atris 3.72.2 → 3.72.3

package/lib/site.js

@@ -18,13 +18,19 @@ function collectMd(input) {
   const stat = fs.statSync(input);
   if (stat.isFile()) return MD_EXTS.has(path.extname(input)) ? [input] : [];
   const out = [];
+  let realRoot; try { realRoot = fs.realpathSync(input); } catch { return out; }
+  const inside = (p) => p === realRoot || p.startsWith(realRoot + path.sep);
   (function walk(dir) {
     for (const name of fs.readdirSync(dir).sort()) {
       if (name.startsWith('.')) continue;
       const full = path.join(dir, name);
-      let st; try { st = fs.statSync(full); } catch { continue; }
+      // lstat, not stat: symlinks are skipped so a site only ever contains files that live in its folder.
+      let st; try { st = fs.lstatSync(full); } catch { continue; }
+      if (st.isSymbolicLink()) continue;
+      let real; try { real = fs.realpathSync(full); } catch { continue; }
+      if (!inside(real)) continue;
       if (st.isDirectory()) { if (!SKIP_DIRS.has(name)) walk(full); }
-      else if (MD_EXTS.has(path.extname(name))) out.push(full);
+      else if (st.isFile() && MD_EXTS.has(path.extname(name))) out.push(full);
     }
   })(input);
   return out;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "atris",
-  "version": "3.72.2",
+  "version": "3.72.3",
   "description": "you say what you want in plain words. atris builds it, checks it, and shows you proof.",
   "main": "bin/atris.js",
   "bin": {