afront 1.0.20 → 1.0.21

package/install.js

@@ -3,12 +3,13 @@ const fs = require('fs');
 const path = require('path');
 const { https } = require('follow-redirects');
 const { exec } = require('child_process');
+const os = require('os');
 const tmp = require('tmp');
 const AdmZip = require('adm-zip');
 const readline = require('readline');
 
 // Configuration
-const GITHUB_ZIP_URL = 'https://github.com/Asggen/afront/archive/refs/tags/v1.0.20.zip'; // Updated URL
+const GITHUB_ZIP_URL = 'https://github.com/Asggen/afront/archive/refs/tags/v1.0.21.zip'; // Updated URL
 
 // Define files to skip
 const SKIP_FILES = ['FUNDING.yml', 'CODE_OF_CONDUCT.md', 'SECURITY.md', 'install.js', '.npmrc'];
@@ -69,7 +70,8 @@ const downloadFile = (url, destination) => {
         });
       });
     }).on('error', (err) => {
-      fs.unlink(destination, () => reject(err));
+      // attempt to remove partial download only if it's inside allowed temp locations
+      safeUnlink(destination).finally(() => reject(err));
     });
   });
 };
@@ -127,6 +129,97 @@ const createDirIfNotExists = (dirPath) => {
   });
 };
 
+const isPathInside = (root, target) => {
+  const r = path.resolve(root);
+  const t = path.resolve(target);
+  return t === r || t.startsWith(r + path.sep);
+};
+
+
+// Security: path validated against SAFE_UNLINK_ROOT before unlink
+const SAFE_UNLINK_ROOT = path.resolve(process.cwd());
+
+const safeUnlink = async (targetPath) => {
+  const resolved = path.resolve(targetPath);
+
+  if (!resolved.startsWith(SAFE_UNLINK_ROOT + path.sep)) {
+    throw new Error(`Blocked unlink outside safe root: ${resolved}`);
+  }
+
+  const stats = await fs.promises.lstat(resolved);
+
+  if (!stats.isFile()) {
+    throw new Error(`Refusing to unlink non-file: ${resolved}`);
+  }
+
+  await fs.promises.unlink(resolved);
+};
+
+
+const safeRm = (dirPath, cb) => {
+  const resolved = path.resolve(dirPath);
+  if (!isPathInside(process.cwd(), resolved)) {
+    return cb(new Error(`Refusing to remove directory outside current working directory: ${resolved}`));
+  }
+  fs.rm(resolved, { recursive: true, force: true }, cb);
+};
+
+// Perform an atomic-safe move: open source with O_NOFOLLOW, stream to a temp file, fsync, then rename
+const safeMoveFile = async (resolvedSrc, resolvedDest) => {
+  const srcFlags = fs.constants.O_RDONLY | fs.constants.O_NOFOLLOW;
+  let srcHandle;
+  let destHandle;
+  const tmpName = `${resolvedDest}.tmp-${process.pid}-${Date.now()}`;
+  try {
+    srcHandle = await fs.promises.open(resolvedSrc, srcFlags);
+  } catch (err) {
+    throw err;
+  }
+
+  try {
+    const stats = await srcHandle.stat();
+    if (stats.isDirectory()) {
+      await srcHandle.close();
+      throw new Error('Source is a directory');
+    }
+
+    await createDirIfNotExists(path.dirname(resolvedDest));
+
+    destHandle = await fs.promises.open(tmpName, fs.constants.O_WRONLY | fs.constants.O_CREAT | fs.constants.O_TRUNC, stats.mode);
+
+    const bufferSize = 64 * 1024;
+    const buffer = Buffer.allocUnsafe(bufferSize);
+    let position = 0;
+    while (true) {
+      const { bytesRead } = await srcHandle.read(buffer, 0, bufferSize, position);
+      if (!bytesRead) break;
+      let written = 0;
+      while (written < bytesRead) {
+        const { bytesWritten } = await destHandle.write(buffer, written, bytesRead - written);
+        written += bytesWritten;
+      }
+      position += bytesRead;
+    }
+
+    await destHandle.sync();
+    await destHandle.close();
+    await srcHandle.close();
+
+    await fs.promises.rename(tmpName, resolvedDest);
+  } catch (err) {
+    try {
+      if (destHandle) await destHandle.close();
+    } catch (e) {}
+    try {
+      await safeUnlink(tmpName, [path.dirname(resolvedDest)]).catch(() => {});
+    } catch (e) {}
+    try {
+      if (srcHandle) await srcHandle.close();
+    } catch (e) {}
+    throw err;
+  }
+};
+
 const promptForFolderName = async () => {
   const answer = await askQuestion('AFront: Enter the name of the destination folder: ');
   return answer;
@@ -140,49 +233,94 @@ const promptForReplace = async (dirPath) => {
 const removeDir = (dirPath) => {
   return new Promise((resolve, reject) => {
     console.log(`Removing existing directory: ${dirPath}`);
-    fs.rm(dirPath, { recursive: true, force: true }, (err) => {
-      if (err) {
-        return reject(err);
-      }
+    safeRm(dirPath, (err) => {
+      if (err) return reject(err);
       resolve();
     });
   });
 };
 
