akanjs 3.0.0-alpha.72 → 3.0.0-alpha.73

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "akanjs",
-  "version": "3.0.0-alpha.72",
+  "version": "3.0.0-alpha.73",
   "sourceType": "module",
   "type": "module",
   "publishConfig": {

package/server/akanApp.ts

@@ -18,6 +18,7 @@ import { LogHub } from "./logging/logHub";
 import { LogStreamRoute } from "./logging/logStreamRoute";
 import { RotatingLogWriter } from "./logging/rotatingLogWriter";
 import { ProcessMetricsCollector } from "./processMetricsCollector";
+import { resolveStaticPath } from "./staticPath";
 import { getWebConfigFromEnv } from "./types";
 
 interface ChildState {
@@ -669,7 +670,7 @@ export class AkanApp {
     if (!this.#web.ssr) return null;
     const clientPrefix = "/_akan/client/";
     if (url.pathname.startsWith(clientPrefix)) {
-      const filePath = this.#safeResolve(
+      const filePath = resolveStaticPath(
         path.join(this.#artifactDir, "client"),
         url.pathname.slice(clientPrefix.length),
       );
@@ -684,7 +685,7 @@ export class AkanApp {
 
     for (const prefix of ["/_akan/styles/", "/_akan/fonts/"]) {
       if (!url.pathname.startsWith(prefix)) continue;
-      const filePath = this.#safeResolve(this.#artifactDir, url.pathname.slice("/_akan/".length));
+      const filePath = resolveStaticPath(this.#artifactDir, url.pathname.slice("/_akan/".length));
       if (!filePath) return new Response("Not Found", { status: 404 });
       const file = Bun.file(filePath);
       if (!(await file.exists())) return new Response("Not Found", { status: 404 });
@@ -1018,23 +1019,6 @@ export class AkanApp {
     return new Response(Bun.file(filePath).stream(), { headers });
   }
 
-  #safeResolve(baseDir: string, urlPath: string): string | null {
-    let decoded: string;
-    try {
-      decoded = decodeURIComponent(urlPath);
-    } catch {
-      return null;
-    }
-    if (decoded.includes("\0")) return null;
-    const normalizedBase = path.resolve(baseDir);
-    const rel = decoded.replace(/^[/\\]+/, "");
-    const resolved = path.resolve(normalizedBase, rel);
-    if (resolved === normalizedBase) return resolved;
-    const baseWithSep = normalizedBase.endsWith(path.sep) ? normalizedBase : `${normalizedBase}${path.sep}`;
-    if (!resolved.startsWith(baseWithSep)) return null;
-    return resolved;
-  }
-
   #makeProxyHeaders(req: Request, childIdx: number, server?: Bun.Server<GatewayWsData>) {
     return makeAkanChildProxyHeaders(req, childIdx, server?.requestIP(req));
   }

package/server/imageOptimizer.ts

@@ -5,6 +5,7 @@ import { Logger } from "akanjs/common";
 import { isAnimatedImage } from "./animatedImage";
 import { ImageOptimizerError } from "./imageOptimizerError";
 import { Semaphore } from "./semaphore";
+import { resolveStaticPath } from "./staticPath";
 import {
   type AkanImageConfig,
   type AkanImageFormat,
@@ -260,7 +261,7 @@ export class ImageOptimizer {
 
   async #readLocalImage(href: string): Promise<ImageSource> {
     const url = new URL(href, "http://local.akan");
-    const filePath = ImageOptimizer.#safeResolve(this.#publicDir, url.pathname);
+    const filePath = resolveStaticPath(this.#publicDir, url.pathname);
     if (!filePath) throw new ImageOptimizerError(400, '"url" parameter is not allowed');
     const file = Bun.file(filePath);
     if (!(await file.exists())) throw new ImageOptimizerError(404, "Image not found");
@@ -455,22 +456,6 @@ export class ImageOptimizer {
     }
   }
 
