@newrelic/preflight 1.4.12 → 1.4.13

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
@@ -1,14 +1,18 @@
1
1
  import { IncomingMessage, ServerResponse } from 'node:http';
2
2
  /**
3
- * True if `target` resolves to a path inside `root`. Checks the literal '/'
4
- * separator first kept so static analysis tools (CodeQL js/path-injection)
5
- * recognise this as the standard path-containment sanitizer pattern, since
6
- * CodeQL cannot statically prove that node:path's `sep` is '/'. The
7
- * `platformSep` check is required as a fallback because on Windows
8
- * resolve()/join() produce backslash-joined paths, which never match a
9
- * hardcoded '/'. Defaults to the real platform separator; overridable so
10
- * tests can exercise the Windows branch deterministically on any OS.
3
+ * True if `target` resolves to a path inside `root`. Both branches are
4
+ * literal string checks ('/' and '\\') and must stay that way — never
5
+ * replace either with a `path.sep`-derived value.
6
+ *
7
+ * Dropping the backslash branch breaks static asset serving on Windows,
8
+ * where resolve()/join() produce backslash-joined paths that a '/'-only
9
+ * check never matches. Making either branch non-literal (e.g. concatenating
10
+ * a runtime `sep` variable instead of a quoted character) breaks static
11
+ * analysis: CodeQL cannot statically prove that a runtime separator value
12
+ * equals '/', so it stops recognising this as the standard
13
+ * path-containment sanitizer pattern and flags the file reads below as
14
+ * path injection.
11
15
  */
12
- export declare function isWithinRoot(root: string, target: string, platformSep?: string): boolean;
16
+ export declare function isWithinRoot(root: string, target: string): boolean;
13
17
  export declare function createStaticHandler(rootDir: string): (req: IncomingMessage, res: ServerResponse) => Promise<void>;
14
18
  //# sourceMappingURL=static-handler.d.ts.map
@@ -1 +1 @@
1
- {"version":3,"file":"static-handler.d.ts","sourceRoot":"","sources":["../../../src/dashboard/routes/static-handler.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAuB5D;;;;;;;;;GASG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,GAAE,MAAY,GAAG,OAAO,CAE7F;AAqBD,wBAAgB,mBAAmB,CACjC,OAAO,EAAE,MAAM,GACd,CAAC,GAAG,EAAE,eAAe,EAAE,GAAG,EAAE,cAAc,KAAK,OAAO,CAAC,IAAI,CAAC,CA+E9D"}
1
+ {"version":3,"file":"static-handler.d.ts","sourceRoot":"","sources":["../../../src/dashboard/routes/static-handler.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAuB5D;;;;;;;;;;;;;GAaG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAElE;AAqBD,wBAAgB,mBAAmB,CACjC,OAAO,EAAE,MAAM,GACd,CAAC,GAAG,EAAE,eAAe,EAAE,GAAG,EAAE,cAAc,KAAK,OAAO,CAAC,IAAI,CAAC,CA+E9D"}
@@ -21,17 +21,21 @@ const MIME = {
21
21
  '.txt': 'text/plain; charset=utf-8',
22
22
  };
23
23
  /**
24
- * True if `target` resolves to a path inside `root`. Checks the literal '/'
25
- * separator first kept so static analysis tools (CodeQL js/path-injection)
26
- * recognise this as the standard path-containment sanitizer pattern, since
27
- * CodeQL cannot statically prove that node:path's `sep` is '/'. The
28
- * `platformSep` check is required as a fallback because on Windows
29
- * resolve()/join() produce backslash-joined paths, which never match a
30
- * hardcoded '/'. Defaults to the real platform separator; overridable so
31
- * tests can exercise the Windows branch deterministically on any OS.
24
+ * True if `target` resolves to a path inside `root`. Both branches are
25
+ * literal string checks ('/' and '\\') and must stay that way — never
26
+ * replace either with a `path.sep`-derived value.
