@goodandready/dsh-image-gen 0.11.33 → 0.11.34

package/lib/attachment-helper.js

@@ -1,6 +1,7 @@
 import path from 'node:path'
 import { mkdir, writeFile } from 'node:fs/promises'
 import { saveAttachmentSafe, buildSidecar, toLosslessJson, ensureImageFormat } from './providers.js'
+import { resolveInside } from './security.js'
 import { recordSpend } from './cost-meter.js'
 import { buildDualOutputMarkdown } from './resolve-image.js'
 
@@ -29,7 +30,7 @@ export async function saveAndAttachResult(ctx, exec, cfg, {
 
   const sessionCwd = exec?.agent?.session?.header?.cwd
   const targetDir = (args.output_dir && String(args.output_dir).trim()) || cfg.outputDir || 'generated/images'
-  const outDir = path.resolve(sessionCwd || process.cwd(), targetDir)
+  const outDir = resolveInside(sessionCwd || process.cwd(), targetDir)
   await mkdir(outDir, { recursive: true })
   const filePath = path.join(outDir, name)
   await writeFile(filePath, bytes)

package/lib/frontend-assets.js

@@ -1,3 +1,4 @@
+import { resolveInside } from './security.js'
 import sharp from 'sharp'
 // @ts-check
 import path from 'node:path'
@@ -712,20 +713,20 @@ export async function generatePwaIconSuite({
   // 6. Write files to outDir if provided
   const exportedFiles = []
   if (outDir) {
-    const fullIconsDir = path.resolve(outDir, iconsDir)
+    const fullIconsDir = resolveInside(outDir, iconsDir || 'icons')
     await fs.mkdir(fullIconsDir, { recursive: true })
 
     for (const item of generatedIcons) {
-      const filePath = path.resolve(outDir, item.filename)
+      const filePath = resolveInside(outDir, item.filename)
       await fs.writeFile(filePath, item.bytes)
       exportedFiles.push(filePath)
     }
 
-    const icoPath = path.resolve(outDir, faviconIcoFilename)
+    const icoPath = resolveInside(outDir, faviconIcoFilename)
     await fs.writeFile(icoPath, faviconIcoBuffer)
     exportedFiles.push(icoPath)
 
-    const manifestPath = path.resolve(outDir, 'manifest.json')
+    const manifestPath = resolveInside(outDir, 'manifest.json')
     await fs.writeFile(manifestPath, manifestJson)
     exportedFiles.push(manifestPath)
   }

package/lib/generation-helpers.js

@@ -20,6 +20,7 @@ import { enhancePrompt } from './prompt-enhancer.js'
 import { buildFaceConsistencyPrompt, getSessionAnchor, applyAnchorPromptHints } from './anchor-helpers.js'
 import { sanitizeNegativePrompt, supportsNegativePrompt } from './negative-sanitizer.js'
 import { recordSpend } from './cost-meter.js'
+import { resolveInside } from './security.js'
 import { setCachedGeneration } from './generation-cache.js'
 import {
   readHistory,
@@ -183,7 +184,7 @@ export async function saveGeneratedImageArtifact({
 
   const sessionCwd = exec?.agent?.session?.header?.cwd
   const targetDir = (args.output_dir && String(args.output_dir).trim()) || cfg.outputDir || 'generated/images'
-  const outDir = path.resolve(sessionCwd || process.cwd(), targetDir)
+  const outDir = resolveInside(sessionCwd || process.cwd(), targetDir)
   await mkdir(outDir, { recursive: true })
   const filePath = path.join(outDir, name)
   await writeFile(filePath, bytes)

package/lib/security.js

@@ -1,8 +1,5 @@
-// lib/security.js
-// Secure credential handling, 0600 file permissions, and token masking (#169)
-// Address validation and trusted request guards against DNS rebinding & cross-site leaks (Refs: GitHub #1, #280, #276, #277)
-
-import { chmodSync, existsSync } from 'node:fs'
+import path from 'node:path'
+import { chmodSync, existsSync, realpathSync } from 'node:fs'
 
