@mryhryki/markdown-preview 0.8.3 → 0.8.5

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
package/package.json CHANGED
@@ -1,7 +1,7 @@
1
1
  {
2
2
  "name": "@mryhryki/markdown-preview",
3
3
  "description": "Markdown realtime preview on browser with your favorite editor",
4
- "version": "0.8.3",
4
+ "version": "0.8.5",
5
5
  "author": "mryhryki",
6
6
  "license": "MIT",
7
7
  "publishConfig": {
@@ -50,24 +50,24 @@
50
50
  "ws": "^8.18.0"
51
51
  },
52
52
  "devDependencies": {
53
- "@biomejs/biome": "1.9.2",
54
- "@types/express": "^4.17.21",
53
+ "@biomejs/biome": "1.9.4",
54
+ "@types/express": "^5.0.0",
55
55
  "@types/express-ws": "^3.0.5",
56
56
  "@types/jest": "^29.5.13",
57
57
  "@types/opener": "^1.4.3",
58
58
  "@types/serve-index": "^1.9.4",
59
- "emojilib": "^3.0.12",
60
- "esbuild": "^0.23.1",
61
- "github-markdown-css": "^5.6.1",
59
+ "emojilib": "^4.0.0",
60
+ "esbuild": "^0.24.0",
61
+ "github-markdown-css": "^5.7.0",
62
62
  "highlight.js": "^11.10.0",
63
63
  "jest": "^29.7.0",
64
- "marked": "^14.1.2",
64
+ "marked": "^14.1.3",
65
65
  "marked-emoji": "^1.4.2",
66
- "marked-highlight": "^2.1.4",
67
- "mermaid": "^11.2.1",
68
- "nodemon": "^3.1.6",
66
+ "marked-highlight": "^2.2.0",
67
+ "mermaid": "^11.3.0",
68
+ "nodemon": "^3.1.7",
69
69
  "ts-jest": "^29.2.5",
70
- "typescript": "^5.6.2"
70
+ "typescript": "^5.6.3"
71
71
  },
72
72
  "files": [
73
73
  "index.js",
package/src/index.js CHANGED
@@ -34,7 +34,7 @@ try {
34
34
  // @ts-ignore
35
35
  app.ws("/ws", (0, websocket_1.WebSocketHandler)(logger));
36
36
  for (const ext of params.extensions) {
37
- app.get(new RegExp(`^/.+\.${ext}$`), (0, markdown_1.MarkdownHandler)(params.template));
37
+ app.get(new RegExp(`^/.+\\.${ext}$`), (0, markdown_1.MarkdownHandler)(params.template));
38
38
  }
39
39
  app.use(express_1.default.static(directory_1.rootDir, { index: false }));
40
40
  app.use(express_1.default.static(directory_1.staticDir, { index: false }));
@@ -34,6 +34,11 @@ class FileWatcher {
34
34
  this._onFileChanged = callback;
35
35
  }
36
36
  addTargetFile(filepath) {
37
+ const absolutePath = node_path_1.default.resolve(directory_1.rootDir, filepath);
38
+ if (!absolutePath.startsWith(directory_1.rootDir)) {
39
+ this.logger.error("Invalid file path:", filepath);
40
+ return;
41
+ }
37
42
  if (this._target[filepath] != null)
38
43
  return;
39
44
  this.logger.debug("Add watch target:", filepath);
@@ -48,10 +53,17 @@ class FileWatcher {
48
53
  delete this._target[filepath];
49
54
  }
50
55
  getFileLastModified(filepath) {
51
- return node_fs_1.default.statSync(node_path_1.default.resolve(directory_1.rootDir, filepath)).mtimeMs;
56
+ const targetFilePath = node_path_1.default.resolve(directory_1.rootDir, filepath);
57
+ if (!targetFilePath.startsWith(directory_1.rootDir)) {
58
+ throw new Error(`Invalid file path: ${filepath}`);
59
+ }
60
+ return node_fs_1.default.statSync(targetFilePath).mtimeMs;
52
61
  }
53
62
  getFileInfo(filepath) {
54
63
  const absolutePath = node_path_1.default.resolve(directory_1.rootDir, filepath);
64
+ if (!absolutePath.startsWith(directory_1.rootDir)) {
65
+ throw new Error(`Invalid file path: ${filepath}`);
66
+ }
55
67
  const markdown = node_fs_1.default.readFileSync(absolutePath, "utf-8");
56
68
  return { filepath, markdown };
57
69
  }
package/src/markdown.js CHANGED
@@ -20,6 +20,10 @@ const file_1 = require("./lib/file");
20
20
  function MarkdownHandler(template) {
21
21
  return (req, res, next) => __awaiter(this, void 0, void 0, function* () {
22
22
  const filepath = node_path_1.default.resolve(directory_1.rootDir, decodeURIComponent(req.path.substring(1)));
23
+ if (!filepath.startsWith(directory_1.rootDir)) {
24
+ res.status(403).end();
25
+ return;
26
+ }
23
27
  if ((0, file_1.existsFile)(filepath)) {
24
28
  const templateContent = yield promises_1.default.readFile(template, "utf-8");
25
29
  res.status(200).send(templateContent);