atris 3.72.2 → 3.72.4

package/lib/site.js

@@ -18,13 +18,19 @@ function collectMd(input) {
   const stat = fs.statSync(input);
   if (stat.isFile()) return MD_EXTS.has(path.extname(input)) ? [input] : [];
   const out = [];
+  let realRoot; try { realRoot = fs.realpathSync(input); } catch { return out; }
+  const inside = (p) => p === realRoot || p.startsWith(realRoot + path.sep);
   (function walk(dir) {
     for (const name of fs.readdirSync(dir).sort()) {
       if (name.startsWith('.')) continue;
       const full = path.join(dir, name);
-      let st; try { st = fs.statSync(full); } catch { continue; }
+      // lstat, not stat: symlinks are skipped so a site only ever contains files that live in its folder.
+      let st; try { st = fs.lstatSync(full); } catch { continue; }
+      if (st.isSymbolicLink()) continue;
+      let real; try { real = fs.realpathSync(full); } catch { continue; }
+      if (!inside(real)) continue;
       if (st.isDirectory()) { if (!SKIP_DIRS.has(name)) walk(full); }
-      else if (MD_EXTS.has(path.extname(name))) out.push(full);
+      else if (st.isFile() && MD_EXTS.has(path.extname(name))) out.push(full);
     }
   })(input);
   return out;
@@ -100,6 +106,11 @@ function serveSite(dir, port = 4321) {
   let realRoot = root;
   try { realRoot = fs.realpathSync(root); } catch { /* missing folder: every request 404s */ }
   const server = http.createServer((req, res) => {
+    // Only answer requests addressed to this computer, so another website cannot
+    // reach the preview by pointing its own name at 127.0.0.1.
+    const port = server.address() && server.address().port;
+    const host = String(req.headers.host || '').toLowerCase();
+    if (![`127.0.0.1:${port}`, `localhost:${port}`, `[::1]:${port}`].includes(host)) { res.writeHead(403); res.end('forbidden'); return; }
     let rel;
     try { rel = decodeURIComponent((req.url || '/').split('?')[0]); }
     catch { res.writeHead(400); res.end('bad request'); return; }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "atris",
-  "version": "3.72.2",
+  "version": "3.72.4",
   "description": "you say what you want in plain words. atris builds it, checks it, and shows you proof.",
   "main": "bin/atris.js",
   "bin": {