@pyreon/server 0.18.0 → 0.20.0

package/lib/analysis/index.js.html

@@ -5386,7 +5386,7 @@ var drawChart = (function (exports) {
   </script>
   <script>
     /*<!--*/
-    const data = {"version":2,"tree":{"name":"root","children":[{"name":"index.js","children":[{"name":"src","children":[{"uid":"22c74963-1","name":"html.ts"},{"uid":"22c74963-3","name":"middleware.ts"},{"uid":"22c74963-5","name":"handler.ts"},{"uid":"22c74963-7","name":"island.ts"},{"uid":"22c74963-9","name":"ssg.ts"},{"uid":"22c74963-11","name":"index.ts"}]}]}],"isRoot":true},"nodeParts":{"22c74963-1":{"renderedLength":2752,"gzipLength":1146,"brotliLength":0,"metaUid":"22c74963-0"},"22c74963-3":{"renderedLength":1738,"gzipLength":835,"brotliLength":0,"metaUid":"22c74963-2"},"22c74963-5":{"renderedLength":3356,"gzipLength":1446,"brotliLength":0,"metaUid":"22c74963-4"},"22c74963-7":{"renderedLength":2957,"gzipLength":1377,"brotliLength":0,"metaUid":"22c74963-6"},"22c74963-9":{"renderedLength":2806,"gzipLength":1214,"brotliLength":0,"metaUid":"22c74963-8"},"22c74963-11":{"renderedLength":0,"gzipLength":0,"brotliLength":0,"metaUid":"22c74963-10"}},"nodeMetas":{"22c74963-0":{"id":"/src/html.ts","moduleParts":{"index.js":"22c74963-1"},"imported":[{"uid":"22c74963-14"}],"importedBy":[{"uid":"22c74963-10"},{"uid":"22c74963-4"}]},"22c74963-2":{"id":"/src/middleware.ts","moduleParts":{"index.js":"22c74963-3"},"imported":[{"uid":"22c74963-12"}],"importedBy":[{"uid":"22c74963-10"},{"uid":"22c74963-4"}]},"22c74963-4":{"id":"/src/handler.ts","moduleParts":{"index.js":"22c74963-5"},"imported":[{"uid":"22c74963-12"},{"uid":"22c74963-13"},{"uid":"22c74963-14"},{"uid":"22c74963-15"},{"uid":"22c74963-0"},{"uid":"22c74963-2"}],"importedBy":[{"uid":"22c74963-10"}]},"22c74963-6":{"id":"/src/island.ts","moduleParts":{"index.js":"22c74963-7"},"imported":[{"uid":"22c74963-12"}],"importedBy":[{"uid":"22c74963-10"}]},"22c74963-8":{"id":"/src/ssg.ts","moduleParts":{"index.js":"22c74963-9"},"imported":[{"uid":"22c74963-16"},{"uid":"22c74963-17"}],"importedBy":[{"uid":"22c74963-10"}]},"22c74963-10":{"id":"/src/index.ts","moduleParts":{"index.js":"22c74963-11"},"imported":[{"uid":"22c74963-4"},{"uid":"22c74963-0"},{"uid":"22c74963-6"},{"uid":"22c74963-2"},{"uid":"22c74963-8"}],"importedBy":[],"isEntry":true},"22c74963-12":{"id":"@pyreon/core","moduleParts":{},"imported":[],"importedBy":[{"uid":"22c74963-4"},{"uid":"22c74963-6"},{"uid":"22c74963-2"}]},"22c74963-13":{"id":"@pyreon/head/ssr","moduleParts":{},"imported":[],"importedBy":[{"uid":"22c74963-4"}]},"22c74963-14":{"id":"@pyreon/router","moduleParts":{},"imported":[],"importedBy":[{"uid":"22c74963-4"},{"uid":"22c74963-0"}]},"22c74963-15":{"id":"@pyreon/runtime-server","moduleParts":{},"imported":[],"importedBy":[{"uid":"22c74963-4"}]},"22c74963-16":{"id":"node:fs/promises","moduleParts":{},"imported":[],"importedBy":[{"uid":"22c74963-8"}]},"22c74963-17":{"id":"node:path","moduleParts":{},"imported":[],"importedBy":[{"uid":"22c74963-8"}]}},"env":{"rollup":"4.23.0"},"options":{"gzip":true,"brotli":false,"sourcemap":false}};
