@gen3/workspaces 0.12.45 → 0.12.46
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/LICENSE +201 -0
- package/dist/dts/providers/useJEGWorkspaceResourceMonitor.d.ts.map +1 -1
- package/dist/dts/providers/useJEGWorkspaceResourceMonitor.js +3 -1
- package/dist/dts/providers/useJEGWorkspaceResourceMonitor.js.map +1 -1
- package/dist/dts/server/workspaceAssetsHandler.d.ts.map +1 -1
- package/dist/dts/server/workspaceAssetsHandler.js +9 -2
- package/dist/dts/server/workspaceAssetsHandler.js.map +1 -1
- package/dist/dts/workspace/tiers/FreeWorkspace.d.ts.map +1 -1
- package/dist/dts/workspace/tiers/FreeWorkspace.js +65 -1
- package/dist/dts/workspace/tiers/FreeWorkspace.js.map +1 -1
- package/dist/dts/workspace/tiers/RemoteComputeWorkspace.d.ts.map +1 -1
- package/dist/dts/workspace/tiers/RemoteComputeWorkspace.js +69 -7
- package/dist/dts/workspace/tiers/RemoteComputeWorkspace.js.map +1 -1
- package/dist/index/cjs/index.js +132 -7
- package/dist/index/cjs/index.js.map +1 -1
- package/dist/index/esm/index.js +133 -8
- package/dist/index/esm/index.js.map +1 -1
- package/dist/jupyterlite-builds/free-private/requirements.txt +0 -1
- package/dist/server/cjs/server.js +9 -3
- package/dist/server/cjs/server.js.map +1 -1
- package/dist/server/esm/server.js +9 -3
- package/dist/server/esm/server.js.map +1 -1
- package/jupyterlite-builds/free-private/requirements.txt +0 -1
- package/package.json +5 -5
|
@@ -19,7 +19,7 @@ const ALLOWED_TIERS = new Set([
|
|
|
19
19
|
'free',
|
|
20
20
|
'remote'
|
|
21
21
|
]);
|
|
22
|
-
const SAFE_SEGMENT_RE =
|
|
22
|
+
const SAFE_SEGMENT_RE = /^@?[A-Za-z0-9._-]+$/;
|
|
23
23
|
const MIME_TYPES = {
|
|
24
24
|
'.html': 'text/html; charset=utf-8',
|
|
25
25
|
'.js': 'application/javascript; charset=utf-8',
|
|
@@ -142,8 +142,13 @@ function injectBranding(html, branding) {
|
|
|
142
142
|
let existing = {};
|
|
143
143
|
try {
|
|
144
144
|
existing = JSON.parse(existingJson);
|
|
145
|
-
} catch
|
|
146
|
-
|
|
145
|
+
} catch (error) {
|
|
146
|
+
// empty or malformed — start fresh
|
|
147
|
+
if (error instanceof Error) {
|
|
148
|
+
console.log('Failed to parse existing JSON', error.message);
|
|
149
|
+
} else {
|
|
150
|
+
console.log('Failed to parse existing JSON', error);
|
|
151
|
+
}
|
|
147
152
|
}
|
|
148
153
|
if (branding.appName) existing.appName = branding.appName;
|
|
149
154
|
if (branding.faviconUrl) existing.faviconUrl = branding.faviconUrl;
|
|
@@ -213,6 +218,7 @@ function createWorkspaceAssetsHandler(options) {
|
|
|
213
218
|
const safeSegments = [];
|
|
214
219
|
for (const seg of segments){
|
|
215
220
|
if (typeof seg !== 'string' || !SAFE_SEGMENT_RE.test(seg) || seg === '.' || seg === '..') {
|
|
221
|
+
console.log(`Forbidden segment: ${seg}`);
|
|
216
222
|
res.status(403).end('Forbidden');
|
|
217
223
|
return;
|
|
218
224
|
}
|