@lunibee/builders 0.2.3 → 0.3.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lunibee/builders",
-  "version": "0.2.3",
+  "version": "0.3.0",
   "type": "module",
   "module": "./src/index.ts",
   "types": "./src/index.ts",
@@ -8,6 +8,6 @@
     ".": "./src/index.ts"
   },
   "dependencies": {
-    "@lunibee/types": "^0.2.3"
+    "@lunibee/types": "^0.3.0"
   }
 }

package/src/attachment.ts

@@ -1,10 +1,16 @@
-import { readFile } from "node:fs/promises";
-import { basename } from "node:path";
+import { readFile, realpath } from "node:fs/promises";
+import { basename, isAbsolute, relative, resolve } from "node:path";
 
 export interface AttachmentData {
     name: string;
     description?: string;
     file: Uint8Array | ArrayBuffer | Blob | Buffer | string;
+    /**
+     * Folder a string `file` must stay inside (symlinks included). Set it
+     * whenever the path is not one you wrote yourself, e.g. from a command
+     * option: without it, any readable file on the machine can be uploaded.
+     */
+    root?: string;
 }
 
 /** Builder for message attachments and file uploads. */
@@ -12,6 +18,8 @@ export class CreateAttachment {
     public name: string;
     public description?: string;
     public file: Uint8Array | ArrayBuffer | Blob | Buffer | string;
+    /** Folder a string `file` must stay inside; see {@link AttachmentData.root}. */
+    public root?: string;
 
     public constructor(
         file: Uint8Array | ArrayBuffer | Blob | Buffer | string,
@@ -25,6 +33,7 @@ export class CreateAttachment {
                 data?.name ??
                 (typeof file === "string" ? basename(file) : "file.bin");
             this.description = data?.description;
+            this.root = data?.root;
         }
     }
 
@@ -51,7 +60,11 @@ export class CreateAttachment {
     /** Resolves the attachment payload to a binary Uint8Array. */
     public async toBuffer(): Promise<Uint8Array> {
         if (typeof this.file === "string") {
-            const buffer = await readFile(this.file);
+            const path =
+                this.root === undefined
+                    ? this.file
+                    : await insideRoot(this.root, this.file);
+            const buffer = await readFile(path);
             return new Uint8Array(buffer);
         }
         if (this.file instanceof Uint8Array) return this.file;
@@ -69,11 +82,14 @@ export class CreateAttachment {
     }
 }
 
-// ─── Deprecated names (0.2.2), removed in 0.3.0 ────────────────────────────────
-// Builders are now `CreateX` (`ButtonBuilder` → `CreateButton`); `…Style` became
-// `…Type` and `…Type` became `…Enum`.
-
-/** @deprecated Use {@link CreateAttachment}. Removed in 0.3.0. */
-export const AttachmentBuilder = CreateAttachment;
-/** @deprecated Use {@link CreateAttachment}. Removed in 0.3.0. */
-export type AttachmentBuilder = CreateAttachment;
+/** Resolves `file` against `root`, refusing anything outside it (after following symlinks). */
+async function insideRoot(root: string, file: string): Promise<string> {
+    const base = await realpath(root);
+    const target = await realpath(resolve(base, file)).catch(() => {
+        throw new Error("Attachment file was not found inside its root.");
+    });
+    const rel = relative(base, target);
+    if (rel === "" || rel.startsWith("..") || isAbsolute(rel))
+        throw new Error("Attachment file is outside its root folder.");
+    return target;
+}