atris 3.72.1 → 3.72.3

package/lib/site.js

@@ -18,13 +18,19 @@ function collectMd(input) {
   const stat = fs.statSync(input);
   if (stat.isFile()) return MD_EXTS.has(path.extname(input)) ? [input] : [];
   const out = [];
+  let realRoot; try { realRoot = fs.realpathSync(input); } catch { return out; }
+  const inside = (p) => p === realRoot || p.startsWith(realRoot + path.sep);
   (function walk(dir) {
     for (const name of fs.readdirSync(dir).sort()) {
       if (name.startsWith('.')) continue;
       const full = path.join(dir, name);
-      let st; try { st = fs.statSync(full); } catch { continue; }
+      // lstat, not stat: symlinks are skipped so a site only ever contains files that live in its folder.
+      let st; try { st = fs.lstatSync(full); } catch { continue; }
+      if (st.isSymbolicLink()) continue;
+      let real; try { real = fs.realpathSync(full); } catch { continue; }
+      if (!inside(real)) continue;
       if (st.isDirectory()) { if (!SKIP_DIRS.has(name)) walk(full); }
-      else if (MD_EXTS.has(path.extname(name))) out.push(full);
+      else if (st.isFile() && MD_EXTS.has(path.extname(name))) out.push(full);
     }
   })(input);
   return out;
@@ -103,6 +109,8 @@ function serveSite(dir, port = 4321) {
     let rel;
     try { rel = decodeURIComponent((req.url || '/').split('?')[0]); }
     catch { res.writeHead(400); res.end('bad request'); return; }
+    // A null byte makes the fs calls below throw synchronously and crash the server.
+    if (rel.includes('\0')) { res.writeHead(400); res.end('bad request'); return; }
     if (rel.endsWith('/')) rel += 'index.html';
     const file = path.normalize(path.join(root, rel));
     // compare against root + separator so a sibling like "site-evil" can't pass for "site"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "atris",
-  "version": "3.72.1",
+  "version": "3.72.3",
   "description": "you say what you want in plain words. atris builds it, checks it, and shows you proof.",
   "main": "bin/atris.js",
   "bin": {