@slidev/cli 52.15.1 → 52.15.2

package/dist/{build-yk6Ejluk.mjs → build-BZYW8gn1.mjs}

@@ -1,5 +1,5 @@
-import "./resolver-XedCEhxI.mjs";
-import { t as resolveViteConfigs } from "./shared-ClfjhvJo.mjs";
+import "./resolver-BhqywfGz.mjs";
+import { t as resolveViteConfigs } from "./shared-CmTSrQGO.mjs";
 import { join, resolve } from "node:path";
 import { build as build$1 } from "vite";
 import { existsSync } from "node:fs";
@@ -53,7 +53,7 @@ async function build(options, viteConfig = {}, args) {
 				dev: true
 			}));
 			server.listen(port);
-			const { exportSlides } = await import("./export-DA_9kPXd.mjs");
+			const { exportSlides } = await import("./export-C2XL3OpJ.mjs");
 			const tempDir = resolve(outDir, "temp");
 			await fs$1.mkdir(tempDir, { recursive: true });
 			await exportSlides({
@@ -94,7 +94,7 @@ async function build(options, viteConfig = {}, args) {
 		"true",
 		"auto"
 	].includes(options.data.config.download)) {
-		const { exportSlides, getExportOptions } = await import("./export-DA_9kPXd.mjs");
+		const { exportSlides, getExportOptions } = await import("./export-C2XL3OpJ.mjs");
 		const port = 12445;
 		const app = connect();
 		const server = http.createServer(app);

package/dist/cli.mjs

@@ -1,6 +1,6 @@
-import { i as resolveEntry, n as getRoots, r as isInstalledGlobally } from "./resolver-XedCEhxI.mjs";
-import { a as parser, c as resolveAddons, d as updateFrontmatterPatch, i as resolveOptions, l as version, o as getThemeMeta, s as resolveTheme, u as loadSetups } from "./shared-ClfjhvJo.mjs";
-import { t as createServer } from "./serve-CYSWeFFN.mjs";
+import { i as resolveEntry, n as getRoots, r as isInstalledGlobally } from "./resolver-BhqywfGz.mjs";
+import { a as parser, c as resolveAddons, d as updateFrontmatterPatch, i as resolveOptions, l as version, o as getThemeMeta, s as resolveTheme, u as loadSetups } from "./shared-CmTSrQGO.mjs";
+import { t as createServer } from "./serve-CLoYUI-M.mjs";
 import path from "node:path";
 import process from "node:process";
 import fs from "node:fs/promises";
@@ -294,7 +294,7 @@ cli.command("build [entry..]", "Build hostable SPA", (args) => exportOptions(com
 	describe: "enable the inspect plugin for debugging"
 }).strict().help(), async (args) => {
 	const { entry, theme, base, download, out, inspect, "without-notes": withoutNotes, "router-mode": routerMode } = args;
-	const { build } = await import("./build-yk6Ejluk.mjs");
+	const { build } = await import("./build-BZYW8gn1.mjs");
 	for (const entryFile of entry) {
 		const options = await resolveOptions({
 			entry: entryFile,
@@ -359,7 +359,7 @@ cli.command("theme [subcommand]", "Theme related operations", (command) => {
 });
 cli.command("export [entry..]", "Export slides to PDF", (args) => exportOptions(commonOptions(args)).strict().help(), async (args) => {
 	const { entry, theme } = args;
-	const { exportSlides, getExportOptions } = await import("./export-DA_9kPXd.mjs");
+	const { exportSlides, getExportOptions } = await import("./export-C2XL3OpJ.mjs");
 	const candidatePort = await getPort(12445);
 	let warned = false;
 	for (const entryFile of entry) {
@@ -411,7 +411,7 @@ cli.command("export-notes [entry..]", "Export slide notes to PDF", (args) => arg
 	type: "number",
 	describe: "wait for the specified ms before exporting"
 }).strict().help(), async ({ entry, output, timeout, wait }) => {
-	const { exportNotes } = await import("./export-DA_9kPXd.mjs");
+	const { exportNotes } = await import("./export-C2XL3OpJ.mjs");
 	const candidatePort = await getPort(12445);
 	for (const entryFile of entry) {
 		const options = await resolveOptions({ entry: entryFile }, "export");

