@farm.js/search 0.1.0-beta.0 → 0.1.0-beta.1

package/dist/build.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"build.d.ts","sourceRoot":"","sources":["../src/build.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AAEzD,MAAM,WAAW,gBAAgB;IAC/B,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,qBAAqB,CAAC;CAChC;AAED,MAAM,WAAW,iBAAiB;IAChC,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,aAAa,EAAE,MAAM,EAAE,CAAC;CACzB;AAED,wBAAsB,gBAAgB,CAAC,KAAK,EAAE,gBAAgB,GAAG,OAAO,CAAC,iBAAiB,CAAC,CA+E1F;AAED,wBAAgB,sBAAsB,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAKhF;AAED,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAGnE;AAED,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAQpE;AAED,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAKrE;AAED,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAKtD;AAED,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAoB3E"}
+{"version":3,"file":"build.d.ts","sourceRoot":"","sources":["../src/build.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AAEzD,MAAM,WAAW,gBAAgB;IAC/B,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,qBAAqB,CAAC;CAChC;AAED,MAAM,WAAW,iBAAiB;IAChC,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,aAAa,EAAE,MAAM,EAAE,CAAC;CACzB;AAED,wBAAsB,gBAAgB,CAAC,KAAK,EAAE,gBAAgB,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAgF1F;AAED,wBAAgB,sBAAsB,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAKhF;AAED,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAGnE;AAED,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAQpE;AAED,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAKrE;AAED,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAKtD;AAED,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAoB3E"}

package/dist/build.js

@@ -1,4 +1,4 @@
-import { mkdir, readFile, readdir, rm } from "node:fs/promises";
+import { lstat, mkdir, readFile, readdir, realpath, rm } from "node:fs/promises";
 import path from "node:path";
 import * as pagefind from "pagefind";
 export async function writeSearchIndex(input) {
@@ -6,6 +6,7 @@ export async function writeSearchIndex(input) {
     const basePath = normalizeBasePath(input.basePath);
     const bundlePath = withBasePath(`/${input.options.output}`, basePath);
     const outputPath = resolveOutputPath(publicDir, bundlePath);
+    await assertOutputPathInside(publicDir, outputPath);
     const htmlFiles = await collectHtmlFiles(publicDir, outputPath);
     const routes = htmlFiles
         .map((file) => ({
@@ -163,11 +164,44 @@ async function collectHtmlFiles(root, ignoredDirectory) {
 function resolveOutputPath(publicDir, bundlePath) {
     const outputPath = path.resolve(publicDir, `.${bundlePath}`);
     const relative = path.relative(publicDir, outputPath);
-    if (!relative || relative.startsWith("..") || path.isAbsolute(relative)) {
+    if (!relative ||
+        relative === ".." ||
+        relative.startsWith(`..${path.sep}`) ||
+        path.isAbsolute(relative)) {
         throw new Error("[farm:search] Search output must stay inside the public output directory");
     }
     return outputPath;
 }
+async function assertOutputPathInside(publicDir, outputPath) {
+    const realPublicDir = await realpath(publicDir);
+    let existingAncestor = outputPath;
+    while (true) {
+        try {
+            existingAncestor = await realpath(existingAncestor);
+            break;
+        }
+        catch (error) {
+            if (error.code !== "ENOENT")
+                throw error;
+            try {
+                await lstat(existingAncestor);
+                throw new Error("[farm:search] Search output must stay inside the public output directory, including through symlinks");
+            }
+            catch (statError) {
+                if (statError.code !== "ENOENT")
+                    throw statError;
+            }
+            const parent = path.dirname(existingAncestor);
+            if (parent === existingAncestor)
+                throw error;
+            existingAncestor = parent;
+        }
+    }
+    const relative = path.relative(realPublicDir, existingAncestor);
+    if (relative === ".." || relative.startsWith(`..${path.sep}`) || path.isAbsolute(relative)) {
+        throw new Error("[farm:search] Search output must stay inside the public output directory, including through symlinks");
+    }
+}
 function pagefindError(action, errors) {
     const details = errors.length ? `:\n${errors.map((error) => `  - ${error}`).join("\n")}` : "";
     return new Error(`[farm:search] Pagefind ${action}${details}`);

package/dist/config.js

@@ -57,11 +57,30 @@ function normalizeOutput(value) {
         value.includes("\\") ||
         value.includes("?") ||
         value.includes("#") ||
-        segments.some((segment) => segment === "." || segment === ".." || !segment)) {
+        segments.some((segment) => !isStableOutputSegment(segment))) {
         throw new TypeError("Search output must stay inside the public output directory");
     }
     return normalized;
 }
+function isStableOutputSegment(segment) {
+    if (!segment)
+        return false;
+    let decoded = segment;
+    try {
+        decoded = decodeURIComponent(segment);
+    }
+    catch {
+        // Malformed escapes remain literal in browser pathnames.
+    }
+    return (decoded !== "." &&
+        decoded !== ".." &&
+        !decoded.includes("/") &&
+        !decoded.includes("\\") &&
+        !Array.from(decoded).some((character) => {
+            const code = character.charCodeAt(0);
+            return code <= 31 || (code >= 127 && code <= 159);
+        }));
+}
 function normalizeLanguage(value) {
     const normalized = normalizeOptionalString(value, "language")?.toLowerCase();
     if (normalized && !/^[a-z]{2}$/.test(normalized)) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@farm.js/search",
-  "version": "0.1.0-beta.0",
+  "version": "0.1.0-beta.1",
   "description": "Build-time static page search for Farm.js applications",
   "keywords": [
     "farm.js",
@@ -37,7 +37,7 @@
   },
   "dependencies": {
     "pagefind": "^1.5.2",
-    "@farm.js/core": "0.1.0-beta.92"
+    "@farm.js/core": "0.1.0-beta.93"
   },
   "devDependencies": {
     "@types/node": "^20.10.5",