+    const data = {"version":2,"tree":{"name":"root","children":[{"name":"index.js","children":[{"name":"src","children":[{"uid":"4deb8524-1","name":"html.ts"},{"uid":"4deb8524-3","name":"middleware.ts"},{"uid":"4deb8524-5","name":"handler.ts"},{"uid":"4deb8524-7","name":"island.ts"},{"uid":"4deb8524-9","name":"ssg.ts"},{"uid":"4deb8524-11","name":"index.ts"}]}]}],"isRoot":true},"nodeParts":{"4deb8524-1":{"renderedLength":2770,"gzipLength":1153,"brotliLength":0,"metaUid":"4deb8524-0"},"4deb8524-3":{"renderedLength":1738,"gzipLength":835,"brotliLength":0,"metaUid":"4deb8524-2"},"4deb8524-5":{"renderedLength":3356,"gzipLength":1446,"brotliLength":0,"metaUid":"4deb8524-4"},"4deb8524-7":{"renderedLength":2957,"gzipLength":1377,"brotliLength":0,"metaUid":"4deb8524-6"},"4deb8524-9":{"renderedLength":2881,"gzipLength":1235,"brotliLength":0,"metaUid":"4deb8524-8"},"4deb8524-11":{"renderedLength":0,"gzipLength":0,"brotliLength":0,"metaUid":"4deb8524-10"}},"nodeMetas":{"4deb8524-0":{"id":"/src/html.ts","moduleParts":{"index.js":"4deb8524-1"},"imported":[{"uid":"4deb8524-14"}],"importedBy":[{"uid":"4deb8524-10"},{"uid":"4deb8524-4"}]},"4deb8524-2":{"id":"/src/middleware.ts","moduleParts":{"index.js":"4deb8524-3"},"imported":[{"uid":"4deb8524-12"}],"importedBy":[{"uid":"4deb8524-10"},{"uid":"4deb8524-4"}]},"4deb8524-4":{"id":"/src/handler.ts","moduleParts":{"index.js":"4deb8524-5"},"imported":[{"uid":"4deb8524-12"},{"uid":"4deb8524-13"},{"uid":"4deb8524-14"},{"uid":"4deb8524-15"},{"uid":"4deb8524-0"},{"uid":"4deb8524-2"}],"importedBy":[{"uid":"4deb8524-10"}]},"4deb8524-6":{"id":"/src/island.ts","moduleParts":{"index.js":"4deb8524-7"},"imported":[{"uid":"4deb8524-12"}],"importedBy":[{"uid":"4deb8524-10"}]},"4deb8524-8":{"id":"/src/ssg.ts","moduleParts":{"index.js":"4deb8524-9"},"imported":[{"uid":"4deb8524-16"},{"uid":"4deb8524-17"}],"importedBy":[{"uid":"4deb8524-10"}]},"4deb8524-10":{"id":"/src/index.ts","moduleParts":{"index.js":"4deb8524-11"},"imported":[{"uid":"4deb8524-4"},{"uid":"4deb8524-0"},{"uid":"4deb8524-6"},{"uid":"4deb8524-2"},{"uid":"4deb8524-8"}],"importedBy":[],"isEntry":true},"4deb8524-12":{"id":"@pyreon/core","moduleParts":{},"imported":[],"importedBy":[{"uid":"4deb8524-4"},{"uid":"4deb8524-6"},{"uid":"4deb8524-2"}]},"4deb8524-13":{"id":"@pyreon/head/ssr","moduleParts":{},"imported":[],"importedBy":[{"uid":"4deb8524-4"}]},"4deb8524-14":{"id":"@pyreon/router","moduleParts":{},"imported":[],"importedBy":[{"uid":"4deb8524-4"},{"uid":"4deb8524-0"}]},"4deb8524-15":{"id":"@pyreon/runtime-server","moduleParts":{},"imported":[],"importedBy":[{"uid":"4deb8524-4"}]},"4deb8524-16":{"id":"node:fs/promises","moduleParts":{},"imported":[],"importedBy":[{"uid":"4deb8524-8"}]},"4deb8524-17":{"id":"node:path","moduleParts":{},"imported":[],"importedBy":[{"uid":"4deb8524-8"}]}},"env":{"rollup":"4.23.0"},"options":{"gzip":true,"brotli":false,"sourcemap":false}};
 
     const run = () => {
       const width = window.innerWidth;

package/lib/index.js

@@ -3,7 +3,7 @@ import { renderWithHead } from "@pyreon/head/ssr";
 import { RouterProvider, createRouter, getRedirectInfo, prefetchLoaderData, serializeLoaderData, stringifyLoaderData } from "@pyreon/router";
 import { renderToStream, runWithRequestContext } from "@pyreon/runtime-server";
 import { mkdir, writeFile } from "node:fs/promises";
-import { dirname, join, resolve } from "node:path";
+import { dirname, join, resolve, sep } from "node:path";
 
