, f);
+  if (!rel || rel.startsWith("..") || path2.isAbsolute(rel)) {
+    return false;
+  }
+  return true;
+}
+function urlToUiRelativePath(requestUrl) {
+  let u;
+  try {
+    u = new URL(requestUrl);
+  } catch {
+    return "";
+  }
+  let p = "";
+  try {
+    p = decodeURIComponent(u.pathname || "");
+  } catch {
+    p = u.pathname || "";
+  }
+  p = p.replace(/^\/+/, "");
+  const host = (u.hostname || "").toLowerCase();
+  if (p.includes("..")) {
+    return "";
+  }
+  if (host === "electron" || host === "") {
+    return p || "index.html";
+  }
+  if (p) {
+    return `${host}/${p}`.replace(/\\/g, "/");
+  }
+  if (host.includes(".")) {
+    return host;
+  }
+  return "index.html";
+}
+function bufferToResponseBody(buf) {
+  return new Uint8Array(buf.buffer, buf.byteOffset, buf.byteLength);
+}
+function looksLikeHtml(buf) {
+  let i = 0;
+  if (buf.length >= 3 && buf[0] === 239 && buf[1] === 187 && buf[2] === 191) {
+    i = 3;
+  }
+  while (i < buf.length && (buf[i] === 32 || buf[i] === 9 || buf[i] === 10 || buf[i] === 13)) {
+    i += 1;
+  }
+  return i < buf.length && buf[i] === 60;
+}
+function corsHeaders() {
+  return {
+    "Access-Control-Allow-Origin": "*",
+    "Access-Control-Allow-Methods": "GET, OPTIONS",
+    "Access-Control-Allow-Headers": "*"
+  };
 }
 function registerDashboardSchemePrivileged() {
   if (privilegedRegistered) {
@@ -1175,29 +1228,55 @@ function ensureDashboardProtocolHandler(uiRoot) {
   handlerRegistered = true;
   const base = path2.resolve(uiRoot);
   import_electron2.protocol.handle(SCHEME, async (request) => {
+    if (request.method === "OPTIONS") {
+      return new Response(null, { status: 204, headers: corsHeaders() });
+    }
     try {
-      const { pathname } = new URL(request.url);
-      let rel = pathname.startsWith("/") ? pathname.slice(1) : pathname;
-      if (!rel) {
-        rel = "index.html";
+      const rel = urlToUiRelativePath(request.url);
+      if (!rel || rel.includes("..")) {
+        return new Response("Bad path", { status: 400, headers: corsHeaders() });
       }
-      const filePath = path2.resolve(path2.join(base, rel));
+      const filePath = path2.resolve(path2.join(base, ...rel.split("/")));
       if (!isPathInsideRoot(filePath, base)) {
-        return new Response("Forbidden", { status: 403 });
+        return new Response("Forbidden", { status: 403, headers: corsHeaders() });
+      }
+      const fileUrl = (0, import_node_url.pathToFileURL)(filePath).href;
+      let upstream;
+      try {
+        upstream = await import_electron2.net.fetch(fileUrl);
+      } catch {
+        upstream = new Response(null, { status: 599 });
+      }
+      let buf;
+      if (!upstream.ok) {
+        buf = await (0, import_promises.readFile)(filePath);
+      } else {
+        const ab = await upstream.arrayBuffer();
+        buf = Buffer.from(ab);
       }
-      const body = await (0, import_promises.readFile)(filePath);
       const ext = path2.extname(filePath).toLowerCase();
+      if (ext === ".html" && !looksLikeHtml(buf)) {
+        console.error(
+          "[@electron-memory/monitor] emm-dashboard: not HTML at",
+          filePath,
+          "url=",
+          request.url
+        );
+        return new Response("Invalid dashboard HTML", { status: 500, headers: corsHeaders() });
+      }
       const mime = MIME_BY_EXT[ext] || "application/octet-stream";
-      return new Response(body, {
+      return new Response(bufferToResponseBody(buf), {
         status: 200,
         headers: {
           "Content-Type": mime,
-          "Cache-Control": "no-store"
+          "Cache-Control": "no-store",
+          ...corsHeaders()
         }
       });
     } catch (err) {
       const msg = err instanceof Error ? err.message : String(err);
-      return new Response(msg, { status: 404 });
+      console.error("[@electron-memory/monitor] emm-dashboard:", request.url, err);
+      return new Response(msg, { status: 404, headers: corsHeaders() });
     }
   });
 }