@ryanfw/prompt-orchestration-pipeline 1.3.1 → 1.3.2

package/src/ui/server/endpoints/upload-endpoints.ts

@@ -3,6 +3,9 @@ import path from "node:path";
 
 import { parseMultipartFormData, sendJson } from "../utils/http-utils";
 import { extractSeedZip } from "../zip-utils";
+import { createErrorResponse } from "../config-bridge";
+import { Constants } from "../config-bridge-node";
+import { resolveWithin } from "../utils/path-containment";
 
 export interface SeedUploadResult {
   seedObject: Record<string, unknown>;
@@ -40,10 +43,17 @@ export async function handleSeedUploadDirect(
   // current/{jobId}/files/artifacts/ during promotion.
   if (artifacts.length > 0) {
     const stagingJobDir = path.join(pipelineData, "staging", jobId);
+
+    for (const artifact of artifacts) {
+      if (resolveWithin(stagingJobDir, artifact.filename) === null) {
+        return sendJson(400, createErrorResponse(Constants.ERROR_CODES.BAD_REQUEST, `unsafe artifact path: ${artifact.filename}`));
+      }
+    }
+
     for (const artifact of artifacts) {
-      const artifactPath = path.join(stagingJobDir, artifact.filename);
-      await mkdir(path.dirname(artifactPath), { recursive: true });
-      await Bun.write(artifactPath, artifact.content);
+      const resolved = resolveWithin(stagingJobDir, artifact.filename)!;
+      await mkdir(path.dirname(resolved), { recursive: true });
+      await Bun.write(resolved, artifact.content);
     }
   }
 

package/src/ui/server/utils/http-utils.ts

@@ -10,6 +10,11 @@ function badRequest(message: string): Error {
   return new Error(message);
 }
 
+function normalizeContentType(contentType: string): string {
+  const mediaType = contentType.split(";", 1)[0]?.trim();
+  return mediaType || "application/octet-stream";
+}
+
 export function sendJson(statusCode: number, data: unknown): Response {
   return new Response(JSON.stringify(data), {
     status: statusCode,
@@ -57,7 +62,7 @@ export async function parseMultipartFormData(
       } else {
         files.push({
           filename: value.name,
-          contentType: value.type || "application/octet-stream",
+          contentType: normalizeContentType(value.type),
           content: new Uint8Array(await value.arrayBuffer()),
         });
       }

package/src/ui/server/utils/path-containment.ts

@@ -0,0 +1,18 @@
+import path from "node:path";
+
+/**
+ * Resolve a relative path under rootDir and return null when it escapes or
+ * resolves to rootDir itself.
+ * POSIX-oriented for Bun on macOS/Linux; revalidate Windows separators and
+ * case-insensitive filesystem behavior before reusing this on other boundaries.
+ */
+export function resolveWithin(rootDir: string, relativePath: unknown): string | null {
+  if (typeof relativePath !== "string" || relativePath.length === 0) return null;
+  if (relativePath.includes("\0")) return null;
+  if (path.isAbsolute(relativePath)) return null;
+  const root = path.resolve(rootDir);
+  const resolved = path.resolve(root, relativePath);
+  if (resolved === root) return null;
+  if (!resolved.startsWith(root + path.sep)) return null;
+  return resolved;
+}

package/src/ui/server/utils/status-corruption.ts

@@ -0,0 +1,27 @@
+import path from "node:path";
+
+import { createErrorResponse } from "../config-bridge";
+import { Constants } from "../config-bridge-node";
+import { getJobDirectoryPath } from "../../../config/paths";
+import { StatusCorruptError } from "../../../core/status-writer";
+import { sendJson } from "./http-utils";
+
+export async function assertStatusParseable(statusPath: string): Promise<void> {
+  try {
+    JSON.parse(await Bun.file(statusPath).text());
+  } catch (err: unknown) {
+    if ((err as NodeJS.ErrnoException).code === "ENOENT") return;
+    if (err instanceof SyntaxError) throw new StatusCorruptError(statusPath, { cause: err });
+    throw err;
+  }
+}
+
+export async function assertKnownJobStatusesParseable(dataDir: string, jobId: string): Promise<void> {
+  for (const location of ["current", "complete"] as const) {
+    await assertStatusParseable(path.join(getJobDirectoryPath(dataDir, jobId, location), "tasks-status.json"));
+  }
+}
+
+export function statusCorruptResponse(err: StatusCorruptError): Response {
+  return sendJson(409, createErrorResponse(Constants.ERROR_CODES.STATUS_CORRUPT, err.message, err.statusPath));
+}