package/dist/{export-DA_9kPXd.mjs → export-C2XL3OpJ.mjs}

@@ -1,4 +1,4 @@
-import { n as getRoots } from "./resolver-XedCEhxI.mjs";
+import { n as getRoots } from "./resolver-BhqywfGz.mjs";
 import path, { dirname, relative } from "node:path";
 import process from "node:process";
 import fs from "node:fs/promises";
@@ -304,9 +304,9 @@ async function exportSlides({ port = 18724, total = 0, range: range$1, format =
 		if (!output.endsWith(".pdf")) output = `${output}.pdf`;
 		return perSlide ? genPagePdfPerSlide() : genPagePdfOnePiece();
 	}
-	async function genPagePng(writeToDisk) {
+	async function genPagePng(writeToDisk, cleanOutput = true) {
 		if (writeToDisk) {
-			await fs.rm(writeToDisk, {
+			if (cleanOutput) await fs.rm(writeToDisk, {
 				force: true,
 				recursive: true
 			});
@@ -315,7 +315,7 @@ async function exportSlides({ port = 18724, total = 0, range: range$1, format =
 		return perSlide ? genPagePngPerSlide(writeToDisk) : genPagePngOnePiece(writeToDisk);
 	}
 	async function genPageMd() {
-		const pngs = await genPagePng(dirname(output));
+		const pngs = await genPagePng(dirname(output), false);
 		const content = slides.filter(({ index }) => pages.includes(index + 1)).map(({ title, index, note }) => pngs.filter(({ slideIndex }) => slideIndex === index).map(({ filename }) => `![${title || index + 1}](./${filename})\n\n`).join("") + (note ? `${note.trim()}\n\n` : "")).join("---\n\n");
 		await fs.writeFile(ensureSuffix(".md", output), content);
 	}

package/dist/index.mjs

@@ -1,5 +1,5 @@
-import "./resolver-XedCEhxI.mjs";
-import { a as parser, i as resolveOptions, n as ViteSlidevPlugin, r as createDataUtils } from "./shared-ClfjhvJo.mjs";
-import { t as createServer } from "./serve-CYSWeFFN.mjs";
+import "./resolver-BhqywfGz.mjs";
+import { a as parser, i as resolveOptions, n as ViteSlidevPlugin, r as createDataUtils } from "./shared-CmTSrQGO.mjs";
+import { t as createServer } from "./serve-CLoYUI-M.mjs";
 
 export { ViteSlidevPlugin, createDataUtils, createServer, parser, resolveOptions };

package/dist/{resolver-XedCEhxI.mjs → resolver-BhqywfGz.mjs}

@@ -14,6 +14,7 @@ import { findClosestPkgJsonPath, findDepPkgJsonPath } from "vitefu";
 
 //#region node/resolver.ts
 const RE_PATH_SEPARATOR = /[/\\]/;
+const RE_SAFE_PKG_NAME = /^(?:@[a-z0-9-~][a-z0-9-._~]*\/)?[a-z0-9-~][a-z0-9-._~]*$/;
 const cliRoot = fileURLToPath(new URL("..", import.meta.url));
 const isInstalledGlobally = {};
 /**
@@ -93,6 +94,7 @@ function createResolver(type, officials) {
 		if (name[0] === "/") return [name, name];
 		if (name.startsWith("@/")) return [name, resolve(userRoot, name.slice(2))];
 		if (name[0] === "." || name[0] !== "@" && name.includes("/")) return [name, resolve(dirname(importer), name)];
+		if (!RE_SAFE_PKG_NAME.test(name)) throw new Error(`Invalid ${type} name "${name}". Only valid npm package names are allowed.`);
 		{
 			const possiblePkgNames = [name];
 			if (!name.includes("/") && !name.startsWith("@")) possiblePkgNames.unshift(`@slidev/${type}-${name}`, `slidev-${type}-${name}`);

