@lwrjs/fs-asset-provider 0.24.0 → 0.24.1

package/build/cjs/index.cjs

@@ -72,13 +72,17 @@ var FsAssetProvider = class {
     const fullAssetPath = (0, import_shared_utils.normalizeAssetSpecifier)(assetId, this.assetPathMap, this.resourcePaths, this.basePath);
     return this.getAssetFromFSPath(fullAssetPath);
   }
+  isWithinConfiguredRoots(resolvedPath) {
+    const roots = [...this.assetPathMap.values(), ...Object.values(this.resourcePaths)].filter((root) => typeof root === "string" && root.length > 0).map((root) => (0, import_path.resolve)(root));
+    return roots.some((root) => resolvedPath === root || resolvedPath.startsWith(root + import_path.sep));
+  }
   async getAssetFromFSPath(assetPath) {
-    assetPath = (0, import_shared_utils.toForwardSlash)((0, import_path.normalize)(assetPath));
-    const fullAssetPath = decodeURI(assetPath);
+    const decodedAssetPath = decodeURI(assetPath);
+    const fullAssetPath = (0, import_shared_utils.toForwardSlash)((0, import_path.normalize)(decodedAssetPath));
     if (!this.cachedAssets.has(fullAssetPath)) {
       const [assetPath2] = fullAssetPath.split("?");
       const ext = (0, import_path.extname)(`x.${assetPath2}`).toLowerCase().substring(1);
-      if (ext && import_fs_extra.default.existsSync(assetPath2)) {
+      if (ext && import_fs_extra.default.existsSync(assetPath2) && this.isWithinConfiguredRoots((0, import_path.resolve)(assetPath2))) {
         const ownHash = hash(assetPath2);
         const mimeType = (0, import_shared_utils.mimeLookup)(assetPath2);
         const assetDef = {

package/build/es/index.d.ts

@@ -14,6 +14,12 @@ export default class FsAssetProvider implements AssetProvider {
      * Public API to get an AssetSource object from an asset identifier
      */
     getAsset(assetId: AssetIdentifier): Promise<AssetSource | undefined>;
+    /**
+     * True if the resolved path falls within one of the roots this provider is configured
+     * to serve from. Last line of defense against path traversal, independent of whatever
+     * validation (or lack thereof) happened upstream of this provider.
+     */
+    private isWithinConfiguredRoots;
     /**
      * Get and AssetSource object from a resolved filesystem file path.
      */

package/build/es/index.js

@@ -1,5 +1,5 @@
 import fs from 'fs-extra';
-import { extname, normalize } from 'path';
+import { extname, normalize, resolve, sep } from 'path';
 import { logger } from '@lwrjs/diagnostics';
 import { mimeLookup, normalizeAssetSpecifier, toForwardSlash } from '@lwrjs/shared-utils';
 function hash(filePath) {
@@ -45,17 +45,33 @@ export default class FsAssetProvider {
         const fullAssetPath = normalizeAssetSpecifier(assetId, this.assetPathMap, this.resourcePaths, this.basePath);
         return this.getAssetFromFSPath(fullAssetPath);
     }
+    /**
+     * True if the resolved path falls within one of the roots this provider is configured
+     * to serve from. Last line of defense against path traversal, independent of whatever
+     * validation (or lack thereof) happened upstream of this provider.
+     */
+    isWithinConfiguredRoots(resolvedPath) {
+        const roots = [...this.assetPathMap.values(), ...Object.values(this.resourcePaths)]
+            .filter((root) => typeof root === 'string' && root.length > 0)
+            .map((root) => resolve(root));
+        return roots.some((root) => resolvedPath === root || resolvedPath.startsWith(root + sep));
+    }
     /**
      * Get and AssetSource object from a resolved filesystem file path.
      */
     async getAssetFromFSPath(assetPath) {
-        assetPath = toForwardSlash(normalize(assetPath));
-        const fullAssetPath = decodeURI(assetPath); // decodeURIComponent decodes too many things (eg: /)
+        // Decode BEFORE normalizing: percent-encoded traversal segments (eg '%2e%2e%2f')
+        // must become literal '..' segments before normalize() can collapse them. Decoding
+        // after normalize (the previous order) let encoded traversal sequences pass through
+        // untouched.
+        // decodeURIComponent decodes too many things (eg: /), so use decodeURI here.
+        const decodedAssetPath = decodeURI(assetPath);
+        const fullAssetPath = toForwardSlash(normalize(decodedAssetPath));
         if (!this.cachedAssets.has(fullAssetPath)) {
             const [assetPath] = fullAssetPath.split('?'); // remove query params
             // Clever normalization to avoid corner cases
             const ext = extname(`x.${assetPath}`).toLowerCase().substring(1);
-            if (ext && fs.existsSync(assetPath)) {
+            if (ext && fs.existsSync(assetPath) && this.isWithinConfiguredRoots(resolve(assetPath))) {
                 const ownHash = hash(assetPath);
                 const mimeType = mimeLookup(assetPath);
                 const assetDef = {

package/package.json

@@ -4,7 +4,7 @@
     "publishConfig": {
         "access": "public"
     },
-    "version": "0.24.0",
+    "version": "0.24.1",
     "homepage": "https://developer.salesforce.com/docs/platform/lwr/overview",
     "repository": {
         "type": "git",
@@ -33,16 +33,16 @@
         "build": "tsc -b"
     },
     "dependencies": {
-        "@lwrjs/diagnostics": "0.24.0",
-        "@lwrjs/shared-utils": "0.24.0",
+        "@lwrjs/diagnostics": "0.24.1",
+        "@lwrjs/shared-utils": "0.24.1",
         "fs-extra": "^11.2.0"
     },
     "devDependencies": {
-        "@lwrjs/types": "0.24.0",
+        "@lwrjs/types": "0.24.1",
         "memfs": "^4.13.0"
     },
     "engines": {
         "node": ">=22.0.0"
     },
-    "gitHead": "6b7aace3739a07eae17d4220fd86ceb8a65f147a"
+    "gitHead": "ebc0aaa310f5ebd008732d0203a15a1c51f77e5e"
 }