bloby-bot 0.22.2 → 0.22.5

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (2) hide show
  1. package/package.json +1 -1
  2. package/supervisor/index.ts +2 -4
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "bloby-bot",
3
- "version": "0.22.2",
3
+ "version": "0.22.5",
4
4
  "releaseNotes": [
5
5
  "1. testing chrome extension",
6
6
  "2. ",
package/supervisor/index.ts CHANGED
@@ -694,10 +694,8 @@ ${!connected ? '<script>setTimeout(()=>location.reload(),4000)</script>' : ''}
694
694
  // Bloby routes → serve pre-built static files from dist-bloby/
695
695
  // Note: must check '/bloby/' (with slash) to avoid matching '/bloby_tilts.webm' etc.
696
696
  if (req.url === '/bloby' || req.url?.startsWith('/bloby/')) {
697
- // Strip /bloby prefix and resolve file path
698
- let filePath = req.url!.replace(/^\/bloby\/?/, '') || 'bloby.html';
699
- // Strip query strings (e.g. ?v=xxx)
700
- filePath = filePath.split('?')[0];
697
+ // Strip /bloby prefix, then query strings, then resolve file path
698
+ let filePath = req.url!.replace(/^\/bloby\/?/, '').split('?')[0] || 'bloby.html';
701
699
  const fullPath = path.join(DIST_BLOBY, filePath);
702
700
 
703
701
  // Security: prevent directory traversal