package/dist/{serve-CYSWeFFN.mjs → serve-CLoYUI-M.mjs}

@@ -1,4 +1,4 @@
-import { t as resolveViteConfigs } from "./shared-ClfjhvJo.mjs";
+import { t as resolveViteConfigs } from "./shared-CmTSrQGO.mjs";
 import { join } from "node:path";
 import process from "node:process";
 import { createServer } from "vite";

package/dist/{shared-ClfjhvJo.mjs → shared-CmTSrQGO.mjs}

@@ -1,9 +1,9 @@
-import { a as resolveImportPath, c as toAtFS, i as resolveEntry, n as getRoots, o as resolveImportUrl, r as isInstalledGlobally, s as resolveSourceFiles, t as createResolver } from "./resolver-XedCEhxI.mjs";
+import { a as resolveImportPath, c as toAtFS, i as resolveEntry, n as getRoots, o as resolveImportUrl, r as isInstalledGlobally, s as resolveSourceFiles, t as createResolver } from "./resolver-BhqywfGz.mjs";
 import { builtinModules } from "node:module";
 import path, { basename, dirname, join, relative, resolve, win32 } from "node:path";
-import { loadConfigFromFile, mergeConfig } from "vite";
+import { loadConfigFromFile, mergeConfig, parseSync } from "vite";
 import MarkdownExit from "markdown-exit";
-import fs, { existsSync } from "node:fs";
+import fs, { existsSync, realpathSync } from "node:fs";
 import fs$1, { readFile } from "node:fs/promises";
 import { fileURLToPath, pathToFileURL } from "node:url";
 import { ensureSuffix, isString, isTruthy, notNullish, objectEntries, objectMap, range, slash, uniq } from "@antfu/utils";
@@ -473,6 +473,158 @@ function createIconsPlugin(options, pluginOptions) {
 	});
 }
 
