@jamesmddoyle/phantom 0.2.4 → 0.2.5

package/dist/dashboard-ui/_app/version.json

@@ -1 +1 @@
-{"version":"1793227677261"}
+{"version":"1793228583037"}

package/dist/dashboard-ui/index.html

@@ -22,16 +22,16 @@
     <div style="display: contents">
 			<script>
 				{
-					__sveltekit_1m83ubh = {
+					__sveltekit_15nbta3 = {
 						base: "/_dashboard",
-						version: "1793227677261",
+						version: "1793228583037",
 						assets: "/_dashboard"
 					};
 
 					const element = document.currentScript.parentElement;
 
 					import("/_dashboard/_app/immutable/entry/start.DRnrjJWJ.js").then(async (kit) => {
-						kit.init(__sveltekit_1m83ubh);
+						kit.init(__sveltekit_15nbta3);
 						const app = await import("/_dashboard/_app/immutable/entry/app.xWq8izru.js");
 						kit.start(app, element);
 					});

package/dist/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@jamesmddoyle/phantom",
-  "version": "0.2.4",
+  "version": "0.2.5",
   "description": "API mocker and traffic inspector with a built-in dashboard.",
   "author": "James Doyle",
   "license": "MIT",

package/dist/static.js

@@ -11,7 +11,29 @@ const MIME_TYPES = {
     ".json": "application/json",
 };
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
-export async function handleStaticFile(requestPath) {
+/** The published build first, then the repo build during development. */
+const DASHBOARD_FOLDERS = [path.join(__dirname, "dashboard-ui"), path.join(__dirname, "../dashboard/build")];
+/**
+ * Decodes a request path and joins it onto the folder.
+ * Returns null when the path can't be decoded or ends up outside the folder.
+ */
+function resolveInside(folder, requestPath) {
+    let decodedPath;
+    try {
+        decodedPath = decodeURIComponent(requestPath);
+    }
+    catch {
+        return null;
+    }
+    const filePath = path.join(folder, decodedPath);
+    const isInside = filePath === folder || filePath.startsWith(folder + path.sep);
+    return isInside ? filePath : null;
+}
+/**
+ * Finds the dashboard file for a request. Returns null when the request isn't for the dashboard,
+ * or when its path leaves the dashboard folder, so the request ends in a 404.
+ */
+export async function handleStaticFile(requestPath, folders = DASHBOARD_FOLDERS) {
     const isDashboardBase = requestPath.startsWith("/_dashboard");
     const isAppAsset = requestPath.startsWith("/_app");
     const isPhantomSVG = requestPath === "/phantom.svg";
@@ -23,9 +45,10 @@ export async function handleStaticFile(requestPath) {
     }
     if (cleanPath === "" || cleanPath === "/")
         cleanPath = "/index.html";
-    // check production path first, then development path
-    const paths = [path.join(__dirname, "dashboard-ui", cleanPath), path.join(__dirname, "../dashboard/build", cleanPath)];
-    for (const filePath of paths) {
+    for (const folder of folders) {
+        const filePath = resolveInside(folder, cleanPath);
+        if (!filePath)
+            return null;
         try {
             const content = await fs.readFile(filePath);
             const ext = path.extname(filePath);
@@ -41,10 +64,9 @@ export async function handleStaticFile(requestPath) {
         }
     }
     // SPA fallback for /_dashboard sub-routes
-    const fallbackPaths = [path.join(__dirname, "dashboard-ui", "index.html"), path.join(__dirname, "../dashboard/build", "index.html")];
-    for (const fallback of fallbackPaths) {
+    for (const folder of folders) {
         try {
-            const indexContent = await fs.readFile(fallback);
+            const indexContent = await fs.readFile(path.join(folder, "index.html"));
             return { body: indexContent, headers: { "Content-Type": "text/html" } };
         }
         catch {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@jamesmddoyle/phantom",
-  "version": "0.2.4",
+  "version": "0.2.5",
   "description": "API mocker and traffic inspector with a built-in dashboard.",
   "author": "James Doyle",
   "license": "MIT",