@slidev/parser 52.17.0 → 52.17.2

package/dist/fs.d.mts

@@ -2,10 +2,22 @@ import { a as TimesplitOutput, i as TimesplitInput, n as parseRangeString, o as
 import { SlidevParserOptions, detectFeatures, extractImagesUsage, getDefaultConfig, parse, parseSlide, parseSync, prettify, prettifySlide, resolveConfig, resolveFonts, stringify, stringifySlide, verifyConfig } from "./core.mjs";
 import { PreparserExtensionLoader, SlidevData, SlidevMarkdown } from "@slidev/types";
 //#region src/fs.d.ts
+/**
+ * Whether `filePath` resolves inside any of `roots` (no `..` escape).
+ * Inlined here (rather than imported from the `slidev` package) because
+ * `@slidev/parser` must stay independent of `@slidev/slidev`.
+ */
+declare function isPathInsideRoots(filePath: string, roots: string[]): boolean;
 declare function injectPreparserExtensionLoader(fn: PreparserExtensionLoader): void;
 interface LoadRootsInfo {
   roots: string[];
   userRoot: string;
+  /**
+   * When provided, `src:` includes resolving outside these roots are
+   * rejected (recorded as an error) instead of being loaded. Optional for
+   * backward compatibility with other `@slidev/parser` consumers.
+   */
+  allowedRoots?: string[];
 }
 /**
  * Slidev data without config and themeMeta,
@@ -15,4 +27,4 @@ type LoadedSlidevData = Omit<SlidevData, 'config' | 'themeMeta'>;
 declare function load(options: LoadRootsInfo, filepath: string, sources?: Record<string, string> | ((path: string) => Promise<string>), mode?: string): Promise<LoadedSlidevData>;
 declare function save(markdown: SlidevMarkdown): Promise<string>;
 //#endregion
-export { LoadRootsInfo, LoadedSlidevData, SlidevParserOptions, TimesplitInput, TimesplitOutput, detectFeatures, extractImagesUsage, getDefaultConfig, injectPreparserExtensionLoader, load, parse, parseAspectRatio, parseRangeString, parseSlide, parseSync, parseTimeString, parseTimesplits, prettify, prettifySlide, resolveConfig, resolveFonts, save, stringify, stringifySlide, verifyConfig };
+export { LoadRootsInfo, LoadedSlidevData, SlidevParserOptions, TimesplitInput, TimesplitOutput, detectFeatures, extractImagesUsage, getDefaultConfig, injectPreparserExtensionLoader, isPathInsideRoots, load, parse, parseAspectRatio, parseRangeString, parseSlide, parseSync, parseTimeString, parseTimesplits, prettify, prettifySlide, resolveConfig, resolveFonts, save, stringify, stringifySlide, verifyConfig };

package/dist/fs.mjs

@@ -4,8 +4,19 @@ import { slash } from "@antfu/utils";
 import YAML from "yaml";
 import { existsSync } from "node:fs";
 import { readFile, writeFile } from "node:fs/promises";
-import { dirname, resolve } from "node:path";
+import { dirname, isAbsolute, relative, resolve } from "pathe";
 //#region src/fs.ts
+/**
+* Whether `filePath` resolves inside any of `roots` (no `..` escape).
+* Inlined here (rather than imported from the `slidev` package) because
+* `@slidev/parser` must stay independent of `@slidev/slidev`.
+*/
+function isPathInsideRoots(filePath, roots) {
+	return roots.some((root) => {
+		const rel = relative(root, filePath);
+		return rel === "" || !!rel && !rel.startsWith("..") && !isAbsolute(rel);
+	});
+}
 const RE_FRONTMATTER_START = /^---(?:[^-].*)?$/;
 const RE_BLANK_LINE = /^\s*$/;
 const RE_FRONTMATTER_END = /^---$/;
@@ -66,7 +77,22 @@ async function load(options, filepath, sources = {}, mode) {
 				...frontmatterOverride
 			};
 			delete frontmatterOverride.src;
-			if (!existsSync(path)) {
+			const ancestorPaths = new Set((importChain ?? []).map((s) => s.filepath));
+			if (path === slide.filepath || ancestorPaths.has(path)) {
+				md.errors ??= [];
+				md.errors.push({
+					row: slide.start,
+					message: `Circular import detected for "${slide.frontmatter.src}" (${path})`
+				});
+				return;
+			}
+			if (options.allowedRoots && !isPathInsideRoots(path, options.allowedRoots)) {
+				md.errors ??= [];
+				md.errors.push({
+					row: slide.start,
+					message: `Imported markdown escapes the project root: ${path}`
+				});
+			} else if (!existsSync(path)) {
 				md.errors ??= [];
 				md.errors.push({
 					row: slide.start,
@@ -107,4 +133,4 @@ async function save(markdown) {
 	return fileContent;
 }
 //#endregion
-export { detectFeatures, extractImagesUsage, getDefaultConfig, injectPreparserExtensionLoader, load, parse, parseAspectRatio, parseRangeString, parseSlide, parseSync, parseTimeString, parseTimesplits, prettify, prettifySlide, resolveConfig, resolveFonts, save, stringify, stringifySlide, verifyConfig };
+export { detectFeatures, extractImagesUsage, getDefaultConfig, injectPreparserExtensionLoader, isPathInsideRoots, load, parse, parseAspectRatio, parseRangeString, parseSlide, parseSync, parseTimeString, parseTimesplits, prettify, prettifySlide, resolveConfig, resolveFonts, save, stringify, stringifySlide, verifyConfig };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@slidev/parser",
-  "version": "52.17.0",
+  "version": "52.17.2",
   "description": "Markdown parser for Slidev",
   "author": "Anthony Fu <anthonyfu117@hotmail.com>",
   "license": "MIT",
@@ -30,8 +30,9 @@
   },
   "dependencies": {
     "@antfu/utils": "^9.3.0",
+    "pathe": "^2.0.3",
     "yaml": "^2.9.0",
-    "@slidev/types": "52.17.0"
+    "@slidev/types": "52.17.2"
   },
   "devDependencies": {
     "tsdown-stale-guard": "^0.1.2"