@statewalker/webrun-storage 0.2.2 → 0.3.0

package/dist/files-blob-store.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"files-blob-store.d.ts","sourceRoot":"","sources":["../src/files-blob-store.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,2BAA2B,CAAC;AAE1D,OAAO,KAAK,EAAE,SAAS,EAAc,MAAM,YAAY,CAAC;AAExD,MAAM,WAAW,qBAAqB;IACpC,oEAAoE;IACpE,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,QAAQ,EAAE,IAAI,CAAC,EAAE,qBAAqB,GAAG,SAAS,CAkDvF"}
+{"version":3,"file":"files-blob-store.d.ts","sourceRoot":"","sources":["../src/files-blob-store.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,2BAA2B,CAAC;AAE1D,OAAO,KAAK,EAAE,SAAS,EAAc,MAAM,YAAY,CAAC;AAExD,MAAM,WAAW,qBAAqB;IACpC,oEAAoE;IACpE,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAID;;;GAGG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,QAAQ,EAAE,IAAI,CAAC,EAAE,qBAAqB,GAAG,SAAS,CA4DvF"}

package/dist/index.js

@@ -42,13 +42,19 @@ async function assertVerified(id, chunks, verify) {
 }
 //#endregion
 //#region src/files-blob-store.ts
+const isDotSegment = (segment) => segment === "." || segment === "..";
 /**
 * {@link BlobStore} backed by a {@link FilesApi}. Ids map to git-style sharded
 * paths (`ab/cdef…`) so a large id space never lands in one flat directory.
 */
 function filesBlobStore(files, opts) {
 	const base = (opts?.root ?? "/").replace(/\/+$/, "");
-	const pathFor = (id) => `${base}/${id.slice(0, 2)}/${id.slice(2)}`;
+	const pathFor = (id) => {
+		const shard = id.slice(0, 2);
+		const rest = id.slice(2);
+		if (id === "" || /[/\\]/.test(id) || isDotSegment(shard) || isDotSegment(rest)) throw new Error(`Invalid blob id: ${JSON.stringify(id)}`);
+		return `${base}/${shard}/${rest}`;
+	};
 	const idFrom = (relative) => relative.replace("/", "");
 	return {
 		async put(id, bytes, opts) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@statewalker/webrun-storage",
-  "version": "0.2.2",
+  "version": "0.3.0",
   "description": "Domain-neutral byte-persistence seam (BlobStore + KvStore with CAS) over the webrun-files FilesApi",
   "bugs": {
     "url": "https://github.com/statewalker/webrun-sync/issues"
@@ -31,10 +31,10 @@
     "src"
   ],
   "dependencies": {
-    "@statewalker/webrun-files": "^0.10.0"
+    "@statewalker/webrun-files": "^0.12.0"
   },
   "devDependencies": {
-    "@statewalker/webrun-files-mem": "^0.10.0",
+    "@statewalker/webrun-files-mem": "^0.12.0",
     "rolldown": "^1.2.12",
     "vitest": "^5.0.3",
     "typescript": "^7.0.2",
@@ -49,6 +49,7 @@
     "format": "biome format --write .",
     "format:check": "biome format .",
     "format:fix": "biome check --write --unsafe .",
-    "typecheck": "tsc --noEmit"
+    "typecheck": "tsc --noEmit",
+    "typecheck:tests": "tsc -p tsconfig.tests.json"
   }
 }

package/src/files-blob-store.ts

@@ -7,6 +7,8 @@ export interface FilesBlobStoreOptions {
   root?: string;
 }
 
+const isDotSegment = (segment: string): boolean => segment === "." || segment === "..";
+
 /**
  * {@link BlobStore} backed by a {@link FilesApi}. Ids map to git-style sharded
  * paths (`ab/cdef…`) so a large id space never lands in one flat directory.
@@ -14,7 +16,17 @@ export interface FilesBlobStoreOptions {
 export function filesBlobStore(files: FilesApi, opts?: FilesBlobStoreOptions): BlobStore {
   const base = (opts?.root ?? "/").replace(/\/+$/, "");
 
-  const pathFor = (id: string): string => `${base}/${id.slice(0, 2)}/${id.slice(2)}`;
+  const pathFor = (id: string): string => {
+    const shard = id.slice(0, 2);
+    const rest = id.slice(2);
+    // webrun-files resolves `..` before any mount or guard sees the path, so an
+    // id carrying a separator or a dot segment would land outside `root`. Ids
+    // come from remote peers (content-transfer's serve-store), so refuse them.
+    if (id === "" || /[/\\]/.test(id) || isDotSegment(shard) || isDotSegment(rest)) {
+      throw new Error(`Invalid blob id: ${JSON.stringify(id)}`);
+    }
+    return `${base}/${shard}/${rest}`;
+  };
   const idFrom = (relative: string): string => relative.replace("/", "");
 
   return {