@examplary/cli 1.11.0 → 1.11.1

package/dist/commands/preview.js

@@ -12,6 +12,7 @@ import { WebSocketServer } from "ws";
 import { setApiHost, setApiKey } from "../lib/api.js";
 import { buildComponent } from "../lib/bundle.js";
 import { readJsonOrYamlFile, readMetaFile } from "../lib/read-meta.js";
+import { resolveInside } from "../lib/safe-path.js";
 import { buildStyles } from "../lib/styles.js";
 export const previewCommand = async (argv) => {
     setApiHost(argv.host);
@@ -33,7 +34,7 @@ export const previewCommand = async (argv) => {
         const sourcemap = c.req.query("sourcemap") === "1";
         const componentName = c.req.query("componentName");
         try {
-            const componentOutput = await buildComponent(path);
+            const componentOutput = await buildComponent(resolveInside(dir, path));
             if (sourcemap) {
                 return c.body(componentOutput.sourcemap, 200, {
                     "Content-Type": "application/json",
@@ -60,7 +61,13 @@ export const previewCommand = async (argv) => {
     });
     app.get("/api/icon", async (c) => {
         const path = c.req.query("path") || "";
-        const icon = await readFile(resolve(dir, path), "utf-8");
+        let icon;
+        try {
+            icon = await readFile(resolveInside(dir, path), "utf-8");
+        }
+        catch (error) {
+            return c.text(`Error reading icon from ${path}: ${error.message}`, 400);
+        }
         return c.body(icon, 200, {
             "Content-Type": "image/svg+xml",
         });
@@ -171,7 +178,11 @@ export const previewCommand = async (argv) => {
         watcher.close();
         process.exit(0);
     });
-    serve({ fetch: app.fetch, port: 5777 }, (address) => {
+    serve({
+        fetch: app.fetch,
+        hostname: "localhost",
+        port: 5777,
+    }, (address) => {
         const port = address.port;
         wsPort = port + 1234;
         const wsServer = createHttpServer();

package/dist/lib/safe-path.d.ts

@@ -0,0 +1,5 @@
+/**
+ * Resolves `path` against `dir` and throws if the result escapes `dir`,
+ * preventing path traversal via `../` segments or absolute paths.
+ */
+export declare const resolveInside: (dir: string, path: string) => string;

package/dist/lib/safe-path.js

@@ -0,0 +1,13 @@
+import { resolve, sep } from "path";
+/**
+ * Resolves `path` against `dir` and throws if the result escapes `dir`,
+ * preventing path traversal via `../` segments or absolute paths.
+ */
+export const resolveInside = (dir, path) => {
+    const base = resolve(dir);
+    const resolved = resolve(base, path);
+    if (resolved !== base && !resolved.startsWith(base + sep)) {
+        throw new Error(`Path "${path}" is outside of the question type directory`);
+    }
+    return resolved;
+};