boltdocs 1.3.0 → 1.3.1

package/dist/node/index.js

@@ -445,8 +445,18 @@ var import_path2 = __toESM(require("path"));
 var import_github_slugger = __toESM(require("github-slugger"));
 init_utils();
 function parseDocFile(file, docsDir, basePath, config) {
+  const decodedFile = decodeURIComponent(file);
+  const absoluteFile = import_path2.default.resolve(decodedFile);
+  const absoluteDocsDir = import_path2.default.resolve(docsDir);
+  const relativePath = normalizePath(
+    import_path2.default.relative(absoluteDocsDir, absoluteFile)
+  );
+  if (relativePath.startsWith("../") || relativePath === ".." || absoluteFile.includes("\0")) {
+    throw new Error(
+      `Security breach: File is outside of docs directory or contains null bytes: ${file}`
+    );
+  }
   const { data, content } = parseFrontmatter(file);
-  const relativePath = normalizePath(import_path2.default.relative(docsDir, file));
   let parts = relativePath.split("/");
   let locale;
   let version;
@@ -492,25 +502,30 @@ function parseDocFile(file, docsDir, basePath, config) {
     const level = match[1].length;
     const text = match[2].replace(/\[([^\]]+)\]\([^\)]+\)/g, "$1").replace(/[_*`]/g, "").trim();
     const id = slugger.slug(text);
-    headings.push({ level, text, id });
+    headings.push({ level, text: escapeHtml(text), id });
   }
+  const sanitizedTitle = data.title ? escapeHtml(data.title) : inferredTitle;
+  const sanitizedDescription = data.description ? escapeHtml(data.description) : "";
+  const sanitizedBadge = data.badge ? escapeHtml(data.badge) : void 0;
   return {
     route: {
       path: finalPath,
       componentPath: file,
       filePath: relativePath,
-      title: data.title || inferredTitle,
-      description: data.description || "",
+      title: sanitizedTitle,
+      description: sanitizedDescription,
       sidebarPosition,
       headings,
       locale,
       version,
-      badge: data.badge
+      badge: sanitizedBadge
     },
     relativeDir: cleanDirName,
     isGroupIndex,
     groupMeta: isGroupIndex ? {
-      title: data.groupTitle || data.title || (cleanDirName ? capitalize(cleanDirName) : ""),
+      title: escapeHtml(
+        data.groupTitle || data.title || (cleanDirName ? capitalize(cleanDirName) : "")
+      ),
       position: data.groupPosition ?? data.sidebarPosition ?? (rawDirName ? extractNumberPrefix(rawDirName) : void 0)
     } : void 0,
     inferredGroupPosition: rawDirName ? extractNumberPrefix(rawDirName) : void 0

package/dist/node/index.mjs

@@ -30,8 +30,18 @@ function invalidateFile(filePath) {
 import path from "path";
 import GithubSlugger from "github-slugger";
 function parseDocFile(file, docsDir, basePath, config) {
+  const decodedFile = decodeURIComponent(file);
+  const absoluteFile = path.resolve(decodedFile);
+  const absoluteDocsDir = path.resolve(docsDir);
+  const relativePath = normalizePath(
+    path.relative(absoluteDocsDir, absoluteFile)
+  );
+  if (relativePath.startsWith("../") || relativePath === ".." || absoluteFile.includes("\0")) {
+    throw new Error(
+      `Security breach: File is outside of docs directory or contains null bytes: ${file}`
+    );
+  }
   const { data, content } = parseFrontmatter(file);
-  const relativePath = normalizePath(path.relative(docsDir, file));
   let parts = relativePath.split("/");
   let locale;
   let version;
@@ -77,25 +87,30 @@ function parseDocFile(file, docsDir, basePath, config) {
     const level = match[1].length;
     const text = match[2].replace(/\[([^\]]+)\]\([^\)]+\)/g, "$1").replace(/[_*`]/g, "").trim();
     const id = slugger.slug(text);
-    headings.push({ level, text, id });
+    headings.push({ level, text: escapeHtml(text), id });
   }
+  const sanitizedTitle = data.title ? escapeHtml(data.title) : inferredTitle;
+  const sanitizedDescription = data.description ? escapeHtml(data.description) : "";
+  const sanitizedBadge = data.badge ? escapeHtml(data.badge) : void 0;
   return {
     route: {
       path: finalPath,
       componentPath: file,
       filePath: relativePath,
-      title: data.title || inferredTitle,
-      description: data.description || "",
+      title: sanitizedTitle,
+      description: sanitizedDescription,
       sidebarPosition,
       headings,
       locale,
       version,
-      badge: data.badge
+      badge: sanitizedBadge
     },
     relativeDir: cleanDirName,
     isGroupIndex,
     groupMeta: isGroupIndex ? {
-      title: data.groupTitle || data.title || (cleanDirName ? capitalize(cleanDirName) : ""),
+      title: escapeHtml(
+        data.groupTitle || data.title || (cleanDirName ? capitalize(cleanDirName) : "")
+      ),
       position: data.groupPosition ?? data.sidebarPosition ?? (rawDirName ? extractNumberPrefix(rawDirName) : void 0)
     } : void 0,
     inferredGroupPosition: rawDirName ? extractNumberPrefix(rawDirName) : void 0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "boltdocs",
-  "version": "1.3.0",
+  "version": "1.3.1",
   "description": "A lightweight documentation generator for React projects.",
   "main": "dist/node/index.js",
   "module": "dist/node/index.mjs",