+//#endregion
+//#region node/virtual/deprecated.ts
+/**
+* Kept for backward compatibility, use #slidev/slides instead
+*
+* @deprecated
+*/
+const templateLegacyRoutes = {
+	id: "/@slidev/routes",
+	getContent() {
+		return [`export { slides } from '#slidev/slides'`, `console.warn('[slidev] #slidev/routes is deprecated, use #slidev/slides instead')`].join("\n");
+	}
+};
+/**
+* Kept for backward compatibility, use #slidev/title-renderer instead
+*
+* @deprecated
+*/
+const templateLegacyTitles = {
+	id: "/@slidev/titles.md",
+	getContent() {
+		return `
+<script setup lang="ts">
+import TitleRenderer from '#slidev/title-renderer'
+defineProps<{ no: number | string }>()
+console.warn('/@slidev/titles.md is deprecated, import from #slidev/title-renderer instead')
+<\/script>
+
+<TitleRenderer :no="no" />
+`;
+	}
+};
+
+//#endregion
+//#region node/virtual/titles.ts
+const templateTitleRendererMd = {
+	id: "/@slidev/title-renderer.md",
+	getContent({ data }) {
+		const lines = data.slides.map(({ title }, i) => `<template ${i === 0 ? "v-if" : "v-else-if"}="no === ${i + 1}">\n\n${title}\n\n</template>`);
+		lines.push(`<script setup lang="ts">`, `import { useSlideContext } from '@slidev/client/context.ts'`, `import { computed } from 'vue'`, `const props = defineProps<{ no?: number | string }>()`, `const { $page } = useSlideContext()`, `const no = computed(() => +(props.no ?? $page.value))`, `<\/script>`);
+		return lines.join("\n");
+	}
+};
+const templateTitleRenderer = {
+	id: "/@slidev/title-renderer",
+	async getContent() {
+		return "export { default } from \"/@slidev/title-renderer.md\"";
+	}
+};
+
+//#endregion
+//#region node/vite/importGuard.ts
+const virtualSlideMarkdownIds = new Set([templateTitleRendererMd.id, templateLegacyTitles.id]);
+function createSlideImportGuardPlugin() {
+	let config;
+	let allowRoots = [];
+	return {
+		name: "slidev:slide-import-guard",
+		configResolved(resolved) {
+			config = resolved;
+			allowRoots = config.server.fs.allow.map(normalizeFsPath);
+		},
+		async transform(code, id$2) {
+			if (!isSlideMarkdownId(id$2) || !config?.server.fs.strict) return null;
+			const importer = filePathFromId(id$2) ?? id$2;
+			await Promise.all(extractImportSources(code, id$2).map(async ({ value, start }) => {
+				const resolved = await this.resolve(value, importer, { skipSelf: true });
+				if (!resolved || resolved.external) return;
+				const filePath = filePathFromId(resolved.id);
+				if (!filePath) return;
+				const normalized = normalizeFsPath(filePath);
+				if (isAllowedFile(normalized, allowRoots)) return;
+				if (isBareImport(value) && isDependencyFile(normalized)) return;
+				this.error(`[slidev] Import "${value}" from slide Markdown resolves outside of Vite server.fs.allow: ${normalized}`, start);
+			}));
+			return null;
+		}
+	};
+}
+function isSlideMarkdownId(id$2) {
+	const clean = cleanUrl$1(id$2);
+	return regexSlideSourceId.test(clean) || virtualSlideMarkdownIds.has(clean);
+}
+function filePathFromId(id$2) {
+	const clean = cleanUrl$1(id$2);
+	if (clean.startsWith("file://")) return fileURLToPath(clean);
+	if (clean.startsWith("/@fs/")) return clean.slice(4);
+	if (clean.startsWith("/@")) return null;
+	if (path.isAbsolute(clean)) return clean;
+	return null;
+}
+function isAllowedFile(filePath, allowRoots) {
+	return allowRoots.some((root) => isFileInRoot(root, filePath));
+}
+function extractImportSources(code, id$2) {
+	const result = parseSync(id$2, code);
+	const sources = [];
+	for (const item of result.module.staticImports) sources.push({
+		value: item.moduleRequest.value,
+		start: item.moduleRequest.start
+	});
+	for (const item of result.module.staticExports) for (const entry of item.entries) if (entry.moduleRequest) sources.push({
+		value: entry.moduleRequest.value,
+		start: entry.moduleRequest.start
+	});
+	for (const item of result.module.dynamicImports) {
+		const source = parseStringLiteral(code.slice(item.moduleRequest.start, item.moduleRequest.end));
+		if (source) sources.push({
+			value: source,
+			start: item.moduleRequest.start
+		});
+	}
+	return sources;
+}
+function cleanUrl$1(id$2) {
+	return id$2.replace(/[?#].*$/, "");
+}
+function normalizeFsPath(filePath) {
+	const absolute = path.resolve(filePath);
+	if (!existsSync(absolute)) return normalizeMissingFsPath(absolute);
+	return realpathSync.native(absolute);
+}
+function normalizeMissingFsPath(filePath) {
+	const dir = path.dirname(filePath);
+	if (dir === filePath) return filePath;
+	if (existsSync(dir)) return path.join(realpathSync.native(dir), path.basename(filePath));
+	return path.join(normalizeMissingFsPath(dir), path.basename(filePath));
+}
+function isFileInRoot(root, filePath) {
+	const relative$1 = path.relative(root, filePath);
+	return relative$1 === "" || !!relative$1 && !relative$1.startsWith("..") && !path.isAbsolute(relative$1);
+}
+function isDependencyFile(filePath) {
+	return filePath.split(/[\\/]/).includes("node_modules");
+}
+function isBareImport(source) {
+	return /^(?![a-z]:)[\w@](?!.*:\/\/)/i.test(source);
+}
+function parseStringLiteral(raw) {
+	const trimmed = raw.trim();
+	const quote = trimmed[0];
+	if (quote !== "\"" && quote !== "'" && quote !== "`") return null;
+	if (trimmed.at(-1) !== quote) return null;
+	if (quote === "`" && trimmed.includes("${")) return null;
+	try {
+		if (quote === "\"") return JSON.parse(trimmed);
+		return JSON.parse(`"${trimmed.slice(1, -1).replace(/"/g, "\\\"")}"`);
+	} catch {
+		return trimmed.slice(1, -1);
+	}
+}
+
 //#endregion
 //#region node/vite/inspect.ts
 async function createInspectPlugin(options, pluginOptions) {
@@ -533,7 +685,7 @@ function createLayoutWrapperPlugin({ data, utils }) {
 
