@farm.js/partytown 0.1.0-beta.0 → 0.1.0-beta.1

package/dist/build.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"build.d.ts","sourceRoot":"","sources":["../src/build.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,aAAa,CAAC;AAE5D,eAAO,MAAM,mBAAmB,eAAe,CAAC;AAChD,eAAO,MAAM,mBAAmB,sBAAsB,CAAC;AAEvD,MAAM,WAAW,mBAAmB;IAClC,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,wBAAwB,CAAC;CACnC;AAED,MAAM,WAAW,oBAAoB;IACnC,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,EAAE,MAAM,CAAC;IACtB,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,wBAAsB,4BAA4B,CAChD,KAAK,EAAE,mBAAmB,GACzB,OAAO,CAAC,oBAAoB,CAAC,CAgB/B;AAED,wBAAgB,wBAAwB,CACtC,OAAO,EAAE,wBAAwB,EACjC,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,OAAO,GACb,MAAM,CAeR;AAED,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,MAAM,CAMnF;AAED,wBAAsB,qBAAqB,CACzC,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,wBAAwB,GAChC,OAAO,CAAC;IAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,CAAC,CA8BrE;AAED,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAUnE;AAED,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAIxE;AAED,wBAAgB,yBAAyB,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAEnF"}
+{"version":3,"file":"build.d.ts","sourceRoot":"","sources":["../src/build.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,aAAa,CAAC;AAE5D,eAAO,MAAM,mBAAmB,eAAe,CAAC;AAChD,eAAO,MAAM,mBAAmB,sBAAsB,CAAC;AAEvD,MAAM,WAAW,mBAAmB;IAClC,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,wBAAwB,CAAC;CACnC;AAED,MAAM,WAAW,oBAAoB;IACnC,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,EAAE,MAAM,CAAC;IACtB,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,wBAAsB,4BAA4B,CAChD,KAAK,EAAE,mBAAmB,GACzB,OAAO,CAAC,oBAAoB,CAAC,CAoB/B;AAED,wBAAgB,wBAAwB,CACtC,OAAO,EAAE,wBAAwB,EACjC,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,OAAO,GACb,MAAM,CAeR;AAED,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,MAAM,CAMnF;AAcD,wBAAsB,qBAAqB,CACzC,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,wBAAwB,GAChC,OAAO,CAAC;IAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,CAAC,CA8BrE;AAED,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAUnE;AAED,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAIxE;AAED,wBAAgB,yBAAyB,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAEnF"}