 /**
  * Masks sensitive API keys, leaving only the prefix/suffix.
@@ -233,4 +230,67 @@ export function isTrustedLocalRequest(req) {
   }
 
   return true
-}
+}
+
+/**
+ * Resolves candidatePath strictly inside baseDir.
+ * If candidatePath is absolute or contains '..', it must resolve inside baseDir.
+ * Both lexical containment check and realpath check (for baseDir and existing targets/ancestors)
+ * are performed to prevent symlink and lexical directory traversal attacks (#409, #410, #411, #412, #420).
+ *
+ * @param {string} baseDir Base directory (e.g. sessionCwd or workspace root)
+ * @param {string} candidatePath Relative or sub-path to resolve
+ * @returns {string} Absolute resolved path guaranteed to be contained within baseDir
+ * @throws {Error} if candidatePath escapes baseDir
+ */
+export function resolveInside(baseDir, candidatePath) {
+  const root = path.resolve(baseDir || '.')
+  const sub = candidatePath ? String(candidatePath).trim() : '.'
+  const resolved = path.resolve(root, sub)
+  const rel = path.relative(root, resolved)
+  if (rel.startsWith('..') || path.isAbsolute(rel)) {
+    throw new Error(`Path traversal denied: "${candidatePath}" escapes base directory "${root}"`)
+  }
+
+  let realRoot = root
+  try {
+    realRoot = realpathSync(root)
+  } catch (_err) {
+    // If baseDir does not exist yet on disk, lexical containment check above is sufficient
+    return resolved
+  }
+
+  try {
+    const realTarget = realpathSync(resolved)
+    const relReal = path.relative(realRoot, realTarget)
+    if (relReal.startsWith('..') || path.isAbsolute(relReal)) {
+      throw new Error(`Path traversal denied: "${candidatePath}" resolves via symlink outside "${realRoot}"`)
+    }
+  } catch (err) {
+    if (err?.code === 'ENOENT') {
+      let curr = path.dirname(resolved)
+      while (curr === root || curr.startsWith(root + path.sep)) {
+        try {
+          const realCurr = realpathSync(curr)
+          const relCurr = path.relative(realRoot, realCurr)
+          if (relCurr.startsWith('..') || path.isAbsolute(relCurr)) {
+            throw new Error(`Path traversal denied: ancestor in "${candidatePath}" resolves via symlink outside "${realRoot}"`)
+          }
+          break
+        } catch (ancestorErr) {
+          if (ancestorErr?.code === 'ENOENT') {
+            const parent = path.dirname(curr)
+            if (parent === curr) break
+            curr = parent
+            continue
+          }
+          throw ancestorErr
+        }
+      }
+    } else {
+      throw err
+    }
+  }
+
+  return resolved
+}

package/lib/tools/frontend.js

@@ -4,7 +4,7 @@ import { renderToolOutput } from "../attachment-helper.js"
 import path from 'node:path'
 import { defineTool } from '@deepseek-ai/dsh-tools'
 import { toLosslessJson } from '../providers.js'
-import { sanitizeErrorAndLogs } from '../security.js'
+import { sanitizeErrorAndLogs, resolveInside } from '../security.js'
 import {
   extractDesignTokens,
   generateCssGradient,
@@ -219,7 +219,7 @@ export function registerFrontendTools(ctx, deps) {
               }
             }
             const sessionCwd = exec?.agent?.session?.header?.cwd || process.cwd()
-            const outDir = path.resolve(sessionCwd, args.out_dir || '.')
+            const outDir = resolveInside(sessionCwd, args.out_dir || args.output_dir || '.')
 
             const res = await generatePwaIconSuite({
               name: args.name || 'App',

package/lib/tools/generation.js

@@ -1,4 +1,5 @@
 import { buildPresentationMeta } from '../attachment-helper.js'
+import { resolveInside } from '../security.js'
 import { registerGenerationPackTool } from './generation-pack.js'
 import { defineTool } from '@deepseek-ai/dsh-tools'
 import path from 'node:path'
@@ -496,7 +497,7 @@ export function registerGenerationTools(ctx, deps, options = {}) {
               const { attachment, localUrl } = await saveAttachmentSafe(ctx, { bytes: diskHit.bytes, mediaType: diskHit.mediaType, name })
               const sessionCwd = exec?.agent?.session?.header?.cwd
               const targetDir = (args.output_dir && String(args.output_dir).trim()) || cfg.outputDir || 'generated/images'
-              const outDir = path.resolve(sessionCwd || process.cwd(), targetDir)
+              const outDir = resolveInside(sessionCwd || process.cwd(), targetDir)
               await mkdir(outDir, { recursive: true })
               const filePath = path.join(outDir, name)
               await writeFile(filePath, diskHit.bytes)

