@magicpixelart/cli 0.1.1 → 0.3.0

package/dist/util/security.js

@@ -0,0 +1,127 @@
+import { randomBytes } from 'node:crypto';
+import { isAbsolute, relative, resolve } from 'node:path';
+/** Max PNG payload per asset (64 MiB). */
+export const MAX_ASSET_BYTES = 64 * 1024 * 1024;
+const SHA256_RE = /^[a-f0-9]{64}$/i;
+/**
+ * Resolved path must stay under `rootDir` (prevents manifest-driven path traversal).
+ */
+export function assertPathInsideRoot(targetPath, rootDir, label) {
+    const root = resolve(rootDir);
+    const target = resolve(targetPath);
+    const rel = relative(root, target);
+    if (rel === '' || (!rel.startsWith('..') && !isAbsolute(rel)))
+        return;
+    throw new Error(`refusing to write outside ${label} (${relative(process.cwd(), root) || '.'}).\n` +
+        `  Fix: report unexpected folder/slug values to MagicPixel support.`);
+}
+/**
+ * Reject manifest folder/slug values that could escape via `..` or separators.
+ */
+export function assertSafeAssetSegments(folder, slug, key) {
+    const badSegment = (seg) => seg.length === 0 || seg === '.' || seg === '..' || /[\0\\]/.test(seg);
+    if (badSegment(slug)) {
+        throw new Error(`unsafe asset slug in manifest for key "${key}".`);
+    }
+    if (folder !== null) {
+        for (const seg of folder.split('/')) {
+            if (badSegment(seg)) {
+                throw new Error(`unsafe asset folder in manifest for key "${key}".`);
+            }
+        }
+    }
+}
+/**
+ * Custom endpoints must be HTTPS (unless MAGICPIXEL_ALLOW_INSECURE_ENDPOINT=1 for local http).
+ * Credentials embedded in the URL are rejected.
+ */
+export function validateEndpointUrl(raw) {
+    let url;
+    try {
+        url = new URL(raw);
+    }
+    catch {
+        throw new Error(`endpoint is not a valid URL: ${raw}\n` +
+            `  Fix: use https://… or remove "endpoint" from magicpixel.json.`);
+    }
+    if (url.username || url.password) {
+        throw new Error(`endpoint must not embed credentials in the URL.\n` +
+            `  Fix: use MAGICPIXEL_API_KEY for auth, not user:pass@host.`);
+    }
+    if (url.protocol === 'https:') {
+        return normalizeEndpointBase(url);
+    }
+    const allowInsecure = process.env.MAGICPIXEL_ALLOW_INSECURE_ENDPOINT === '1';
+    if (allowInsecure && url.protocol === 'http:' && (url.hostname === 'localhost' || url.hostname === '127.0.0.1')) {
+        return normalizeEndpointBase(url);
+    }
+    throw new Error(`endpoint must use HTTPS (${url.protocol}//${url.host}).\n` +
+        `  Fix: remove "endpoint" to use production, or for local http://localhost set ` +
+        `MAGICPIXEL_ALLOW_INSECURE_ENDPOINT=1.`);
+}
+function normalizeEndpointBase(url) {
+    // Drop query/hash; trim trailing slash on pathname (except root).
+    const path = url.pathname.replace(/\/+$/, '') || '';
+    return `${url.protocol}//${url.host}${path}`;
+}
+export function isSha256Hex(value) {
+    return SHA256_RE.test(value);
+}
+export function etagForSha256(sha256) {
+    if (!isSha256Hex(sha256)) {
+        throw new Error('internal: refusing to send If-None-Match for non-sha256 value');
+    }
+    return `"${sha256.toLowerCase()}"`;
+}
+export function tmpPathFor(diskPath) {
+    const suffix = randomBytes(8).toString('hex');
+    return `${diskPath}.${process.pid}.${suffix}.tmp`;
+}
+/**
+ * Follow redirects only within the same origin as the initial request (prevents API key leak).
+ */
+export async function safeFetch(url, init = {}) {
+    const origin = new URL(url).origin;
+    let current = url;
+    for (let hop = 0; hop < 5; hop++) {
+        const res = await fetch(current, { ...init, redirect: 'manual' });
+        if (res.status < 300 || res.status >= 400)
+            return res;
+        const location = res.headers.get('location');
+        await res.body?.cancel();
+        if (!location) {
+            throw new Error(`HTTP ${res.status} redirect without Location header.`);
+        }
+        const next = new URL(location, current);
+        if (next.origin !== origin) {
+            throw new Error(`refusing cross-origin redirect to ${next.origin}.\n` +
+                `  Fix: point "endpoint" directly at the integration API; do not use redirecting URLs.`);
+        }
+        current = next.href;
+    }
+    throw new Error('too many HTTP redirects (max 5).');
+}
+export async function readBodyWithLimit(res, maxBytes) {
+    const declared = res.headers.get('content-length');
+    if (declared) {
+        const n = Number(declared);
+        if (Number.isFinite(n) && n > maxBytes) {
+            await res.body?.cancel();
+            throw new Error(`response too large (${n} bytes, max ${maxBytes}).`);
+        }
+    }
+    const buf = new Uint8Array(await res.arrayBuffer());
+    if (buf.byteLength > maxBytes) {
+        throw new Error(`response too large (${buf.byteLength} bytes, max ${maxBytes}).`);
+    }
+    return buf;
+}
+const MAX_GLOB_LEN = 256;
+/** Validate a user-supplied picomatch glob from the CLI. */
+export function assertSafeGlob(glob) {
+    const g = glob.trim();
+    if (!g || g.length > MAX_GLOB_LEN || g.includes('\0')) {
+        throw new Error(`invalid glob pattern (empty, too long, or contains null bytes).`);
+    }
+    return g;
+}

package/package.json

@@ -1,10 +1,10 @@
 {
   "name": "@magicpixelart/cli",
-  "version": "0.1.1",
+  "version": "0.3.0",
   "description": "Sync MagicPixel pixel-art assets to your local project.",
   "type": "module",
   "bin": {
-    "magicpixel": "./dist/index.js"
+    "magicpixel": "dist/index.js"
   },
   "files": ["dist", "README.md", "LICENSE"],
   "scripts": {