cloudcmd 19.20.1 → 19.20.2

package/ChangeLog

@@ -1,3 +1,8 @@
+2026.08.25, v19.20.2
+
+fix:
+- b9bdc9ed path traversal (#474)
+
 2026.08.23, v19.20.1
 
 feature:

package/HELP.md

@@ -1,4 +1,4 @@
-# Cloud Commander v19.20.1
+# Cloud Commander v19.20.2
 
 ### [Main][MainURL] [Blog][BlogURL] [Demo][DemoURL] [Deploy](#deploy)
 
@@ -1122,6 +1122,7 @@ There are a lot of ways to be involved in `Cloud Commander` development:
 
 ## Version history
 
+- *2026.08.25*, **[v19.20.2](//github.com/coderaiser/cloudcmd/releases/tag/v19.20.2)**
 - *2026.08.23*, **[v19.20.1](//github.com/coderaiser/cloudcmd/releases/tag/v19.20.1)**
 - *2026.08.06*, **[v19.20.0](//github.com/coderaiser/cloudcmd/releases/tag/v19.20.0)**
 - *2026.06.15*, **[v19.19.1](//github.com/coderaiser/cloudcmd/releases/tag/v19.19.1)**

package/README.md

@@ -1,4 +1,4 @@
-# Cloud Commander v19.20.1 [![Build Status][BuildStatusIMGURL]][BuildStatusURL] [![Codacy][CodacyIMG]][CodacyURL] [![Gitter][GitterIMGURL]][GitterURL] [![Deploy on InstaPods][DeployInstaPodsIMG]][DeployInstaPodsURL]
+# Cloud Commander v19.20.2 [![Build Status][BuildStatusIMGURL]][BuildStatusURL] [![Codacy][CodacyIMG]][CodacyURL] [![Gitter][GitterIMGURL]][GitterURL] [![Deploy on InstaPods][DeployInstaPodsIMG]][DeployInstaPodsURL]
 
 ### [Main][MainURL] [Blog][BlogURL] [Support][SupportURL] [Demo][DemoURL]
 

package/dist/sw.js

@@ -302,7 +302,7 @@ const respondWith = currify((f, e) => {
   e.respondWith(f(e));
 });
 const getPathName = url => new URL(url).pathname;
-const date = "Sun Aug 23 2026 10:54:37 GMT+0300 (Eastern European Summer Time)";
+const date = "Tue Aug 25 2026 13:17:11 GMT+0300 (Eastern European Summer Time)";
 const NAME = `cloudcmd: ${date}`;
 const createRequest = a => new Request(a, {
   credentials: 'same-origin'

package/dist-dev/cloudcmd.common.js

@@ -32,7 +32,7 @@ eval("{\n\nconst identityLoginURL = 'static.olark.com/jsclient/loader.js';\n\nif
   \************************/
 (__unused_rspack_module, __webpack_exports__, __webpack_require__) {
 "use strict";
-eval("{__webpack_require__.r(__webpack_exports__);\n// extracted by css-extract-rspack-plugin\n\n\n//# sourceURL=file://cloudcmd//Users/coderaiser/cloudcmd/css/terminal.css\n}");
+eval("{__webpack_require__.r(__webpack_exports__);\n// extracted by css-extract-rspack-plugin\n\n\n//# sourceURL=file://cloudcmd//Users/coderaiser/cloudcmd/css/config.css\n}");
 
 },
 "./css/main.css"
@@ -41,7 +41,7 @@ eval("{__webpack_require__.r(__webpack_exports__);\n// extracted by css-extract-
   \**********************/
 (__unused_rspack_module, __webpack_exports__, __webpack_require__) {
 "use strict";
-eval("{__webpack_require__.r(__webpack_exports__);\n// extracted by css-extract-rspack-plugin\n\n\n//# sourceURL=file://cloudcmd//Users/coderaiser/cloudcmd/css/terminal.css\n}");
+eval("{__webpack_require__.r(__webpack_exports__);\n// extracted by css-extract-rspack-plugin\n\n\n//# sourceURL=file://cloudcmd//Users/coderaiser/cloudcmd/css/config.css\n}");
 
