@sparkelf/dsh-patch-better-sidebar-html-preview-path 0.2.0-rc.17 → 0.2.0-rc.18
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
package/package.json
CHANGED
|
@@ -2,19 +2,26 @@ diff --git a/lib/index.js b/lib/index.js
|
|
|
2
2
|
index 278ca90..82d457d 100644
|
|
3
3
|
--- a/lib/index.js
|
|
4
4
|
+++ b/lib/index.js
|
|
5
|
-
@@ -5080,8 +5080,
|
|
5
|
+
@@ -5080,8 +5080,21 @@ function apply(ctx, config) {
|
|
6
6
|
writeError(res, new SidebarError("bad-request", decoded.message, decoded.status));
|
|
7
7
|
return;
|
|
8
8
|
}
|
|
9
9
|
- const { sessionId, path } = decoded.ref;
|
|
10
10
|
- const absolute = await ensureWorkspacePath(await sessionCwdOf(ctx, sessionId), path, fenceEnabledOf(() => settingsFace));
|
|
11
11
|
+ const { sessionId, path: decodedPath } = decoded.ref;
|
|
12
|
-
+ // A produced-file path
|
|
13
|
-
+ //
|
|
14
|
-
+ //
|
|
12
|
+
+ // A produced-file path may arrive workspace-root-relative ("/x.html"), which the
|
|
13
|
+
+ // host would read as a POSIX root and realpath outside the workspace. That only
|
|
14
|
+
+ // holds while the cwd-joined candidate actually exists: every other absolute path
|
|
15
|
+
+ // (a mounted drive such as /mnt/d/..., a workspace sibling) is already the real
|
|
16
|
+
+ // target and must be used as sent. Deciding on existence — not on containment —
|
|
17
|
+
+ // is what keeps both shapes working, which is how the media route bounds its own.
|
|
15
18
|
+ const htmlCwd = await sessionCwdOf(ctx, sessionId);
|
|
16
|
-
+
|
|
17
|
-
+
|
|
19
|
+
+ let path = decodedPath;
|
|
20
|
+
+ if (isAbsolute(decodedPath) && !isWithin(htmlCwd, decodedPath)) {
|
|
21
|
+
+ const candidate = join(htmlCwd, decodedPath);
|
|
22
|
+
+ const exists = await stat(candidate).then(info => info.isFile(), () => false);
|
|
23
|
+
+ if (exists) path = candidate;
|
|
24
|
+
+ }
|
|
18
25
|
+ const absolute = await ensureWorkspacePath(htmlCwd, path, fenceEnabledOf(() => settingsFace));
|
|
19
26
|
const info = await stat(absolute);
|
|
20
27
|
if (!info.isFile() || info.size > resolved.mediaLimit) throw new SidebarError("fs-error", "not a file or too large", 400);
|