 //#region src/html.ts
 /**
@@ -44,7 +44,7 @@ function splitOnce(str, delimiter) {
 	return [str.slice(0, idx), str.slice(idx + delimiter.length)];
 }
 function processTemplate(template, data) {
-	return template.replace("<!--pyreon-head-->", data.head).replace("<!--pyreon-app-->", data.app).replace("<!--pyreon-scripts-->", data.scripts);
+	return template.replace("<!--pyreon-head-->", () => data.head).replace("<!--pyreon-app-->", () => data.app).replace("<!--pyreon-scripts-->", () => data.scripts);
 }
 /** Fast path using a pre-compiled template */
 function processCompiledTemplate(compiled, data) {
@@ -385,7 +385,8 @@ async function prerender(options) {
 		}
 		const filePath = resolveOutputPath(outDir, path);
 		const resolvedOut = resolve(outDir);
-		if (!resolve(filePath).startsWith(resolvedOut)) {
+		const resolvedFile = resolve(filePath);
+		if (resolvedFile !== resolvedOut && !resolvedFile.startsWith(resolvedOut + sep)) {
 			errors.push({
 				path,
 				error: /* @__PURE__ */ new Error(`Path traversal detected: "${path}"`)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pyreon/server",
-  "version": "0.18.0",
+  "version": "0.20.0",
   "description": "SSR handler, SSG prerender, and island architecture for Pyreon",
   "homepage": "https://github.com/pyreon/pyreon/tree/main/packages/server#readme",
   "bugs": {
@@ -49,12 +49,12 @@
     "prepublishOnly": "bun run build"
   },
   "dependencies": {
-    "@pyreon/core": "^0.18.0",
-    "@pyreon/head": "^0.18.0",
-    "@pyreon/reactivity": "^0.18.0",
-    "@pyreon/router": "^0.18.0",
-    "@pyreon/runtime-dom": "^0.18.0",
-    "@pyreon/runtime-server": "^0.18.0"
+    "@pyreon/core": "^0.20.0",
+    "@pyreon/head": "^0.20.0",
+    "@pyreon/reactivity": "^0.20.0",
+    "@pyreon/router": "^0.20.0",
+    "@pyreon/runtime-dom": "^0.20.0",
+    "@pyreon/runtime-server": "^0.20.0"
   },
   "devDependencies": {
     "@pyreon/manifest": "0.13.1",

package/src/html.ts

@@ -53,10 +53,18 @@ function splitOnce(str: string, delimiter: string): [string, string] {
 }
 
 export function processTemplate(template: string, data: TemplateData): string {
+  // Use FUNCTION replacements, not string replacements. With a string
+  // replacement, `String.prototype.replace` still interprets `$$`, `$&`,
+  // `` $` ``, `$'`, `$n` in the *replacement* even though the search is a
+  // literal string. `data.app` is rendered SSR HTML and routinely
+  // contains literal `$&` / `$$` (prices, code samples, math) — string
+  // replacement would corrupt them. A replacer function returns its
+  // value verbatim with zero `$`-pattern interpretation. Same
+  // first-occurrence semantics as before.
   return template
-    .replace('<!--pyreon-head-->', data.head)
-    .replace('<!--pyreon-app-->', data.app)
-    .replace('<!--pyreon-scripts-->', data.scripts)
+    .replace('<!--pyreon-head-->', () => data.head)
+    .replace('<!--pyreon-app-->', () => data.app)
+    .replace('<!--pyreon-scripts-->', () => data.scripts)
 }
 
 /** Fast path using a pre-compiled template */

package/src/ssg.ts

@@ -29,7 +29,7 @@
  */
 
 import { mkdir, writeFile } from 'node:fs/promises'
-import { dirname, join, resolve } from 'node:path'
+import { dirname, join, resolve, sep } from 'node:path'
 
 export interface PrerenderOptions {
   /** SSR handler created by createHandler() */
@@ -102,8 +102,17 @@ export async function prerender(options: PrerenderOptions): Promise<PrerenderRes
 
     const filePath = resolveOutputPath(outDir, path)
 
