@mantiq/vite 0.5.22 → 0.6.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
package/package.json
CHANGED
package/src/Vite.ts
CHANGED
|
@@ -421,6 +421,10 @@ export class Vite {
|
|
|
421
421
|
}
|
|
422
422
|
}
|
|
423
423
|
|
|
424
|
+
// Security note: `head` and `ssrHead` are trusted developer-controlled values.
|
|
425
|
+
// They contain raw HTML tags (meta, link, style) that must NOT be escaped.
|
|
426
|
+
// Developers are responsible for ensuring no user input is interpolated
|
|
427
|
+
// into head/ssrHead without proper escaping.
|
|
424
428
|
const headContent = [head, ssrHead].filter(Boolean).join('\n ')
|
|
425
429
|
|
|
426
430
|
return `<!DOCTYPE html>
|
|
@@ -1,4 +1,5 @@
|
|
|
1
1
|
import type { Middleware, NextFunction, MantiqRequest } from '@mantiq/core'
|
|
2
|
+
import path from 'node:path'
|
|
2
3
|
import { Vite } from '../Vite.ts'
|
|
3
4
|
|
|
4
5
|
/**
|
|
@@ -43,17 +44,19 @@ export class ServeStaticFiles implements Middleware {
|
|
|
43
44
|
|
|
44
45
|
const urlPath = request.path()
|
|
45
46
|
|
|
46
|
-
// Prevent directory traversal
|
|
47
|
-
if (urlPath.includes('..') || urlPath.includes('\0')) {
|
|
48
|
-
return next()
|
|
49
|
-
}
|
|
50
|
-
|
|
51
47
|
// Skip the hot file — it's internal
|
|
52
48
|
if (urlPath === '/hot') {
|
|
53
49
|
return next()
|
|
54
50
|
}
|
|
55
51
|
|
|
56
|
-
|
|
52
|
+
// Security: resolve the absolute path and verify it stays within publicDir
|
|
53
|
+
// to prevent directory traversal attacks (including encoded sequences like
|
|
54
|
+
// %2e%2e, double-encoding, and symlink tricks).
|
|
55
|
+
const publicDir = path.resolve(this.getPublicDir())
|
|
56
|
+
const filePath = path.resolve(publicDir, '.' + urlPath)
|
|
57
|
+
if (!filePath.startsWith(publicDir + path.sep) && filePath !== publicDir) {
|
|
58
|
+
return next()
|
|
59
|
+
}
|
|
57
60
|
const file = Bun.file(filePath)
|
|
58
61
|
|
|
59
62
|
if (await file.exists()) {
|