 //#endregion
 //#region package.json
-var version = "52.15.1";
+var version = "52.15.2";
 
 //#endregion
 //#region node/integrations/addons.ts
@@ -1123,39 +1275,6 @@ const templateConfigs = {
 	}
 };
 
-//#endregion
-//#region node/virtual/deprecated.ts
-/**
-* Kept for backward compatibility, use #slidev/slides instead
-*
-* @deprecated
-*/
-const templateLegacyRoutes = {
-	id: "/@slidev/routes",
-	getContent() {
-		return [`export { slides } from '#slidev/slides'`, `console.warn('[slidev] #slidev/routes is deprecated, use #slidev/slides instead')`].join("\n");
-	}
-};
-/**
-* Kept for backward compatibility, use #slidev/title-renderer instead
-*
-* @deprecated
-*/
-const templateLegacyTitles = {
-	id: "/@slidev/titles.md",
-	getContent() {
-		return `
-<script setup lang="ts">
-import TitleRenderer from '#slidev/title-renderer'
-defineProps<{ no: number | string }>()
-console.warn('/@slidev/titles.md is deprecated, import from #slidev/title-renderer instead')
-<\/script>
-
-<TitleRenderer :no="no" />
-`;
-	}
-};
-
 //#endregion
 //#region node/virtual/global-layers.ts
 const id = `/@slidev/global-layers`;
@@ -1345,23 +1464,6 @@ const templateSlides = {
 	}
 };
 
-//#endregion
-//#region node/virtual/titles.ts
-const templateTitleRendererMd = {
-	id: "/@slidev/title-renderer.md",
-	getContent({ data }) {
-		const lines = data.slides.map(({ title }, i) => `<template ${i === 0 ? "v-if" : "v-else-if"}="no === ${i + 1}">\n\n${title}\n\n</template>`);
-		lines.push(`<script setup lang="ts">`, `import { useSlideContext } from '@slidev/client/context.ts'`, `import { computed } from 'vue'`, `const props = defineProps<{ no?: number | string }>()`, `const { $page } = useSlideContext()`, `const no = computed(() => +(props.no ?? $page.value))`, `<\/script>`);
-		return lines.join("\n");
-	}
-};
-const templateTitleRenderer = {
-	id: "/@slidev/title-renderer",
-	async getContent() {
-		return "export { default } from \"/@slidev/title-renderer.md\"";
-	}
-};
-
 //#endregion
 //#region node/virtual/index.ts
 const templates = [
@@ -2768,6 +2870,7 @@ function ViteSlidevPlugin(options, pluginOptions = {}, serverOptions = {}) {
 		createLayoutWrapperPlugin(options),
 		createContextInjectionPlugin(),
 		createVuePlugin(options, pluginOptions),
+		createSlideImportGuardPlugin(),
 		createHmrPatchPlugin(),
 		createComponentsPlugin(options, pluginOptions),
 		createIconsPlugin(options, pluginOptions),

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@slidev/cli",
   "type": "module",
-  "version": "52.15.1",
+  "version": "52.15.2",
   "description": "Presentation slides for developers",
   "author": "Anthony Fu <anthonyfu117@hotmail.com>",
   "license": "MIT",
@@ -111,9 +111,9 @@
     "vue": "^3.5.33",
     "yaml": "^2.8.3",
     "yargs": "^18.0.0",
-    "@slidev/types": "52.15.1",
-    "@slidev/parser": "52.15.1",
-    "@slidev/client": "52.15.1"
+    "@slidev/parser": "52.15.2",
+    "@slidev/types": "52.15.2",
+    "@slidev/client": "52.15.2"
   },
   "devDependencies": {
     "@hedgedoc/markdown-it-plugins": "^2.1.4",