@gen3/workspaces 0.12.45 → 0.12.46
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/LICENSE +201 -0
- package/dist/dts/providers/useJEGWorkspaceResourceMonitor.d.ts.map +1 -1
- package/dist/dts/providers/useJEGWorkspaceResourceMonitor.js +3 -1
- package/dist/dts/providers/useJEGWorkspaceResourceMonitor.js.map +1 -1
- package/dist/dts/server/workspaceAssetsHandler.d.ts.map +1 -1
- package/dist/dts/server/workspaceAssetsHandler.js +9 -2
- package/dist/dts/server/workspaceAssetsHandler.js.map +1 -1
- package/dist/dts/workspace/tiers/FreeWorkspace.d.ts.map +1 -1
- package/dist/dts/workspace/tiers/FreeWorkspace.js +65 -1
- package/dist/dts/workspace/tiers/FreeWorkspace.js.map +1 -1
- package/dist/dts/workspace/tiers/RemoteComputeWorkspace.d.ts.map +1 -1
- package/dist/dts/workspace/tiers/RemoteComputeWorkspace.js +69 -7
- package/dist/dts/workspace/tiers/RemoteComputeWorkspace.js.map +1 -1
- package/dist/index/cjs/index.js +132 -7
- package/dist/index/cjs/index.js.map +1 -1
- package/dist/index/esm/index.js +133 -8
- package/dist/index/esm/index.js.map +1 -1
- package/dist/jupyterlite-builds/free-private/requirements.txt +0 -1
- package/dist/server/cjs/server.js +9 -3
- package/dist/server/cjs/server.js.map +1 -1
- package/dist/server/esm/server.js +9 -3
- package/dist/server/esm/server.js.map +1 -1
- package/jupyterlite-builds/free-private/requirements.txt +0 -1
- package/package.json +5 -5
|
@@ -17,7 +17,7 @@ const ALLOWED_TIERS = new Set([
|
|
|
17
17
|
'free',
|
|
18
18
|
'remote'
|
|
19
19
|
]);
|
|
20
|
-
const SAFE_SEGMENT_RE =
|
|
20
|
+
const SAFE_SEGMENT_RE = /^@?[A-Za-z0-9._-]+$/;
|
|
21
21
|
const MIME_TYPES = {
|
|
22
22
|
'.html': 'text/html; charset=utf-8',
|
|
23
23
|
'.js': 'application/javascript; charset=utf-8',
|
|
@@ -140,8 +140,13 @@ function injectBranding(html, branding) {
|
|
|
140
140
|
let existing = {};
|
|
141
141
|
try {
|
|
142
142
|
existing = JSON.parse(existingJson);
|
|
143
|
-
} catch
|
|
144
|
-
|
|
143
|
+
} catch (error) {
|
|
144
|
+
// empty or malformed — start fresh
|
|
145
|
+
if (error instanceof Error) {
|
|
146
|
+
console.log('Failed to parse existing JSON', error.message);
|
|
147
|
+
} else {
|
|
148
|
+
console.log('Failed to parse existing JSON', error);
|
|
149
|
+
}
|
|
145
150
|
}
|
|
146
151
|
if (branding.appName) existing.appName = branding.appName;
|
|
147
152
|
if (branding.faviconUrl) existing.faviconUrl = branding.faviconUrl;
|
|
@@ -211,6 +216,7 @@ function createWorkspaceAssetsHandler(options) {
|
|
|
211
216
|
const safeSegments = [];
|
|
212
217
|
for (const seg of segments){
|
|
213
218
|
if (typeof seg !== 'string' || !SAFE_SEGMENT_RE.test(seg) || seg === '.' || seg === '..') {
|
|
219
|
+
console.log(`Forbidden segment: ${seg}`);
|
|
214
220
|
res.status(403).end('Forbidden');
|
|
215
221
|
return;
|
|
216
222
|
}
|