@hyperframes/studio-server 0.8.70 → 0.8.72

package/dist/index.js

@@ -302,8 +302,10 @@ import { bodyLimit } from "hono/body-limit";
 import {
   closeSync,
   existsSync as existsSync3,
+  lstatSync as lstatSync3,
   openSync,
   readFileSync as readFileSync5,
+  readlinkSync,
   writeFileSync as writeFileSync4,
   writeSync,
   mkdirSync as mkdirSync3,
@@ -1020,6 +1022,24 @@ function resolveGsapWriter(env) {
 async function loadGsapParser() {
   return import("@hyperframes/parsers/gsap-parser-recast");
 }
+function isDanglingSymlinkInProject(projectDir, lexicalPath) {
+  if (!isSafePath(projectDir, dirname3(lexicalPath))) return false;
+  let stats;
+  try {
+    stats = lstatSync3(lexicalPath);
+  } catch {
+    return false;
+  }
+  if (!stats.isSymbolicLink()) return false;
+  const target = resolve3(dirname3(lexicalPath), readlinkSync(lexicalPath));
+  if (!isSafePath(projectDir, target)) return false;
+  try {
+    statSync3(lexicalPath);
+    return false;
+  } catch {
+    return true;
+  }
+}
 async function resolveProjectPath(c, adapter, pathPrefix, opts) {
   const id = c.req.param("id");
   const project = await adapter.resolveProject(id);
@@ -1037,6 +1057,9 @@ async function resolveProjectPath(c, adapter, pathPrefix, opts) {
   }
   const absPath = resolveWithinProject(project.dir, filePath);
   if (!absPath) {
+    if (isDanglingSymlinkInProject(project.dir, resolve3(project.dir, filePath))) {
+      return { error: c.json({ error: "not found", why: "dangling_symlink" }, 404) };
+    }
     return { error: c.json({ error: "forbidden", why: "outside_project" }, 403) };
   }
   if (opts?.mustExist && !existsSync3(absPath)) {
@@ -2410,21 +2433,31 @@ function registerFileRoutes(api, adapter) {
   api.get("/projects/:id/files/*", async (c) => {
     const res = await resolveProjectFile(c, adapter);
     if ("error" in res) return res.error;
-    if (!existsSync3(res.absPath)) {
+    let fd;
+    try {
+      fd = openSync(res.absPath, "r");
+    } catch {
       if (c.req.query("optional") === "1") {
         return c.json({ filename: res.filePath, content: "", missing: true });
       }
       return c.json({ error: "not found" }, 404);
     }
-    const content = readFileSync5(res.absPath);
-    const version = fileContentVersion(content);
-    c.header("ETag", version);
-    return c.json({
-      filename: res.filePath,
-      content: content.toString("utf-8"),
-      version,
-      missing: false
-    });
+    try {
+      if (!fstatSync(fd).isFile()) {
+        return c.json({ error: "not found", why: "not_a_file" }, 404);
+      }
+      const content = readFileSync5(fd);
+      const version = fileContentVersion(content);
+      c.header("ETag", version);
+      return c.json({
+        filename: res.filePath,
+        content: content.toString("utf-8"),
+        version,
+        missing: false
+      });
+    } finally {
+      closeSync(fd);
+    }
   });
   api.put("/projects/:id/files/*", async (c) => {
     const res = await resolveProjectFile(c, adapter);