+const SAFE_READDIR_ROOT = path.resolve(os.tmpdir());
+
+const safeReaddir = (dirPath, cb) => {
+  const resolved = path.resolve(dirPath);
+
+  if (!resolved.startsWith(SAFE_READDIR_ROOT + path.sep)) {
+    return cb(new Error(`Blocked readdir outside safe root: ${resolved}`));
+  }
+
+  fs.lstat(resolved, (err, stats) => {
+    if (err) return cb(err);
+    if (!stats.isDirectory()) {
+      return cb(new Error(`Not a directory: ${resolved}`));
+    }
+
+    fs.readdir(resolved, cb);
+  });
+};
+
+
 const moveFiles = (srcPath, destPath) => {
   return new Promise((resolve, reject) => {
-    fs.readdir(srcPath, (err, files) => {
+    safeReaddir(srcPath, (err, files) => {
       if (err) {
         return reject(err);
       }
       let pending = files.length;
       if (!pending) return resolve();
       files.forEach((file) => {
-        if (SKIP_FILES.includes(file)) {
+        // Normalize and validate file name to avoid path traversal
+        const fileName = path.basename(file);
+        if (SKIP_FILES.includes(fileName)) {
+          if (!--pending) resolve();
+          return;
+        }
+
+        const srcRoot = path.resolve(srcPath);
+        const destRoot = path.resolve(destPath);
+        const resolvedSrc = path.resolve(srcPath, file);
+        const resolvedDest = path.resolve(destPath, file);
+
+        // Ensure resolved paths are inside their respective roots
+        if (
+          !(resolvedSrc === srcRoot || resolvedSrc.startsWith(srcRoot + path.sep)) ||
+          !(resolvedDest === destRoot || resolvedDest.startsWith(destRoot + path.sep))
+        ) {
+          console.warn(`Skipping suspicious path: ${file}`);
           if (!--pending) resolve();
           return;
         }
 
-        const srcFile = path.join(srcPath, file);
-        const destFile = path.join(destPath, file);
-        fs.stat(srcFile, (err, stats) => {
+        // Use lstat to detect symlinks and refuse to follow them
+        fs.lstat(resolvedSrc, (err, stats) => {
           if (err) {
             return reject(err);
           }
+
+          if (stats.isSymbolicLink()) {
+            console.warn(`Skipping symbolic link for safety: ${resolvedSrc}`);
+            if (!--pending) resolve();
+            return;
+          }
+
           if (stats.isDirectory()) {
-            createDirIfNotExists(destFile)
-              .then(() => moveFiles(srcFile, destFile))
+            createDirIfNotExists(resolvedDest)
+              .then(() => moveFiles(resolvedSrc, resolvedDest))
               .then(() => {
                 if (!--pending) resolve();
               })
               .catch(reject);
           } else {
-            fs.rename(srcFile, destFile, (err) => {
-              if (err) {
-                return reject(err);
-              }
-              if (!--pending) resolve();
-            });
+                // Use atomic-safe move: copy from a non-following FD to temp file, then rename
+                createDirIfNotExists(path.dirname(resolvedDest))
+                  .then(() => {
+                    safeMoveFile(resolvedSrc, resolvedDest)
+                      .then(() => {
+                        if (!--pending) resolve();
+                      })
+                      .catch(reject);
+                  })
+                  .catch(reject);
           }
         });
       });
@@ -202,6 +340,29 @@ const main = async () => {
       folderName = await promptForFolderName();
     }
 
