@redocly/cli 0.0.0-snapshot.1782483365 → 0.0.0-snapshot.1782825774

package/lib/commands/split/__tests__/index.test.js

@@ -34,6 +34,33 @@ describe('#split', () => {
     and all related files are saved to the directory: ${(0, colorette_1.blue)(openapiDir)} \n`);
         expect(process.stderr.write.mock.calls[1][0]).toContain(`${filePath}: split processed in <test>ms`);
     });
+    it('aborts instead of writing a component file outside the output directory', async () => {
+        const filePath = 'packages/cli/src/commands/split/__tests__/fixtures/path-traversal.json';
+        jest.spyOn(process.stderr, 'write').mockImplementation(() => true);
+        await expect((0, index_1.handleSplit)({
+            argv: {
+                api: filePath,
+                outDir: openapiDir,
+                separator: '_',
+            },
+            config: (0, miscellaneous_1.loadConfigAndHandleErrors)(),
+            version: 'cli-version',
+        })).rejects.toThrow(utils.HandledError);
+        expect(utils.writeToFileByExtension).not.toHaveBeenCalled();
+    });
+    it('aborts instead of writing a path file outside the output directory', async () => {
+        const filePath = 'packages/cli/src/commands/split/__tests__/fixtures/path-traversal-paths.json';
+        jest.spyOn(process.stderr, 'write').mockImplementation(() => true);
+        await expect((0, index_1.handleSplit)({
+            argv: {
+                api: filePath,
+                outDir: openapiDir,
+                separator: '/',
+            },
+            config: (0, miscellaneous_1.loadConfigAndHandleErrors)(),
+            version: 'cli-version',
+        })).rejects.toThrow(utils.HandledError);
+    });
     it('should use the correct separator', async () => {
         const filePath = 'packages/cli/src/commands/split/__tests__/fixtures/spec.json';
         jest.spyOn(utils, 'pathToFilename').mockImplementation(() => 'newFilePath');

package/lib/commands/split/index.js

@@ -172,6 +172,13 @@ function extractFileNameFromPath(filename) {
 function getFileNamePath(componentDirPath, componentName, ext) {
     return path.join(componentDirPath, componentName) + `.${ext}`;
 }
+function assertWithinDir(baseDir, targetPath, subject) {
+    const base = path.resolve(baseDir);
+    const target = path.resolve(targetPath);
+    if (target !== base && !target.startsWith(base + path.sep)) {
+        (0, miscellaneous_1.exitWithError)(`Refusing to write "${subject}" outside the output directory.`);
+    }
+}
 function gatherComponentsFiles(components, componentsFiles, componentType, componentName, filename) {
     let inherits = [];
     if (componentType === types_1.OPENAPI3_COMPONENT.Schemas) {
@@ -191,6 +198,7 @@ function iteratePathItems(pathItems, openapiDir, outDir, componentsFiles, pathSe
         const pathData = pathItems[pathName];
         if ((0, openapi_core_1.isRef)(pathData))
             continue;
+        assertWithinDir(openapiDir, pathFile, pathName);
         for (const method of types_1.OPENAPI3_METHOD_NAMES) {
             const methodData = pathData[method];
             const methodDataXCode = methodData?.['x-code-samples'] || methodData?.['x-codeSamples'];
@@ -201,6 +209,7 @@ function iteratePathItems(pathItems, openapiDir, outDir, componentsFiles, pathSe
                 if (sample.source && sample.source.$ref)
                     continue;
                 const sampleFileName = path.join(openapiDir, 'code_samples', (0, miscellaneous_1.escapeLanguageName)(sample.lang), codeSamplesPathPrefix + (0, miscellaneous_1.pathToFilename)(pathName, pathSeparator), method + (0, miscellaneous_1.langToExt)(sample.lang));
+                assertWithinDir(openapiDir, sampleFileName, sample.lang);
                 fs.mkdirSync(path.dirname(sampleFileName), { recursive: true });
                 fs.writeFileSync(sampleFileName, sample.source);
                 // eslint-disable-next-line @typescript-eslint/ban-ts-comment
@@ -230,6 +239,7 @@ function iterateComponents(openapi, openapiDir, componentsFiles, ext) {
             const componentDirPath = path.join(componentsDir, componentType);
             for (const componentName of Object.keys(components?.[componentType] || {})) {
                 const filename = getFileNamePath(componentDirPath, componentName, ext);
+                assertWithinDir(openapiDir, filename, componentName);
                 gatherComponentsFiles(components, componentsFiles, componentType, componentName, filename);
             }
         }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@redocly/cli",
-  "version": "0.0.0-snapshot.1782483365",
+  "version": "0.0.0-snapshot.1782825774",
   "description": "",
   "license": "MIT",
   "bin": {
@@ -38,8 +38,8 @@
   ],
   "dependencies": {
     "@redocly/config": "0.22.0",
-    "@redocly/openapi-core": "0.0.0-snapshot.1782483365",
-    "@redocly/respect-core": "0.0.0-snapshot.1782483365",
+    "@redocly/openapi-core": "0.0.0-snapshot.1782825774",
+    "@redocly/respect-core": "0.0.0-snapshot.1782825774",
     "abort-controller": "3.0.0",
     "chokidar": "3.5.3",
     "colorette": "1.4.0",