@mintlify/cli 4.0.906 → 4.0.907

package/__test__/init.test.ts

@@ -12,11 +12,16 @@ vi.mock('@mintlify/previewing', () => ({
   removeLastLog: vi.fn(),
 }));
 
-vi.mock('@mintlify/validation', () => ({
-  docsConfigSchema: {
-    options: [{ shape: { theme: { _def: { value: 'quill' } } } }],
-  },
-}));
+vi.mock('@mintlify/validation', async () => {
+  const original =
+    await vi.importActual<typeof import('@mintlify/validation')>('@mintlify/validation');
+  return {
+    ...original,
+    docsConfigSchema: {
+      options: [{ shape: { theme: { _def: { value: 'quill' } } } }],
+    },
+  };
+});
 
 vi.mock('fs-extra', () => ({
   default: {
@@ -48,19 +53,19 @@ describe('init', () => {
   describe('path traversal prevention', () => {
     it('rejects path traversal with ../', async () => {
       await expect(init('../outside', false, 'quill', 'Test')).rejects.toThrow(
-        'Access denied: path "../outside" is outside the current directory'
+        'Access denied: path: ../outside is outside the current directory'
       );
     });
 
     it('rejects deep path traversal', async () => {
       await expect(init('../../../etc', false, 'quill', 'Test')).rejects.toThrow(
-        'Access denied: path "../../../etc" is outside the current directory'
+        'Access denied: path: ../../../etc is outside the current directory'
       );
     });
 
     it('rejects absolute paths outside cwd', async () => {
       await expect(init('/etc/test', false, 'quill', 'Test')).rejects.toThrow(
-        'Access denied: path "/etc/test" is outside the current directory'
+        'Access denied: path: /etc/test is outside the current directory'
       );
     });
 

package/__test__/openApiCheck.test.ts

@@ -125,20 +125,3 @@ describe('openApiCheck', () => {
     expect(processExitMock).toHaveBeenCalledWith(1);
   });
 });
-
-describe('readLocalOpenApiFile', () => {
-  it('rejects path traversal attempts', async () => {
-    const { readLocalOpenApiFile } =
-      await vi.importActual<typeof import('../src/helpers.js')>('../src/helpers.js');
-
-    await expect(readLocalOpenApiFile('../etc/passwd')).rejects.toThrow(
-      'Access denied: invalid path'
-    );
-    await expect(readLocalOpenApiFile('/etc/passwd')).rejects.toThrow(
-      'Access denied: invalid path'
-    );
-    await expect(readLocalOpenApiFile('../../secret.yaml')).rejects.toThrow(
-      'Access denied: invalid path'
-    );
-  });
-});

package/__test__/pathValidation.test.ts

@@ -0,0 +1,25 @@
+import { describe, expect, it } from 'vitest';
+
+import { readLocalOpenApiFile } from '../src/helpers.js';
+
+describe('readLocalOpenApiFile', () => {
+  describe('path traversal prevention', () => {
+    it('rejects path traversal with ../', async () => {
+      await expect(readLocalOpenApiFile('../etc/passwd')).rejects.toThrow(
+        'path: ../etc/passwd is outside the current directory'
+      );
+    });
+
+    it('rejects absolute paths', async () => {
+      await expect(readLocalOpenApiFile('/etc/passwd')).rejects.toThrow(
+        'path: /etc/passwd is outside the current directory'
+      );
+    });
+
+    it('rejects deep path traversal', async () => {
+      await expect(readLocalOpenApiFile('../../secret.yaml')).rejects.toThrow(
+        'path: ../../secret.yaml is outside the current directory'
+      );
+    });
+  });
+});

package/bin/helpers.js

@@ -11,7 +11,7 @@ import { jsx as _jsx } from "react/jsx-runtime";
 import { getConfigPath } from '@mintlify/prebuild';
 import { MintConfigUpdater } from '@mintlify/prebuild';
 import { addLog, ErrorLog, getClientVersion, SuccessLog, InfoLog, SpinnerLog, removeLastLog, LOCAL_LINKED_CLI_VERSION, } from '@mintlify/previewing';
-import { upgradeToDocsConfig } from '@mintlify/validation';
+import { upgradeToDocsConfig, validatePathWithinCwd } from '@mintlify/validation';
 import detect from 'detect-port';
 import fse from 'fs-extra';
 import fs from 'fs/promises';
@@ -143,13 +143,7 @@ export const suppressConsoleWarnings = () => {
     };
 };
 export const readLocalOpenApiFile = (filename) => __awaiter(void 0, void 0, void 0, function* () {
-    const baseDir = process.cwd();
-    // const pathname = path.resolve(process.cwd(), filename);
-    const resolvedPath = path.resolve(baseDir, filename);
-    const relative = path.relative(baseDir, resolvedPath);
-    if (relative.startsWith('..') || path.isAbsolute(relative)) {
-        throw new Error('Access denied: invalid path');
-    }
+    const { resolvedPath } = validatePathWithinCwd(filename, CMD_EXEC_PATH);
     const file = yield fs.readFile(resolvedPath, 'utf-8');
     const document = yaml.load(file);
     return document;

package/bin/init.js

@@ -10,19 +10,10 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
 import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
 import { select, input } from '@inquirer/prompts';
 import { addLogs, addLog, SpinnerLog, removeLastLog } from '@mintlify/previewing';
-import { docsConfigSchema } from '@mintlify/validation';
+import { docsConfigSchema, validatePathWithinCwd } from '@mintlify/validation';
 import AdmZip from 'adm-zip';
 import fse from 'fs-extra';
 import { Box, Text } from 'ink';
-import path from 'path';
-const validatePathWithinCwd = (inputPath) => {
-    const baseDir = process.cwd();
-    const resolvedPath = path.resolve(baseDir, inputPath);
-    const relative = path.relative(baseDir, resolvedPath);
-    if (relative.startsWith(`..${path.sep}`) || relative === '..' || path.isAbsolute(relative)) {
-        throw new Error(`Access denied: path "${inputPath}" is outside the current directory`);
-    }
-};
 const sendOnboardingMessage = (installDir) => {
     addLogs(_jsx(Text, { bold: true, children: "Documentation Setup!" }), _jsx(Text, { children: "To see your docs run" }), _jsxs(Box, { children: [_jsx(Text, { color: "blue", children: "cd" }), _jsxs(Text, { children: [" ", installDir] })] }), _jsx(Text, { color: "blue", children: "mint dev" }));
 };
@@ -74,7 +65,7 @@ export function init(installDir, force, theme, name) {
                 }
                 installDir = installDir === '.' ? subdir : `${installDir}/${subdir}`;
                 // Re-validate after subdirectory is appended
-                validatePathWithinCwd(installDir);
+                validatePathWithinCwd(installDir, process.cwd());
             }
         }
         if (!isAI && (!selectedTheme || !projectName)) {