@volter/world-runtime 2.0.29 → 2.0.30

package/dist/src/served-world.js

@@ -26,7 +26,7 @@ import { getActiveWorldStore, withAncestryLock, captureHistory, historyAtInstant
 // to `.volter/token` and `.volter/token.read` (0600).
 // One writer per world by construction: the doors run in this process, serialized per twin.
 import { chmodSync, existsSync, mkdirSync, readFileSync, writeFileSync, rmSync } from 'node:fs';
-import { blobDigest, openSealedAt, getActiveBlobStore, loadCheck, mirrorShellUnder, readTwinRequestJournal, serveHttp, TWIN_PREFIX_HEADER, validateRemoteOrigin } from '@volter/world-core';
+import { assertSafeChangesetName, blobDigest, openSealedAt, getActiveBlobStore, loadCheck, mirrorShellUnder, readTwinRequestJournal, serveHttp, TWIN_PREFIX_HEADER, validateRemoteOrigin } from '@volter/world-core';
 import { APP_READ_ENDPOINT_ENV } from "./init.js";
 import { grantOf, presentedSecrets, sameSecret, spentPasses, verifyPass } from '@volter/world-access';
 import { createHash } from 'node:crypto';
@@ -1687,6 +1687,9 @@ export class WorldDoors {
  * door and the path transport both come here.
  */
 export async function landChangeset(name, worldRoot, instance, changeset, expected = {}) {
+    // the name addresses the file the changeset is kept in: a name with a separator or a traversal would write anywhere in
+    // the World's store (its token, its credentials), so it is refused before anything lands
+    assertSafeChangesetName(typeof changeset.name === 'string' ? changeset.name : '');
     const receipts = [];
     const checks = await loadWorldChecks(worldRoot);
     const stateOf = (twin) => stateServiceOf(join(instance.dirs.data, twin), twin);
@@ -1744,7 +1747,10 @@ export async function landChangeset(name, worldRoot, instance, changeset, expect
                 receipts.push({ actionId: id, twin, status: 'landed', at: worldNow() });
         }
     }
-    const path = join(worldChangesetsDir(name, worldRoot), `${changeset.name}.json`);
+    const dir = worldChangesetsDir(name, worldRoot);
+    const path = join(dir, `${changeset.name}.json`);
+    if (dirname(path) !== dir)
+        throw new Error(`Invalid changeset name: ${JSON.stringify(changeset.name)}`);
     const store = getActiveWorldStore();
     if (!store.exists(path))
         store.write(path, `${JSON.stringify(changeset, null, 2)}\n`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@volter/world-runtime",
-  "version": "2.0.29",
+  "version": "2.0.30",
   "description": "World configs for twins: boot named local runtimes, allocate ports, generate world.env/instance.json, and run apps against fake-key twin worlds.",
   "keywords": [
     "twin",

package/src/served-world.ts

@@ -26,7 +26,7 @@ import { getActiveWorldStore, withAncestryLock, captureHistory, historyAtInstant
 // to `.volter/token` and `.volter/token.read` (0600).
 // One writer per world by construction: the doors run in this process, serialized per twin.
 import { chmodSync, existsSync, mkdirSync, readdirSync, readFileSync, writeFileSync , rmSync} from 'node:fs';
-import { blobDigest, openSealedAt, getActiveBlobStore, loadCheck, mirrorShellUnder, readTwinRequestJournal, serveHttp, TWIN_PREFIX_HEADER, validateRemoteOrigin, type SealedCredential, type TwinStreamConnection, type TwinStreamSink } from '@volter/world-core';
+import { assertSafeChangesetName, blobDigest, openSealedAt, getActiveBlobStore, loadCheck, mirrorShellUnder, readTwinRequestJournal, serveHttp, TWIN_PREFIX_HEADER, validateRemoteOrigin, type SealedCredential, type TwinStreamConnection, type TwinStreamSink } from '@volter/world-core';
 import { APP_READ_ENDPOINT_ENV } from './init.ts';
 import { grantOf, presentedSecrets, sameSecret, spentPasses, verifyPass, type TrustedIssuer, type WorldCredentials } from '@volter/world-access';
 import { createHash } from 'node:crypto';
@@ -1436,6 +1436,9 @@ export class WorldDoors {
  * door and the path transport both come here.
  */
 export async function landChangeset(name: string, worldRoot: string, instance: WorldLayout, changeset: Changeset, expected: Record<string, HistoryReference> = {}): Promise<Array<{ actionId: string; twin: string } & Receipt>> {
+  // the name addresses the file the changeset is kept in: a name with a separator or a traversal would write anywhere in
+  // the World's store (its token, its credentials), so it is refused before anything lands
+  assertSafeChangesetName(typeof changeset.name === 'string' ? changeset.name : '');
   const receipts: Array<{ actionId: string; twin: string } & Receipt> = [];
   const checks = await loadWorldChecks(worldRoot);
   const stateOf = (twin: string): string => stateServiceOf(join(instance.dirs.data, twin), twin);
@@ -1481,7 +1484,9 @@ export async function landChangeset(name: string, worldRoot: string, instance: W
       for (const id of landedIds) receipts.push({ actionId: id, twin, status: 'landed', at: worldNow() });
     }
   }
-  const path = join(worldChangesetsDir(name, worldRoot), `${changeset.name}.json`);
+  const dir = worldChangesetsDir(name, worldRoot);
+  const path = join(dir, `${changeset.name}.json`);
+  if (dirname(path) !== dir) throw new Error(`Invalid changeset name: ${JSON.stringify(changeset.name)}`);
   const store = getActiveWorldStore();
   if (!store.exists(path)) store.write(path, `${JSON.stringify(changeset, null, 2)}\n`);
   return receipts;