-  static #safeResolve(baseDir: string, urlPath: string): string | null {
-    let decoded: string;
-    try {
-      decoded = decodeURIComponent(urlPath);
-    } catch {
-      return null;
-    }
-    if (decoded.includes("\0")) return null;
-    const normalizedBase = path.resolve(baseDir);
-    const rel = decoded.replace(/^[/\\]+/, "");
-    const resolved = path.resolve(normalizedBase, rel);
-    if (resolved === normalizedBase) return resolved;
-    const baseWithSep = normalizedBase.endsWith(path.sep) ? normalizedBase : normalizedBase + path.sep;
-    return resolved.startsWith(baseWithSep) ? resolved : null;
-  }
-
   static async #readResponseBuffer(res: Response, maxBytes: number): Promise<Buffer> {
     const contentLength = Number.parseInt(res.headers.get("content-length") ?? "0", 10);
     if (contentLength > maxBytes) throw new ImageOptimizerError(413, "Remote image is too large");

package/server/staticPath.ts

@@ -1,4 +1,3 @@
-import fs from "node:fs";
 import path from "node:path";
 
 /**
@@ -9,9 +8,13 @@ import path from "node:path";
  * then a NUL check (a truncating byte in a path), then `path.resolve` to collapse the traversal, then
  * containment against the base **with a separator** — without it `/public-secrets` passes a `/public` check.
  *
- * `path.resolve` works on the string and does not follow links, so a symlink inside the tree can still point
- * out of it. Callers check existence after this, so a path that resolves to nothing is handed back and 404s
- * there; only a link that really leads outside is refused.
+ * Symlinks are followed, like nginx and `serve-static` do: `akan sync` builds `public/libs/<lib>` as a link to
+ * `<workspaceRoot>/libs/<lib>/public`, so a link out of the tree is how a lib ships its assets, not an attack.
+ * Refusing those would 404 every lib asset under `akan start` and nothing else — `akan build` copies `public/`
+ * with `dereference: true`, so a built app has no links left to refuse. Traversal is what the string checks
+ * above stop, and they run before any of this touches the filesystem.
+ *
+ * Callers check existence after this, so a path that resolves to nothing is handed back and 404s there.
  */
 export const resolveStaticPath = (baseDir: string, urlPath: string): string | null => {
   let decoded: string;
@@ -27,13 +30,5 @@ export const resolveStaticPath = (baseDir: string, urlPath: string): string | nu
   if (resolved === normalizedBase) return resolved;
   const baseWithSep = normalizedBase.endsWith(path.sep) ? normalizedBase : normalizedBase + path.sep;
   if (!resolved.startsWith(baseWithSep)) return null;
-  try {
-
-    const realBase = fs.realpathSync(normalizedBase);
-    const realBaseWithSep = realBase.endsWith(path.sep) ? realBase : realBase + path.sep;
-    const real = fs.realpathSync(resolved);
-    if (real !== realBase && !real.startsWith(realBaseWithSep)) return null;
-  } catch {
-  }
   return resolved;
 };

package/types/server/staticPath.d.ts

@@ -6,8 +6,12 @@
  * then a NUL check (a truncating byte in a path), then `path.resolve` to collapse the traversal, then
  * containment against the base **with a separator** — without it `/public-secrets` passes a `/public` check.
  *
- * `path.resolve` works on the string and does not follow links, so a symlink inside the tree can still point
- * out of it. Callers check existence after this, so a path that resolves to nothing is handed back and 404s
- * there; only a link that really leads outside is refused.
+ * Symlinks are followed, like nginx and `serve-static` do: `akan sync` builds `public/libs/<lib>` as a link to
+ * `<workspaceRoot>/libs/<lib>/public`, so a link out of the tree is how a lib ships its assets, not an attack.
+ * Refusing those would 404 every lib asset under `akan start` and nothing else — `akan build` copies `public/`
+ * with `dereference: true`, so a built app has no links left to refuse. Traversal is what the string checks
+ * above stop, and they run before any of this touches the filesystem.
+ *
+ * Callers check existence after this, so a path that resolves to nothing is handed back and 404s there.
  */
 export declare const resolveStaticPath: (baseDir: string, urlPath: string) => string | null;