 },
 "./css/terminal.css"
@@ -50,7 +50,7 @@ eval("{__webpack_require__.r(__webpack_exports__);\n// extracted by css-extract-
   \**************************/
 (__unused_rspack_module, __webpack_exports__, __webpack_require__) {
 "use strict";
-eval("{__webpack_require__.r(__webpack_exports__);\n// extracted by css-extract-rspack-plugin\n\n\n//# sourceURL=file://cloudcmd//Users/coderaiser/cloudcmd/css/terminal.css\n}");
+eval("{__webpack_require__.r(__webpack_exports__);\n// extracted by css-extract-rspack-plugin\n\n\n//# sourceURL=file://cloudcmd//Users/coderaiser/cloudcmd/css/config.css\n}");
 
 },
 "./css/user-menu.css"
@@ -59,7 +59,7 @@ eval("{__webpack_require__.r(__webpack_exports__);\n// extracted by css-extract-
   \***************************/
 (__unused_rspack_module, __webpack_exports__, __webpack_require__) {
 "use strict";
-eval("{__webpack_require__.r(__webpack_exports__);\n// extracted by css-extract-rspack-plugin\n\n\n//# sourceURL=file://cloudcmd//Users/coderaiser/cloudcmd/css/terminal.css\n}");
+eval("{__webpack_require__.r(__webpack_exports__);\n// extracted by css-extract-rspack-plugin\n\n\n//# sourceURL=file://cloudcmd//Users/coderaiser/cloudcmd/css/config.css\n}");
 
 },
 "./css/view.css"
@@ -68,7 +68,7 @@ eval("{__webpack_require__.r(__webpack_exports__);\n// extracted by css-extract-
   \**********************/
 (__unused_rspack_module, __webpack_exports__, __webpack_require__) {
 "use strict";
-eval("{__webpack_require__.r(__webpack_exports__);\n// extracted by css-extract-rspack-plugin\n\n\n//# sourceURL=file://cloudcmd//Users/coderaiser/cloudcmd/css/terminal.css\n}");
+eval("{__webpack_require__.r(__webpack_exports__);\n// extracted by css-extract-rspack-plugin\n\n\n//# sourceURL=file://cloudcmd//Users/coderaiser/cloudcmd/css/config.css\n}");
 
 },
 "./node_modules/@cloudcmd/modal/css/modal.css"
@@ -77,7 +77,7 @@ eval("{__webpack_require__.r(__webpack_exports__);\n// extracted by css-extract-
   \****************************************************/
 (__unused_rspack_module, __webpack_exports__, __webpack_require__) {
 "use strict";
-eval("{__webpack_require__.r(__webpack_exports__);\n// extracted by css-extract-rspack-plugin\n\n\n//# sourceURL=file://cloudcmd//Users/coderaiser/cloudcmd/css/terminal.css\n}");
+eval("{__webpack_require__.r(__webpack_exports__);\n// extracted by css-extract-rspack-plugin\n\n\n//# sourceURL=file://cloudcmd//Users/coderaiser/cloudcmd/css/config.css\n}");
 
 },
 "./node_modules/smalltalk/css/smalltalk.css"
@@ -86,7 +86,7 @@ eval("{__webpack_require__.r(__webpack_exports__);\n// extracted by css-extract-
   \**************************************************/
 (__unused_rspack_module, __webpack_exports__, __webpack_require__) {
 "use strict";
-eval("{__webpack_require__.r(__webpack_exports__);\n// extracted by css-extract-rspack-plugin\n\n\n//# sourceURL=file://cloudcmd//Users/coderaiser/cloudcmd/css/terminal.css\n}");
+eval("{__webpack_require__.r(__webpack_exports__);\n// extracted by css-extract-rspack-plugin\n\n\n//# sourceURL=file://cloudcmd//Users/coderaiser/cloudcmd/css/config.css\n}");
 
 },
 "./node_modules/supermenu/css/supermenu.css"
@@ -95,7 +95,7 @@ eval("{__webpack_require__.r(__webpack_exports__);\n// extracted by css-extract-
   \**************************************************/
 (__unused_rspack_module, __webpack_exports__, __webpack_require__) {
 "use strict";
-eval("{__webpack_require__.r(__webpack_exports__);\n// extracted by css-extract-rspack-plugin\n\n\n//# sourceURL=file://cloudcmd//Users/coderaiser/cloudcmd/css/terminal.css\n}");
+eval("{__webpack_require__.r(__webpack_exports__);\n// extracted by css-extract-rspack-plugin\n\n\n//# sourceURL=file://cloudcmd//Users/coderaiser/cloudcmd/css/config.css\n}");
 
