@theokit/sdk 4.19.3 → 4.19.4
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/cron.cjs +7 -3
- package/dist/cron.cjs.map +1 -1
- package/dist/cron.js +8 -4
- package/dist/cron.js.map +1 -1
- package/dist/eval.cjs +7 -3
- package/dist/eval.cjs.map +1 -1
- package/dist/eval.js +8 -4
- package/dist/eval.js.map +1 -1
- package/dist/filesystem/index.cjs +7 -3
- package/dist/filesystem/index.cjs.map +1 -1
- package/dist/filesystem/index.js +7 -3
- package/dist/filesystem/index.js.map +1 -1
- package/dist/index.cjs +7 -3
- package/dist/index.cjs.map +1 -1
- package/dist/index.js +7 -3
- package/dist/index.js.map +1 -1
- package/dist/internal/security/index.cjs +7 -3
- package/dist/internal/security/index.cjs.map +1 -1
- package/dist/internal/security/index.js +8 -4
- package/dist/internal/security/index.js.map +1 -1
- package/dist/path-safety.cjs +7 -3
- package/dist/path-safety.cjs.map +1 -1
- package/dist/path-safety.js +8 -4
- package/dist/path-safety.js.map +1 -1
- package/dist/skills.cjs +7 -3
- package/dist/skills.cjs.map +1 -1
- package/dist/skills.js +7 -3
- package/dist/skills.js.map +1 -1
- package/dist/workflow.cjs.map +1 -1
- package/dist/workflow.js.map +1 -1
- package/package.json +1 -1
package/dist/index.js
CHANGED
|
@@ -854,6 +854,11 @@ var init_atomic_write = __esm({
|
|
|
854
854
|
warnedNfsDirs = /* @__PURE__ */ new Set();
|
|
855
855
|
}
|
|
856
856
|
});
|
|
857
|
+
function isInside(target, base) {
|
|
858
|
+
if (target === base) return true;
|
|
859
|
+
const prefix = base.endsWith(sep) ? base : base + sep;
|
|
860
|
+
return target.startsWith(prefix);
|
|
861
|
+
}
|
|
857
862
|
function safePathJoin(base, ...parts) {
|
|
858
863
|
if (base === "") {
|
|
859
864
|
throw new Error("safePathJoin: base must be non-empty");
|
|
@@ -864,8 +869,7 @@ function safePathJoin(base, ...parts) {
|
|
|
864
869
|
}
|
|
865
870
|
const baseResolved = resolve(base);
|
|
866
871
|
const target = resolve(base, ...parts);
|
|
867
|
-
|
|
868
|
-
if (target !== baseResolved && !target.startsWith(prefix)) {
|
|
872
|
+
if (!isInside(target, baseResolved)) {
|
|
869
873
|
throw new PathTraversalError(parts.join("/"), target);
|
|
870
874
|
}
|
|
871
875
|
return target;
|
|
@@ -890,7 +894,7 @@ function assertNoSymlinkEscape(path, base) {
|
|
|
890
894
|
}
|
|
891
895
|
const resolved = realpathOfDeepestExisting(path);
|
|
892
896
|
if (resolved === void 0) return;
|
|
893
|
-
if (resolved
|
|
897
|
+
if (!isInside(resolved, baseResolved)) {
|
|
894
898
|
throw new PathTraversalError(`symlink ${path}`, resolved);
|
|
895
899
|
}
|
|
896
900
|
}
|