@tinacms/graphql 2.2.0 → 2.2.2

package/dist/index.js

@@ -3026,7 +3026,7 @@ var validateField = async (field) => {
 var package_default = {
   name: "@tinacms/graphql",
   type: "module",
-  version: "2.2.0",
+  version: "2.2.2",
   main: "dist/index.js",
   module: "./dist/index.js",
   files: [
@@ -3053,7 +3053,7 @@ var package_default = {
     types: "pnpm tsc",
     build: "tinacms-scripts build",
     docs: "pnpm typedoc",
-    test: "vitest run",
+    test: "vitest run --coverage.enabled",
     "test-watch": "vitest"
   },
   dependencies: {
@@ -3099,6 +3099,7 @@ var package_default = {
     "@types/node": "^22.13.1",
     "@types/normalize-path": "catalog:",
     "@types/ws": "catalog:",
+    "@vitest/coverage-v8": "0.32.4",
     "jest-file-snapshot": "^0.5.0",
     "memory-level": "catalog:",
     typescript: "^5.7.3",
@@ -4916,7 +4917,7 @@ var updateObjectWithJsonPath = (obj, path9, oldValue, newValue) => {
   }
   return { object: obj, updated };
 };
-var Resolver = class {
+var Resolver = class _Resolver {
   constructor(init) {
     this.init = init;
     this.config = init.config;
@@ -5187,8 +5188,17 @@ var Resolver = class {
    * path traversal attacks where a user might attempt to read or write files
    * outside of the intended collection.
    */
+  static sanitizePath(input) {
+    if (input.includes("\0")) {
+      throw new Error("Invalid path: null bytes are not allowed");
+    }
+    return input.replace(/\\/g, "/");
+  }
   validatePath = (fullPath, collection, relativePath) => {
-    const normalizedPath = path3.normalize(fullPath);
+    if (fullPath.includes("\0")) {
+      throw new Error("Invalid path: null bytes are not allowed");
+    }
+    const normalizedPath = path3.normalize(fullPath.replace(/\\/g, "/"));
     const normalizedCollectionPath = path3.normalize(collection.path);
     const relative = path3.relative(normalizedCollectionPath, normalizedPath);
     if (relative.startsWith("..")) {
@@ -5219,16 +5229,17 @@ var Resolver = class {
    */
   getValidatedPath = (collectionName, relativePath, options) => {
     const collection = this.getCollectionWithName(collectionName);
-    const pathSegments = [collection.path, relativePath];
+    const sanitizedRelativePath = _Resolver.sanitizePath(relativePath);
+    const pathSegments = [collection.path, sanitizedRelativePath];
     if (options?.extraSegments) {
-      pathSegments.push(...options.extraSegments);
+      pathSegments.push(...options.extraSegments.map(_Resolver.sanitizePath));
     }
     const realPath = path3.join(...pathSegments);
     const shouldValidateExtension = options?.validateExtension !== false;
     this.validatePath(
       realPath,
       collection,
-      shouldValidateExtension ? relativePath : void 0
+      shouldValidateExtension ? sanitizedRelativePath : void 0
     );
     return { collection, realPath };
   };
@@ -8020,14 +8031,39 @@ import path7 from "path";
 import fg from "fast-glob";
 import fs2 from "fs-extra";
 import normalize from "normalize-path";
+function resolveRealPath(candidate) {
+  try {
+    return fs2.realpathSync(candidate);
+  } catch {
+    const parent = path7.dirname(candidate);
+    if (parent === candidate) return candidate;
+    return path7.join(resolveRealPath(parent), path7.basename(candidate));
+  }
+}
 function assertWithinBase(filepath, baseDir) {
+  if (filepath.includes("\0")) {
+    throw new Error("Invalid path: null bytes are not allowed");
+  }
+  const sanitized = filepath.replace(/\\/g, "/");
   const resolvedBase = path7.resolve(baseDir);
-  const resolved = path7.resolve(path7.join(baseDir, filepath));
+  const resolved = path7.resolve(path7.join(baseDir, sanitized));
   if (resolved !== resolvedBase && !resolved.startsWith(resolvedBase + path7.sep)) {
     throw new Error(
       `Path traversal detected: "${filepath}" escapes the base directory`
     );
   }
+  try {
+    const realBase = fs2.realpathSync(resolvedBase);
+    const realResolved = resolveRealPath(resolved);
+    if (realResolved !== realBase && !realResolved.startsWith(realBase + path7.sep)) {
+      throw new Error(
+        `Path traversal detected: "${filepath}" escapes the base directory`
+      );
+    }
+  } catch (err) {
+    if (err instanceof Error && err.message.startsWith("Path traversal"))
+      throw err;
+  }
   return resolved;
 }
 var FilesystemBridge = class {
@@ -8089,7 +8125,11 @@ import { GraphQLError as GraphQLError6 } from "graphql";
 import git2 from "isomorphic-git";
 import normalize2 from "normalize-path";
 function assertWithinBase2(filepath, relativePath) {
-  const qualified = relativePath ? `${relativePath}/${filepath}` : filepath;
+  if (filepath.includes("\0")) {
+    throw new Error("Invalid path: null bytes are not allowed");
+  }
+  const sanitized = filepath.replace(/\\/g, "/");
+  const qualified = relativePath ? `${relativePath}/${sanitized}` : sanitized;
   const normalized = path8.normalize(qualified);
   if (normalized.startsWith("..") || normalized.startsWith("/") || path8.isAbsolute(normalized) || relativePath && normalized !== relativePath && !normalized.startsWith(relativePath + "/")) {
     throw new Error(

package/dist/resolver/index.d.ts

@@ -235,6 +235,7 @@ export declare class Resolver {
      * path traversal attacks where a user might attempt to read or write files
      * outside of the intended collection.
      */
+    private static sanitizePath;
     private validatePath;
     /**
      * Helper method to get collection and construct validated path.

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@tinacms/graphql",
   "type": "module",
-  "version": "2.2.0",
+  "version": "2.2.2",
   "main": "dist/index.js",
   "module": "./dist/index.js",
   "files": [
@@ -43,7 +43,7 @@
     "normalize-path": "^3.0.0",
     "readable-stream": "^4.7.0",
     "yup": "^1.6.1",
-    "@tinacms/mdx": "2.0.7",
+    "@tinacms/mdx": "2.1.0",
     "@tinacms/schema-tools": "2.7.0"
   },
   "publishConfig": {
@@ -65,6 +65,7 @@
     "@types/node": "^22.13.1",
     "@types/normalize-path": "^3.0.2",
     "@types/ws": "^7.4.7",
+    "@vitest/coverage-v8": "0.32.4",
     "jest-file-snapshot": "^0.5.0",
     "memory-level": "^1.0.0",
     "typescript": "^5.7.3",
@@ -72,13 +73,13 @@
     "vitest": "^0.32.4",
     "zod": "^3.24.2",
     "@tinacms/schema-tools": "2.7.0",
-    "@tinacms/scripts": "1.5.0"
+    "@tinacms/scripts": "1.6.0"
   },
   "scripts": {
     "types": "pnpm tsc",
     "build": "tinacms-scripts build",
     "docs": "pnpm typedoc",
-    "test": "vitest run",
+    "test": "vitest run --coverage.enabled",
     "test-watch": "vitest"
   }
 }