 },
 "./node_modules/apart/lib/apart.js"

package/dist-dev/sw.js

@@ -23,7 +23,7 @@ eval("{// shim for using process in browser\nvar process = module.exports = {};\
   \*************************/
 (__unused_rspack___webpack_module__, __webpack_exports__, __webpack_require__) {
 "use strict";
-eval("{__webpack_require__.r(__webpack_exports__);\n/* import */ var node_process__rspack_import_0 = __webpack_require__(/*! node:process */ \"./node_modules/process/browser.js\");\n/* import */ var try_to_catch__rspack_import_1 = __webpack_require__(/*! try-to-catch */ \"./node_modules/try-to-catch/lib/try-to-catch.js\");\n/* import */ var currify__rspack_import_2 = __webpack_require__(/*! currify */ \"./node_modules/currify/lib/currify.js\");\n\n\n\nconst isDev = \"development\" === 'development';\nconst isGet = a => a.method === 'GET';\nconst isBasic = a => a.type === 'basic';\nconst wait = currify__rspack_import_2((f, e) => e.waitUntil(f()));\nconst respondWith = currify__rspack_import_2((f, e) => {\n  const {\n    request\n  } = e;\n  const {\n    url\n  } = request;\n  const pathname = getPathName(url);\n  if (url.endsWith('/') || /\\^\\/fs/.test(pathname)) return;\n  if (!isGet(request)) return;\n  if (!isBasic(request)) return;\n  if (pathname.startsWith('/api')) return;\n  if (/^socket.io/.test(pathname)) return;\n  e.respondWith(f(e));\n});\nconst getPathName = url => new URL(url).pathname;\nconst date = \"Sun Aug 23 2026 10:54:38 GMT+0300 (Eastern European Summer Time)\";\nconst NAME = `cloudcmd: ${date}`;\nconst createRequest = a => new Request(a, {\n  credentials: 'same-origin'\n});\nconst getRequest = (a, request) => {\n  if (a !== '/') return request;\n  return createRequest('/');\n};\nglobalThis.addEventListener('install', wait(onInstall));\nglobalThis.addEventListener('fetch', respondWith(onFetch));\nglobalThis.addEventListener('activate', wait(onActivate));\nasync function onActivate() {\n  console.info(`cloudcmd: sw: activate: ${NAME}`);\n  await globalThis.clients.claim();\n  const keys = await caches.keys();\n  const deleteCache = caches.delete.bind(caches);\n  await Promise.all(keys.map(deleteCache));\n}\nasync function onInstall() {\n  console.info(`cloudcmd: sw: install: ${NAME}`);\n  await globalThis.skipWaiting();\n}\nasync function onFetch(event) {\n  const {\n    request\n  } = event;\n  const {\n    url\n  } = request;\n  const pathname = getPathName(url);\n  const newRequest = getRequest(pathname, event.request);\n  const cache = await caches.open(NAME);\n  const response = await cache.match(request);\n  if (!isDev && response) return response;\n  const [e, resp] = await (0,try_to_catch__rspack_import_1.tryToCatch)(fetch, newRequest, {\n    credentials: 'same-origin'\n  });\n  if (e) return new Response(e.message);\n  await addToCache(request, resp.clone());\n  return resp;\n}\nasync function addToCache(request, response) {\n  const cache = await caches.open(NAME);\n  return cache.put(request, response);\n}\n\n//# sourceURL=file://cloudcmd//Users/coderaiser/cloudcmd/client/sw/sw.js\n}");
+eval("{__webpack_require__.r(__webpack_exports__);\n/* import */ var node_process__rspack_import_0 = __webpack_require__(/*! node:process */ \"./node_modules/process/browser.js\");\n/* import */ var try_to_catch__rspack_import_1 = __webpack_require__(/*! try-to-catch */ \"./node_modules/try-to-catch/lib/try-to-catch.js\");\n/* import */ var currify__rspack_import_2 = __webpack_require__(/*! currify */ \"./node_modules/currify/lib/currify.js\");\n\n\n\nconst isDev = \"development\" === 'development';\nconst isGet = a => a.method === 'GET';\nconst isBasic = a => a.type === 'basic';\nconst wait = currify__rspack_import_2((f, e) => e.waitUntil(f()));\nconst respondWith = currify__rspack_import_2((f, e) => {\n  const {\n    request\n  } = e;\n  const {\n    url\n  } = request;\n  const pathname = getPathName(url);\n  if (url.endsWith('/') || /\\^\\/fs/.test(pathname)) return;\n  if (!isGet(request)) return;\n  if (!isBasic(request)) return;\n  if (pathname.startsWith('/api')) return;\n  if (/^socket.io/.test(pathname)) return;\n  e.respondWith(f(e));\n});\nconst getPathName = url => new URL(url).pathname;\nconst date = \"Tue Aug 25 2026 13:17:11 GMT+0300 (Eastern European Summer Time)\";\nconst NAME = `cloudcmd: ${date}`;\nconst createRequest = a => new Request(a, {\n  credentials: 'same-origin'\n});\nconst getRequest = (a, request) => {\n  if (a !== '/') return request;\n  return createRequest('/');\n};\nglobalThis.addEventListener('install', wait(onInstall));\nglobalThis.addEventListener('fetch', respondWith(onFetch));\nglobalThis.addEventListener('activate', wait(onActivate));\nasync function onActivate() {\n  console.info(`cloudcmd: sw: activate: ${NAME}`);\n  await globalThis.clients.claim();\n  const keys = await caches.keys();\n  const deleteCache = caches.delete.bind(caches);\n  await Promise.all(keys.map(deleteCache));\n}\nasync function onInstall() {\n  console.info(`cloudcmd: sw: install: ${NAME}`);\n  await globalThis.skipWaiting();\n}\nasync function onFetch(event) {\n  const {\n    request\n  } = event;\n  const {\n    url\n  } = request;\n  const pathname = getPathName(url);\n  const newRequest = getRequest(pathname, event.request);\n  const cache = await caches.open(NAME);\n  const response = await cache.match(request);\n  if (!isDev && response) return response;\n  const [e, resp] = await (0,try_to_catch__rspack_import_1.tryToCatch)(fetch, newRequest, {\n    credentials: 'same-origin'\n  });\n  if (e) return new Response(e.message);\n  await addToCache(request, resp.clone());\n  return resp;\n}\nasync function addToCache(request, response) {\n  const cache = await caches.open(NAME);\n  return cache.put(request, response);\n}\n\n//# sourceURL=file://cloudcmd//Users/coderaiser/cloudcmd/client/sw/sw.js\n}");
 