27
+ *
28
+ * Dropping the backslash branch breaks static asset serving on Windows,
29
+ * where resolve()/join() produce backslash-joined paths that a '/'-only
30
+ * check never matches. Making either branch non-literal (e.g. concatenating
31
+ * a runtime `sep` variable instead of a quoted character) breaks static
32
+ * analysis: CodeQL cannot statically prove that a runtime separator value
33
+ * equals '/', so it stops recognising this as the standard
34
+ * path-containment sanitizer pattern and flags the file reads below as
35
+ * path injection.
32
36
  */
33
- export function isWithinRoot(root, target, platformSep = sep) {
34
- return target.startsWith(root + '/') || target.startsWith(root + platformSep);
37
+ export function isWithinRoot(root, target) {
38
+ return target.startsWith(root + '/') || target.startsWith(root + '\\');
35
39
  }
36
40
  async function serveIndexFallback(root, res) {
37
41
  try {
@@ -1 +1 @@
1
- {"version":3,"file":"static-handler.js","sourceRoot":"","sources":["../../../src/dashboard/routes/static-handler.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AAGxD,MAAM,IAAI,GAA2B;IACnC,OAAO,EAAE,0BAA0B;IACnC,KAAK,EAAE,uCAAuC;IAC9C,MAAM,EAAE,uCAAuC;IAC/C,MAAM,EAAE,yBAAyB;IACjC,OAAO,EAAE,iCAAiC;IAC1C,MAAM,EAAE,eAAe;IACvB,MAAM,EAAE,WAAW;IACnB,MAAM,EAAE,YAAY;IACpB,OAAO,EAAE,YAAY;IACrB,MAAM,EAAE,WAAW;IACnB,MAAM,EAAE,cAAc;IACtB,OAAO,EAAE,WAAW;IACpB,QAAQ,EAAE,YAAY;IACtB,MAAM,EAAE,iCAAiC;IACzC,OAAO,EAAE,kBAAkB;IAC3B,OAAO,EAAE,YAAY;IACrB,OAAO,EAAE,YAAY;IACrB,MAAM,EAAE,2BAA2B;CACpC,CAAC;AAEF;;;;;;;;;GASG;AACH,MAAM,UAAU,YAAY,CAAC,IAAY,EAAE,MAAc,EAAE,cAAsB,GAAG;IAClF,OAAO,MAAM,CAAC,UAAU,CAAC,IAAI,GAAG,GAAG,CAAC,IAAI,MAAM,CAAC,UAAU,CAAC,IAAI,GAAG,WAAW,CAAC,CAAC;AAChF,CAAC;AAED,KAAK,UAAU,kBAAkB,CAAC,IAAY,EAAE,GAAmB;IACjE,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;QAC3C,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,SAAS,CAAC,CAAC;QACvC,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE;YACjB,cAAc,EAAE,0BAA0B;YAC1C,gBAAgB,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC;YACrC,mEAAmE;YACnE,gEAAgE;YAChE,gBAAgB;YAChB,eAAe,EAAE,UAAU;SAC5B,CAAC,CAAC;QACH,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAChB,CAAC;IAAC,MAAM,CAAC;QACP,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QACnB,GAAG,CAAC,GAAG,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,MAAM,UAAU,mBAAmB,CACjC,OAAe;IAEf,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC9B,OAAO,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACxB,MAAM,GAAG,GAAG,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC;QAC3B,MAAM,OAAO,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC;QACzC,MAAM,QAAQ,GAAG,OAAO,KAAK,GAAG,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QAE9E,8EAA8E;QAC9E,6EAA6E;QAC7E,sEAAsE;QACtE,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,EAAE,CAAC;YAC3E,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;YACnB,GAAG,CAAC,GAAG,EAAE,CAAC;YACV,OAAO;QACT,CAAC;QAED,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC;QAC7C,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC;YAChC,