+    // Sanitize the provided folder name to prevent path traversal or absolute paths
+    const sanitizeFolderName = (name) => {
+      if (!name) return '';
+      // If user provided '.', use current dir basename
+      if (name === '.') return path.basename(process.cwd());
+      // Disallow absolute paths
+      if (path.isAbsolute(name)) {
+        console.warn('Absolute paths are not allowed for destination; using basename.');
+        name = path.basename(name);
+      }
+      // Disallow parent traversal and nested paths
+      if (name === '..' || name.includes(path.sep) || name.includes('..')) {
+        console.warn('Path traversal detected in destination name; using basename of input.');
+        name = path.basename(name);
+      }
+      // Finally, ensure it's a single path segment
+      name = path.basename(name);
+      if (!name) throw new Error('Invalid destination folder name');
+      return name;
+    };
+
+    folderName = sanitizeFolderName(folderName);
+
     const destDir = path.join(process.cwd(), folderName);
 
     if (fs.existsSync(destDir)) {
@@ -230,6 +391,15 @@ const main = async () => {
 
     await moveFiles(extractedFolderPath, destDir);
 
+    // Remove any bundled lockfiles from the extracted archive to avoid integrity
+    // checksum mismatches originating from the release zip's lockfile.
+    try {
+      await safeUnlink(path.join(destDir, 'package-lock.json')).catch(() => {});
+      await safeUnlink(path.join(destDir, 'npm-shrinkwrap.json')).catch(() => {});
+    } catch (e) {
+      // ignore
+    }
+
     await runNpmInstall(destDir);
 
     rl.close();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "afront",
-  "version": "1.0.20",
+  "version": "1.0.21",
   "description": "AFront is a front-end JavaScript library designed to create seamless server-side rendered (SSSR) websites.",
   "main": "webpack.dev.js",
   "scripts": {

package/server.js

@@ -1,6 +1,7 @@
 const express = require("express");
 const path = require("path");
 const RateLimit = require("express-rate-limit");
+const helmet = require("helmet");
 require("dotenv").config();
 
 const app = express();
@@ -9,6 +10,12 @@ const HOST = process.env.HOST;
 
 app.set("trust proxy", 1);
 
+// Disable the X-Powered-By header to avoid exposing Express
+app.disable("x-powered-by");
+
+// Use Helmet to set various HTTP headers for better security
+app.use(helmet());
+
 // Set up rate limiter: maximum of 100 requests per 15 minutes
 const limiter = RateLimit({
   windowMs: 15 * 60 * 1000, // 15 minutes

package/webpack.build-prod.js

@@ -97,14 +97,14 @@ module.exports = {
         minifyJS: true,
       },
       templateParameters: (compilation, options) => {
-        const hash = crypto.createHash("sha1");
+        const hash = crypto.createHash("sha256");
         hash.update(compilation.hash);
-        const sha1Hash = hash.digest("hex");
+        const sha256Hash = hash.digest("hex");
         return {
           htmlWebpackPlugin: {
             options: {
               title: "AFront",
-              buildTag: `prod-${sha1Hash}`,
+              buildTag: `prod-${sha256Hash}`,
             },
           },
         };
@@ -126,4 +126,4 @@ module.exports = {
       ],
     }),
   ],
-};
+};

package/webpack.dev.js

@@ -95,18 +95,18 @@ module.exports = {
       filename: "index.html",
       hash: true, // This will add the hash in the injected scripts
       templateParameters: (compilation) => {
-        const hash = crypto.createHash("sha1");
+        const hash = crypto.createHash("sha256");
         hash.update(compilation.hash);
-        const sha1Hash = hash.digest("hex");
+        const sha256Hash = hash.digest("hex");
         return {
           htmlWebpackPlugin: {
             options: {
               title: "AFront",
-              buildTag: `dev-${sha1Hash}`, // Set the build tag with the hash for dev
+              buildTag: `dev-${sha256Hash}`, // Set the build tag with the hash for dev
             },
           },
         };
       },
     }),
   ],
-};
+};

package/webpack.prod.js

@@ -101,14 +101,14 @@ module.exports = {
         minifyJS: true,
       },
       templateParameters: (compilation) => {
-        const hash = crypto.createHash("sha1");
+        const hash = crypto.createHash("sha256");
         hash.update(compilation.hash);
-        const sha1Hash = hash.digest("hex");
+        const sha256Hash = hash.digest("hex");
         return {
           htmlWebpackPlugin: {
             options: {
               title: "AFront",
-              buildTag: `prod-${sha1Hash}`,
+              buildTag: `prod-${sha256Hash}`,
             },
           },
         };
@@ -133,4 +133,4 @@ module.exports = {
   performance: {
     hints: "warning",
   },
-};
+};