@zeropress/build-core 0.1.11 → 0.1.12

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zeropress/build-core",
-  "version": "0.1.11",
+  "version": "0.1.12",
   "description": "Shared ZeroPress build core",
   "type": "module",
   "license": "MIT",
@@ -33,6 +33,7 @@
     "node": ">=18.18.0"
   },
   "dependencies": {
+    "@zeropress/slug-policy": "^0.1.0",
     "@zeropress/preview-data-validator": "^0.4.1",
     "@zeropress/theme-validator": "^0.3.0",
     "highlight.js": "^11.11.1",

package/src/api/build-site.js

@@ -1,5 +1,6 @@
 import { createHash } from 'node:crypto';
 import { assertPreviewData } from '@zeropress/preview-data-validator';
+import { isSafeSlugSegment, normalizeStoredSlug } from '@zeropress/slug-policy';
 import { validateThemeFiles } from '@zeropress/theme-validator';
 import { AssetProcessor } from '../assets/asset-processor.js';
 import { renderDocumentContent } from '../render/content-renderer.js';
@@ -17,9 +18,11 @@ const DEFAULT_DATE_FORMAT = 'YYYY-MM-DD';
 const DEFAULT_TIME_FORMAT = 'HH:mm';
 const DEFAULT_TIMEZONE = 'UTC';
 const DEFAULT_LOCALE = 'en-US';
+const OUTPUT_PATH_CONTROL_CHAR_PATTERN = /[\u0000-\u001F\u007F]/;
 export async function buildSite(input) {
   const options = { ...DEFAULT_OPTIONS, ...(input.options || {}) };
   const state = await createBuildState(input, options);
+  assertPlannedOutputPathsSafe(state);
 
   for (const route of state.renderData.indexRoutes) {
     await renderRoute(state, 'index', route);
@@ -959,7 +962,9 @@ function isAbsoluteUrl(value) {
 }
 
 async function writeOutput(writer, summaries, path, content, contentType) {
-  const normalizedPath = normalizeOutputPath(path);
+  const rawPath = String(path || '');
+  const normalizedPath = normalizeOutputPath(rawPath);
+  assertSafeRelativeOutputPath(rawPath, normalizedPath);
   await writer.write({ path: normalizedPath, content, contentType });
   summaries.push({
     path: normalizedPath,
@@ -989,6 +994,95 @@ function normalizeOutputPath(filePath) {
   return String(filePath || '').replace(/^\/+/, '');
 }
 
+function assertPlannedOutputPathsSafe(state) {
+  for (const post of state.renderData.posts) {
+    assertSafeSlugDerivedOutputPath(post.slug, `posts/${encodeSlugSegment(post.slug)}/index.html`);
+  }
+
+  for (const page of state.renderData.pages) {
+    assertSafeSlugDerivedOutputPath(page.slug, `${encodeSlugSegment(page.slug)}/index.html`);
+  }
+
+  for (const category of state.previewData.content.categories) {
+    assertSafeSlugDerivedOutputPath(category.slug, `categories/${encodeSlugSegment(category.slug)}/index.html`);
+  }
+
+  for (const tag of state.previewData.content.tags) {
+    assertSafeSlugDerivedOutputPath(tag.slug, `tags/${encodeSlugSegment(tag.slug)}/index.html`);
+  }
+
+  const plannedPaths = [
+    ...state.renderData.indexRoutes.map((route) => routePathToOutputPath(route.path)),
+    ...state.renderData.archiveRoutes.map((route) => routePathToOutputPath(route.path)),
+    ...state.renderData.categoryRoutes.map((route) => routePathToOutputPath(route.path)),
+    ...state.renderData.tagRoutes.map((route) => routePathToOutputPath(route.path)),
+    ...state.renderData.posts.map((post) => `posts/${encodeSlugSegment(post.slug)}/index.html`),
+    ...state.renderData.pages.map((page) => `${encodeSlugSegment(page.slug)}/index.html`),
+    ...state.assetOutputs.map((assetOutput) => assetOutput.path),
+  ];
+
+  if (state.options.generateSpecialFiles) {
+    plannedPaths.push('404.html', 'robots.txt', 'meta.json');
+    if (hasCanonicalSiteUrl(state.previewData.site.url)) {
+      plannedPaths.push('sitemap.xml', 'feed.xml');
+    }
+  }
+
+  for (const plannedPath of plannedPaths) {
+    const rawPath = String(plannedPath || '');
+    const normalizedPath = normalizeOutputPath(rawPath);
+    assertSafeRelativeOutputPath(rawPath, normalizedPath);
+  }
+}
+
+function assertSafeSlugDerivedOutputPath(rawSlug, outputPath) {
+  const originalSlug = typeof rawSlug === 'string' ? rawSlug : '';
+  const decodedSlug = encodeSlugSegment(rawSlug);
+
+  if (
+    !isSafeSlugPathSegment(originalSlug) ||
+    !isSafeSlugPathSegment(decodedSlug)
+  ) {
+    throw new Error(`Unsafe output path detected: ${outputPath}`);
+  }
+}
+
+function isSafeSlugPathSegment(value) {
+  return isSafeSlugSegment(value);
+}
+
+function assertSafeRelativeOutputPath(rawPath, normalizedPath = normalizeOutputPath(rawPath)) {
+  const originalPath = String(rawPath || '');
+  const candidatePath = String(normalizedPath || '');
+  const normalizedSeparators = candidatePath.replace(/\\/g, '/');
+
+  if (originalPath.trim() === '' || candidatePath.trim() === '') {
+    throw new Error(`Unsafe output path detected: ${originalPath || candidatePath || '<empty>'}`);
+  }
+
+  if (OUTPUT_PATH_CONTROL_CHAR_PATTERN.test(originalPath) || OUTPUT_PATH_CONTROL_CHAR_PATTERN.test(candidatePath)) {
+    throw new Error(`Unsafe output path detected: ${originalPath}`);
+  }
+
+  if (candidatePath.includes('%')) {
+    throw new Error(`Unsafe output path detected: ${originalPath}`);
+  }
+
+  if (
+    originalPath.startsWith('/') ||
+    originalPath.startsWith('\\') ||
+    /^[A-Za-z]:[\\/]/.test(originalPath) ||
+    normalizedSeparators.startsWith('//')
+  ) {
+    throw new Error(`Unsafe output path detected: ${originalPath}`);
+  }
+
+  const segments = normalizedSeparators.split('/');
+  if (segments.some((segment) => segment === '' || segment === '.' || segment === '..')) {
+    throw new Error(`Unsafe output path detected: ${originalPath}`);
+  }
+}
+
 function getContentSize(content) {
   return typeof content === 'string' ? Buffer.byteLength(content) : content.byteLength;
 }
@@ -1120,23 +1214,6 @@ function encodeSlugSegment(slug) {
   return normalizeStoredSlug(slug);
 }
 
-function normalizeStoredSlug(slug) {
-  if (typeof slug !== 'string') {
-    return '';
-  }
-
-  const trimmed = slug.trim();
-  if (!trimmed.includes('%')) {
-    return trimmed;
-  }
-
-  try {
-    return decodeURIComponent(trimmed);
-  } catch {
-    return trimmed;
-  }
-}
-
 function decodeRoutePath(routePath) {
   try {
     return decodeURI(routePath);