+    // Containment check must be separator-terminated. A bare
+    // `startsWith(resolve(outDir))` is a string-prefix test, not a
+    // path-containment test: with outDir `/app/dist`, a traversed
+    // `filePath` resolving to `/app/dist-secret/x` passes
+    // `'/app/dist-secret/x'.startsWith('/app/dist')` → true, and the
+    // build writes (possibly secret-bearing) HTML to a SIBLING dir
+    // outside the intended output root. `path` derives from caller-
+    // supplied route params (e.g. CMS slugs via getStaticPaths).
     const resolvedOut = resolve(outDir)
-    if (!resolve(filePath).startsWith(resolvedOut)) {
+    const resolvedFile = resolve(filePath)
+    if (resolvedFile !== resolvedOut && !resolvedFile.startsWith(resolvedOut + sep)) {
       errors.push({ path, error: new Error(`Path traversal detected: "${path}"`) })
       return
     }

package/src/tests/server.test.ts

@@ -32,6 +32,23 @@ describe('HTML template', () => {
     expect(result).not.toContain('<!--pyreon-scripts-->')
   })
 
+  test('processTemplate preserves literal $-sequences in rendered HTML (no regex-pattern corruption)', () => {
+    // Regression: `String.prototype.replace(str, str)` interprets `$$`,
+    // `$&`, `` $` ``, `$'`, `$n` in the REPLACEMENT even with a string
+    // search. Rendered SSR HTML routinely contains these (prices, code,
+    // math). Must round-trip verbatim.
+    const appHtml = 'Total: $$50 — match $& and back$`tick and $\' and $1 group'
+    const result = processTemplate(DEFAULT_TEMPLATE, {
+      head: 'price $& head',
+      app: appHtml,
+      scripts: '$$ scripts $\'',
+    })
+    expect(result).toContain(appHtml)
+    expect(result).toContain('price $& head')
+    expect(result).toContain("$$ scripts $'")
+    expect(result).not.toContain('<!--pyreon-app-->')
+  })
+
   test('buildScripts emits loader data + client entry', () => {
     const scripts = buildScripts('/entry.js', { users: [{ id: 1 }] })
     expect(scripts).toContain('window.__PYREON_LOADER_DATA__=')
@@ -757,6 +774,32 @@ describe('prerender', () => {
     await rm(tmpDir, { recursive: true, force: true })
   })
 
+  test('rejects a path that escapes outDir into a SIBLING dir (prefix-match bypass)', async () => {
+    // Regression: the guard was `resolve(filePath).startsWith(resolve(outDir))`
+    // — a string-prefix test. With outDir `/tmp/<base>`, a path resolving
+    // to the SIBLING `/tmp/<base>-evil/...` passes `startsWith` and the
+    // build writes HTML OUTSIDE the output root. `path` derives from
+    // caller route params (CMS slugs via getStaticPaths).
+    const App: ComponentFn = () => h('div', null, 'secret')
+    const handler = createHandler({ App, routes: [{ path: '/', component: App }] })
+    const stamp = Date.now()
+    const outDir = `/tmp/pyreon-ssgtrav-${stamp}`
+    const siblingEvil = `/tmp/pyreon-ssgtrav-${stamp}-evil`
+    const escapingPath = `/../pyreon-ssgtrav-${stamp}-evil`
+
+    const result = await prerender({ handler, paths: [escapingPath], outDir })
+
+    // The escaping path is rejected, recorded as an error, NOT written.
+    expect(result.pages).toBe(0)
+    expect(result.errors.some((e) => /Path traversal detected/.test(String(e.error)))).toBe(true)
+    const fs = await import('node:fs')
+    expect(fs.existsSync(`${siblingEvil}/index.html`)).toBe(false)
+
+    const { rm } = await import('node:fs/promises')
+    await rm(outDir, { recursive: true, force: true })
+    await rm(siblingEvil, { recursive: true, force: true })
+  })
+
   test('onPage callback can skip pages', async () => {
     const App: ComponentFn = () => h('div', null)
     const handler = createHandler({ App, routes: [{ path: '/', component: App }] })