package/dist/build.js

@@ -1,4 +1,4 @@
-import { readFile, writeFile } from "node:fs/promises";
+import { lstat, readFile, realpath, rm, writeFile } from "node:fs/promises";
 import path from "node:path";
 import { partytownSnippet } from "@qwik.dev/partytown/integration";
 import { copyLibFiles, libDirPath } from "@qwik.dev/partytown/utils";
@@ -10,6 +10,10 @@ export async function writePartytownBuildArtifacts(input) {
     const relativeAssetsDir = path.posix.join(basePath.slice(1), PARTYTOWN_DIRECTORY);
     const assetsDir = path.join(publicDir, ...relativeAssetsDir.split("/"));
     const debug = input.options.debug ?? false;
+    await assertAssetsPathInsidePublicDir(publicDir, assetsDir);
+    // This directory is entirely plugin-owned. Recreate it so stale files and
+    // nested symlinks cannot redirect copyFile outside the verified destination.
+    await rm(assetsDir, { recursive: true, force: true });
     await copyLibFiles(assetsDir, { debugDir: debug });
     const bootstrapPath = path.join(assetsDir, PARTYTOWN_BOOTSTRAP);
     await writeFile(bootstrapPath, createPartytownBootstrap(input.options, basePath, false), "utf8");
@@ -36,7 +40,7 @@ export function createPartytownBootstrap(options, basePath, isDev) {
     return `${partytownSnippet(config)}\n`;
 }
 export function injectPartytownBootstrap(html, bootstrapUrl) {
-    if (html.includes("data-farm-partytown"))
+    if (hasPartytownBootstrap(html))
         return html;
     const closingHead = html.search(/<\/head\s*>/i);
     if (closingHead < 0)
@@ -44,6 +48,18 @@ export function injectPartytownBootstrap(html, bootstrapUrl) {
     const tag = `<script src="${escapeHtmlAttribute(bootstrapUrl)}" data-farm-partytown></script>`;
     return `${html.slice(0, closingHead)}${tag}${html.slice(closingHead)}`;
 }
+function hasPartytownBootstrap(html) {
+    const scriptTags = html.matchAll(/<script\b(?:[^>"']|"[^"]*"|'[^']*')*>/gi);
+    for (const tag of scriptTags) {
+        const attributes = tag[0].slice("<script".length, -1);
+        const parsed = attributes.matchAll(/([^\s"'<>=]+)(?:\s*=\s*(?:"[^"]*"|'[^']*'|[^\s"'=<>]+))?/g);
+        for (const attribute of parsed) {
+            if (attribute[1]?.toLowerCase() === "data-farm-partytown")
+                return true;
+        }
+    }
+    return false;
+}
 export async function readPartytownDevAsset(pathname, basePath, options) {
     const prefix = partytownAssetUrl("", basePath);
     if (!pathname.startsWith(prefix))
@@ -99,6 +115,46 @@ export function partytownAssetUrl(file, basePath) {
 export function resolvePartytownPublicDir(outputDir, preset) {
     return path.join(outputDir, preset.startsWith("vercel") ? "static" : "public");
 }
+async function assertAssetsPathInsidePublicDir(publicDir, assetsDir) {
+    const prospectivePublicDir = await resolveProspectiveRealPath(publicDir);
+    const prospectiveAssetsDir = await resolveProspectiveRealPath(assetsDir);
+    const relativePath = path.relative(prospectivePublicDir, prospectiveAssetsDir);
+    if (relativePath === ".." ||
+        relativePath.startsWith(`..${path.sep}`) ||
+        path.isAbsolute(relativePath)) {
+        throw new Error("[farm:partytown] Asset output must stay inside the public output directory, including through symlinks.");
+    }
+}
+async function resolveProspectiveRealPath(candidate) {
+    const missingSegments = [];
+    let existingAncestor = path.resolve(candidate);
+    while (true) {
+        try {
+            return path.join(await realpath(existingAncestor), ...missingSegments);
+        }
+        catch (error) {
+            if (error.code !== "ENOENT")
+                throw error;
+            let existingEntry = false;
+            try {
+                await lstat(existingAncestor);
+                existingEntry = true;
+            }
+            catch (statError) {
+                if (statError.code !== "ENOENT")
+                    throw statError;
+            }
+            if (existingEntry) {
+                throw new Error("[farm:partytown] Asset output must stay inside the public output directory, including through symlinks.");
+            }
+            const parent = path.dirname(existingAncestor);
+            if (parent === existingAncestor)
+                throw error;
+            missingSegments.unshift(path.basename(existingAncestor));
+            existingAncestor = parent;
+        }
+    }
+}
 function contentTypeFor(file) {
     if (file.endsWith(".js"))
         return "text/javascript; charset=utf-8";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@farm.js/partytown",
-  "version": "0.1.0-beta.0",
+  "version": "0.1.0-beta.1",
   "description": "Run opted-in third-party scripts in a web worker in Farm.js applications",
   "keywords": [
     "analytics",
@@ -37,7 +37,7 @@
   },
   "dependencies": {
     "@qwik.dev/partytown": "^0.14.4",
-    "@farm.js/core": "0.1.0-beta.91"
+    "@farm.js/core": "0.1.0-beta.93"
   },
   "devDependencies": {
     "@types/node": "^20.10.5",