 },
 "./node_modules/try-to-catch/lib/try-to-catch.js"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cloudcmd",
-  "version": "19.20.1",
+  "version": "19.20.2",
   "type": "module",
   "author": "coderaiser <mnemonic.enemy@gmail.com> (https://github.com/coderaiser)",
   "description": "File manager for the web with console and editor",

package/server/markdown/index.js

@@ -32,9 +32,9 @@ function parseName(query, name, rootDir) {
     const shortName = name.replace('/markdown', '');
     
     if (query === 'relative')
-        return DIR_ROOT + shortName;
+        return root.resolve(shortName, DIR_ROOT);
     
-    return root(shortName, rootDir);
+    return root.resolve(shortName, rootDir);
 }
 
 async function onGET(request, name, root) {

package/server/rest/index.js

@@ -11,6 +11,7 @@ import json from 'jonny';
 import * as ponse from 'ponse';
 import {copymitter} from 'copymitter';
 import {moveFiles as _moveFiles} from '@cloudcmd/move-files';
+import {tryCatch} from 'try-catch';
 import * as CloudFunc from '#common/cloudfunc';
 import root from '../root.js';
 import markdown from '../markdown/index.js';
@@ -216,8 +217,15 @@ function onPUT({name, fs, moveFiles, config, body}, callback) {
         const msg = getMoveMsg(names);
         const fn = swap(callback, msg);
         
-        const fromRooted = root(from, rootDir);
-        const toRooted = root(to, rootDir);
+        const [errorFrom, fromRooted] = tryCatch(root.resolve, from, rootDir);
+        
+        if (errorFrom)
+            return callback(errorFrom);
+        
+        const [errorTo, toRooted] = tryCatch(root.resolve, to, rootDir);
+        
+        if (errorTo)
+            return callback(errorTo);
         
         return moveFiles(fromRooted, toRooted, names)
             .on('error', fn)
@@ -227,21 +235,32 @@ function onPUT({name, fs, moveFiles, config, body}, callback) {
     case 'rename':
         return rename(rootDir, files.from, files.to, fs, callback);
     