package/lib/tools/processing-advanced.js

@@ -10,7 +10,7 @@ import {
   toLosslessJson,
   saveAttachmentSafe,
 } from '../providers.js'
-import { sanitizeErrorAndLogs } from '../security.js'
+import { sanitizeErrorAndLogs, resolveInside } from '../security.js'
 import { resolveConversationImage } from '../resolve-image.js'
 
 export function registerProcessingAdvancedTools(ctx, deps) {
@@ -408,7 +408,7 @@ export function registerProcessingAdvancedTools(ctx, deps) {
         async execute(args, exec) {
           try {
             const sessionCwd = exec?.agent?.session?.header?.cwd || process.cwd()
-            const targetDir = path.resolve(sessionCwd, args.output_dir || './assets/branding')
+            const targetDir = resolveInside(sessionCwd, args.output_dir || './assets/branding')
             await mkdir(targetDir, { recursive: true })
 
             const projectName = args.project_name || 'Project Brand'

package/lib/tools/responsive.js

@@ -13,7 +13,7 @@ import {
   PROVIDER_KEYS,
 } from '../providers.js'
 import { trackAndAssertLoopGuard } from '../loop-guard.js'
-import { sanitizeErrorAndLogs } from '../security.js'
+import { sanitizeErrorAndLogs, resolveInside } from '../security.js'
 import { buildDualOutputMarkdown } from '../resolve-image.js'
 import {
   buildResponsivePrompt,
@@ -119,7 +119,7 @@ export function registerResponsiveTools(ctx, deps) {
             const paletteColors = Array.isArray(args.palette_colors) ? args.palette_colors : undefined
             const sessionCwd = exec?.agent?.session?.header?.cwd
             const targetDir = (args.output_dir && String(args.output_dir).trim()) || cfg.outputDir || 'generated/images'
-            const outDir = path.resolve(sessionCwd || process.cwd(), targetDir)
+            const outDir = resolveInside(sessionCwd || process.cwd(), targetDir)
             await mkdir(outDir, { recursive: true })
 
             const pdeps = {

package/lib/vault.js

@@ -1,3 +1,5 @@
+import path from 'node:path'
+import os from 'node:os'
 import { existsSync, unlinkSync } from 'node:fs'
 import { readHistory, writeHistory, withHistoryLock } from './history.js'
 import { isTrustedLocalRequest } from './security.js'
@@ -131,7 +133,26 @@ export async function readBoundedRequestBody(req, maxBytes = MAX_VAULT_BODY_BYTE
   return Buffer.concat(chunks)
 }
 
-export async function deleteVaultEntry(id) {
+
+export function isPathContainedInRoots(targetPath, allowedRoots = []) {
+  if (!targetPath || typeof targetPath !== 'string') return false
+  const resolvedTarget = path.resolve(targetPath)
+  for (const root of allowedRoots) {
+    if (!root) continue
+    try {
+      const resolvedRoot = path.resolve(root)
+      const rel = path.relative(resolvedRoot, resolvedTarget)
+      if (!rel.startsWith('..') && !path.isAbsolute(rel)) {
+        return true
+      }
+    } catch (_err) {
+      /* ignore invalid root */
+    }
+  }
+  return false
+}
+
+export async function deleteVaultEntry(id, options = {}) {
   if (!id) return { success: false, error: 'Missing entry id' }
   return await withHistoryLock(async () => {
     const entries = await readHistory()
@@ -140,8 +161,17 @@ export async function deleteVaultEntry(id) {
       return { success: false, error: 'Vault entry not found' }
     }
 
+    const allowedRoots = options.allowedRoots || [
+      process.env.DSH_HOME || path.join(os.homedir(), '.dsh'),
+      process.cwd(),
+      os.tmpdir(),
+    ]
     const [entry] = entries.splice(idx, 1)
     if (entry && entry.path) {
+      if (!isPathContainedInRoots(entry.path, allowedRoots)) {
+        await writeHistory(entries)
+        return { success: false, id, error: `Refusing to delete file outside allowed roots: ${entry.path}` }
+      }
       try {
         unlinkSync(entry.path)
       } catch (_err) { /* ignore missing file */ }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@goodandready/dsh-image-gen",
-  "version": "0.11.33",
+  "version": "0.11.34",
   "description": "Image generation for DeepSeek Harness: a generate_image tool with pluggable providers — the FAL queue, any OpenAI-compatible images API, or a ChatGPT/Grok subscription with no API key at all. The picture is shown inline in the conversation; the model receives either a link (works with any chat model) or the image itself (needs dsh-vision-bridge or a vision-capable model).",
   "keywords": [
     "deepseek-harness",