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;YACnB,GAAG,CAAC,GAAG,EAAE,CAAC;YACV,OAAO;QACT,CAAC;QACD,MAAM,GAAG,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,CAAC;QAC1C,MAAM,gBAAgB,GAAG,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC;QAExC,4EAA4E;QAC5E,2EAA2E;QAC3E,uEAAuE;QACvE,IAAI,gBAAgB,IAAI,CAAC,CAAC,GAAG,IAAI,IAAI,CAAC,EAAE,CAAC;YACvC,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;YACnB,GAAG,CAAC,GAAG,EAAE,CAAC;YACV,OAAO;QACT,CAAC;QAED,IAAI,CAAC;YACH,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,CAAC;YAC9B,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC;gBACjB,wDAAwD;gBACxD,mEAAmE;gBACnE,+DAA+D;gBAC/D,gEAAgE;gBAChE,2BAA2B;gBAC3B,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;gBACnB,GAAG,CAAC,GAAG,EAAE,CAAC;gBACV,OAAO;YACT,CAAC;YACD,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,0BAA0B,CAAC;YACrD,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,CAAC;YACpC,0DAA0D;YAC1D,iEAAiE;YACjE,iEAAiE;YACjE,+DAA+D;YAC/D,gEAAgE;YAChE,iDAAiD;YACjD,sEAAsE;YACtE,4EAA4E;YAC5E,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YAC1C,MAAM,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,GAAG,GAAG,SAAS,GAAG,EAAE,CAAC,CAAC;YACvD,MAAM,WAAW,GAAG,QAAQ,KAAK,YAAY,CAAC;YAC9C,MAAM,YAAY,GAAG,WAAW;gBAC9B,CAAC,CAAC,UAAU;gBACZ,CAAC,CAAC,OAAO;oBACP,CAAC,CAAC,qCAAqC;oBACvC,CAAC,CAAC,qBAAqB,CAAC;YAC5B,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE;gBACjB,cAAc,EAAE,IAAI;gBACpB,gBAAgB,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC;gBACrC,eAAe,EAAE,YAAY;aAC9B,CAAC,CAAC;YACH,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAChB,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,gBAAgB,EAAE,CAAC;gBACrB,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;gBACnB,GAAG,CAAC,GAAG,EAAE,CAAC;gBACV,OAAO;YACT,CAAC;YACD,OAAO,MAAM,kBAAkB,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QAC7C,CAAC;IACH,CAAC,CAAC;AACJ,CAAC"}
1
+ {"version":3,"file":"static-handler.js","sourceRoot":"","sources":["../../../src/dashboard/routes/static-handler.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AAGxD,MAAM,IAAI,GAA2B;IACnC,OAAO,EAAE,0BAA0B;IACnC,KAAK,EAAE,uCAAuC;IAC9C,MAAM,EAAE,uCAAuC;IAC/C,MAAM,EAAE,yBAAyB;IACjC,OAAO,EAAE,iCAAiC;IAC1C,MAAM,EAAE,eAAe;IACvB,MAAM,EAAE,WAAW;IACnB,MAAM,EAAE,YAAY;IACpB,OAAO,EAAE,YAAY;IACrB,MAAM,EAAE,WAAW;IACnB,MAAM,EAAE,cAAc;IACtB,OAAO,EAAE,WAAW;IACpB,QAAQ,EAAE,YAAY;IACtB,MAAM,EAAE,iCAAiC;IACzC,OAAO,EAAE,kBAAkB;IAC3B,OAAO,EAAE,YAAY;IACrB,OAAO,EAAE,YAAY;IACrB,MAAM,EAAE,2BAA2B;CACpC,CAAC;AAEF;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,YAAY,CAAC,IAAY,EAAE,MAAc;IACvD,OAAO,MAAM,CAAC,UAAU,CAAC,IAAI,GAAG,GAAG,CAAC,IAAI,MAAM,CAAC,UAAU,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC;AACzE,CAAC;AAED,KAAK,UAAU,kBAAkB,CAAC,IAAY,EAAE,GAAmB;IACjE,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;QAC3C,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,SAAS,CAAC,CAAC;QACvC,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE;YACjB,cAAc,EAAE,0BAA0B;YAC1C,gBAAgB,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC;YACrC,mEAAmE;YACnE,gEAAgE;YAChE,gBAAgB;YAChB,eAAe,EAAE,UAAU;SAC5B,CAAC,CAAC;QACH,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAChB,CAAC;IAAC,MAAM,CAAC;QACP,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QACnB,GAAG,CAAC,GAAG,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,MAAM,UAAU,mBAAmB,CACjC,OAAe;IAEf,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC9B,OAAO,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACxB,MAAM,GAAG,GAAG,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC;QAC3B,MAAM,OAAO,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC;QACzC,MAAM,QAAQ,GAAG,OAAO,KAAK,GAAG,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QAE9E,8EAA8E;QAC9E,6EAA6E;QAC7E,sEAAsE;QACtE,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,EAAE,CAAC;YAC3E,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;YACnB,GAAG,CAAC,GAAG,EAAE,CAAC;YACV,OAAO;QACT,CAAC;QAED,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC;QAC7C,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC;YAChC,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;YACnB,GAAG,CAAC,GAAG,EAAE,CAAC;YACV,OAAO;QACT,CAAC;QACD,MAAM,GAAG,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,CAAC;QAC1C,MAAM,gBAAgB,GAAG,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC;QAExC,4EAA4E;QAC5E,2EAA2E;QAC3E,uEAAuE;QACvE,IAAI,gBAAgB,IAAI,CAAC,CAAC,GAAG,IAAI,IAAI,CAAC,EAAE,CAAC;YACvC,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;YACnB,GAAG,CAAC,GAAG,EAAE,CAAC;YACV,OAAO;QACT,CAAC;QAED,IAAI,CAAC;YACH,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,CAAC;YAC9B,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC;gBACjB,wDAAwD;gBACxD,mEAAmE;gBACnE,+DAA+D;gBAC/D,gEAAgE;gBAChE,2BAA2B;gBAC3B,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;gBACnB,GAAG,CAAC,GAAG,EAAE,CAAC;gBACV,OAAO;YACT,CAAC;YACD,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,0BAA0B,CAAC;YACrD,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,CAAC;YACpC,0DAA0D;YAC1D,iEAAiE;YACjE,iEAAiE;YACjE,+DAA+D;YAC/D,gEAAgE;YAChE,iDAAiD;YACjD,sEAAsE;YACtE,4EAA4E;YAC5E,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YAC1C,MAAM,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,GAAG,GAAG,SAAS,GAAG,EAAE,CAAC,CAAC;YACvD,MAAM,WAAW,GAAG,QAAQ,KAAK,YAAY,CAAC;YAC9C,MAAM,YAAY,GAAG,WAAW;gBAC9B,CAAC,CAAC,UAAU;gBACZ,CAAC,CAAC,OAAO;oBACP,CAAC,CAAC,qCAAqC;oBACvC,CAAC,CAAC,qBAAqB,CAAC;YAC5B,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE;gBACjB,cAAc,EAAE,IAAI;gBACpB,gBAAgB,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC;gBACrC,eAAe,EAAE,YAAY;aAC9B,CAAC,CAAC;YACH,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAChB,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,gBAAgB,EAAE,CAAC;gBACrB,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;gBACnB,GAAG,CAAC,GAAG,EAAE,CAAC;gBACV,OAAO;YACT,CAAC;YACD,OAAO,MAAM,kBAAkB,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QAC7C,CAAC;IACH,CAAC,CAAC;AACJ,CAAC"}
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@newrelic/preflight",
3
- "version": "1.4.12",
3
+ "version": "1.4.13",
4
4
  "type": "module",
5
5
  "license": "Apache-2.0",
6
6
  "private": false,