@nuasite/cms 0.18.0 → 0.19.0

package/src/utils.ts

@@ -143,11 +143,14 @@ export function escapeReplacement(str: string): string {
  */
 export function resolveAndValidatePath(filePath: string): string {
 	const projectRoot = getProjectRoot()
-	const fullPath = path.isAbsolute(filePath)
-		? path.resolve(filePath)
-		: path.resolve(projectRoot, filePath)
-
 	const resolvedRoot = path.resolve(projectRoot)
+	// Absolute filesystem paths (e.g. /Users/...) stay intact;
+	// project-relative paths with a leading slash (e.g. /src/content/...) get it stripped
+	const isAbsoluteFs = filePath.startsWith(resolvedRoot)
+	const normalizedPath = (!isAbsoluteFs && filePath.startsWith('/')) ? filePath.slice(1) : filePath
+	const fullPath = path.isAbsolute(normalizedPath) ? path.resolve(normalizedPath) : path.resolve(projectRoot, normalizedPath)
+
+	// Ensure the resolved path is within the project root
 	if (!fullPath.startsWith(resolvedRoot + path.sep) && fullPath !== resolvedRoot) {
 		throw new Error(`Path traversal detected: ${filePath}`)
 	}
@@ -184,3 +187,36 @@ export async function acquireFileLock(filePath: string): Promise<() => void> {
 		release()
 	}
 }
+
+export { slugify } from './shared'
+
+/**
+ * Type-safe check for Node.js system errors (ENOENT, EEXIST, etc.).
+ */
+export function isNodeError(error: unknown, code: string): boolean {
+	return error instanceof Error && 'code' in error && (error as NodeJS.ErrnoException).code === code
+}
+
+/**
+ * Escape HTML special characters to prevent injection.
+ * Covers &, <, >, ", and ' — the full set needed for both text content and attribute values.
+ */
+export function escapeHtml(text: string): string {
+	return text
+		.replace(/&/g, '&amp;')
+		.replace(/</g, '&lt;')
+		.replace(/>/g, '&gt;')
+		.replace(/"/g, '&quot;')
+		.replace(/'/g, '&#39;')
+}
+
+/**
+ * Compute a POSIX-style relative import path from one file to another.
+ * Ensures the result starts with `./' or `../` and uses forward slashes.
+ */
+export function relativeImportPath(fromFile: string, toFile: string): string {
+	const fromDir = path.dirname(fromFile)
+	let rel = path.relative(fromDir, toFile).split(path.sep).join('/')
+	if (!rel.startsWith('.')) rel = `./${rel}`
+	return rel
+}