@lvce-editor/extension-host-helper-process 0.102.4 → 0.103.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lvce-editor/extension-host-helper-process",
-  "version": "0.102.4",
+  "version": "0.103.1",
   "description": "",
   "main": "index.js",
   "type": "module",

package/src/parts/LoadFile/LoadFile.js

@@ -1,12 +1,33 @@
+import { resolve, sep } from 'node:path'
 import * as Command from '@lvce-editor/command'
 import * as Assert from '../Assert/Assert.js'
 import * as ImportScript from '../ImportScript/ImportScript.js'
 import { VError } from '../VError/VError.js'
 
+export const resolveRemoteExtensionPath = (value, extensionsPath = process.env.LVCE_REMOTE_EXTENSIONS_PATH) => {
+  if (!extensionsPath) {
+    return value
+  }
+  const normalized = value.replaceAll('\\', '/')
+  const marker = '/extensions/'
+  const markerIndex = normalized.lastIndexOf(marker)
+  if (markerIndex === -1) {
+    return value
+  }
+  const relativePath = normalized.slice(markerIndex + marker.length)
+  const root = resolve(extensionsPath)
+  const resolved = resolve(root, relativePath)
+  if (resolved !== root && !resolved.startsWith(`${root}${sep}`)) {
+    throw new Error('Remote extension path escapes the built-in extensions directory')
+  }
+  return resolved
+}
+
 export const loadFile = async (path) => {
   try {
     Assert.string(path)
-    const module = await ImportScript.importScript(path)
+    const resolvedPath = resolveRemoteExtensionPath(path)
+    const module = await ImportScript.importScript(resolvedPath)
     if (module && module.commandMap) {
       const commandMap = module.commandMap
       Command.register(commandMap)