-    case 'copy':
+    case 'copy': {
         if (!files.from || !files.names || !files.to)
             return callback(body);
         
         if (isRootAll(rootDir, [files.to, files.from]))
             return callback(getWin32RootMsg());
         
-        files.from = root(files.from, rootDir);
-        files.to = root(files.to, rootDir);
+        const [errorFrom, resolvedFrom] = tryCatch(root.resolve, files.from, rootDir);
+        
+        if (errorFrom)
+            return callback(errorFrom);
+        
+        const [errorTo, resolvedTo] = tryCatch(root.resolve, files.to, rootDir);
+        
+        if (errorTo)
+            return callback(errorTo);
+        
+        files.from = resolvedFrom;
+        files.to = resolvedTo;
         
         copy(files.from, files.to, files.names, (error) => {
             const msg = formatMsg('copy', files.names);
             callback(error, msg);
         });
         break;
+    }
     
     case 'pack':
         if (!files.from)
@@ -274,8 +293,15 @@ function rename(rootDir, from, to, fs, callback) {
     const msg = getRenameMsg(from, to);
     const fn = swap(callback, msg);
     
-    const fromRooted = root(from, rootDir);
-    const toRooted = root(to, rootDir);
+    const [errorFrom, fromRooted] = tryCatch(root.resolve, from, rootDir);
+    
+    if (errorFrom)
+        return callback(errorFrom);
+    
+    const [errorTo, toRooted] = tryCatch(root.resolve, to, rootDir);
+    
+    if (errorTo)
+        return callback(errorTo);
     
     return fs.rename(fromRooted, toRooted, fn);
 }
@@ -286,8 +312,18 @@ function pack(from, to, names, config, fn) {
     const rootDir = config('root');
     const packer = config('packer');
     
-    from = root(from, rootDir);
-    to = root(to, rootDir);
+    const [errorFrom, resolvedFrom] = tryCatch(root.resolve, from, rootDir);
+    
+    if (errorFrom)
+        return fn(errorFrom);
+    
+    const [errorTo, resolvedTo] = tryCatch(root.resolve, to, rootDir);
+    
+    if (errorTo)
+        return fn(errorTo);
+    
+    from = resolvedFrom;
+    to = resolvedTo;
     
     if (!names) {
         names = [
@@ -305,12 +341,23 @@ export const _pack = pack;
 function extract(from, to, config, fn) {
     const rootDir = config('root');
     
-    from = root(from, rootDir);
+    const [errorFrom, resolvedFrom] = tryCatch(root.resolve, from, rootDir);
     
-    if (to)
-        to = root(to, rootDir);
-    else
+    if (errorFrom)
+        return fn(errorFrom);
+    
+    from = resolvedFrom;
+    
+    if (to) {
+        const [errorTo, resolvedTo] = tryCatch(root.resolve, to, rootDir);
+        
+        if (errorTo)
+            return fn(errorTo);
+        
+        to = resolvedTo;
+    } else {
         to = from.replace(/\.tar\.gz$/, '');
+    }
     
     operation('extract', config('packer'), from, to, fn);
 }

package/server/root.js

@@ -1,5 +1,20 @@
+import path from 'node:path';
 import mellow from 'mellow';
 
-export default (dir, root, {webToWin = mellow.webToWin} = {}) => {
+const rootFn = (dir, root, {webToWin = mellow.webToWin} = {}) => {
     return webToWin(dir, root || '/');
 };
+
+rootFn.resolve = (dir, rootDir) => {
+    const normalizedRoot = path.normalize(rootDir);
+    const resolved = rootFn(dir, normalizedRoot);
+    
+    const sep = normalizedRoot.endsWith(path.sep) ? '' : path.sep;
+    
+    if (resolved !== normalizedRoot && !resolved.startsWith(normalizedRoot + sep))
+        throw Error(`Path ${resolved} beyond root ${normalizedRoot}!`);
+    
+    return resolved;
+};
+
+export default rootFn;