create-kide-app 0.0.26 → 0.0.28

package/index.js

@@ -291,8 +291,8 @@ async function main() {
       s.stop("Demo content seeded");
     } catch (err) {
       s.stop("Seeding failed — run `pnpm cms:seed` manually");
-      if (err.stderr) console.error(err.stderr.toString().slice(-1500));
-      if (err.stdout) console.error(err.stdout.toString().slice(-1500));
+      if (err.stderr) console.error(err.stderr.toString());
+      if (err.stdout) console.error(err.stdout.toString());
     }
   } else if (seedDemo && target === "cloudflare") {
     p.note(

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-kide-app",
-  "version": "0.0.26",
+  "version": "0.0.28",
   "description": "Scaffold a new Kide CMS project",
   "author": "Matti Hernesniemi",
   "license": "MIT",

package/templates/base/src/cms/adapters/storage.ts

@@ -4,8 +4,17 @@ import path from "node:path";
 
 const publicDir = path.join(process.cwd(), "public");
 
+// Resolve storagePath safely under publicDir, rejecting any traversal attempts
+function safeResolve(storagePath: string): string {
+  const resolved = path.resolve(publicDir, storagePath.replace(/^\/+/, ""));
+  if (!resolved.startsWith(publicDir + path.sep) && resolved !== publicDir) {
+    throw new Error(`Invalid storage path: ${storagePath}`);
+  }
+  return resolved;
+}
+
 export async function putFile(storagePath: string, data: ArrayBuffer | Uint8Array): Promise<void> {
-  const filePath = path.join(publicDir, storagePath);
+  const filePath = safeResolve(storagePath);
   const dir = path.dirname(filePath);
   if (!existsSync(dir)) mkdirSync(dir, { recursive: true });
   const buffer = data instanceof Uint8Array ? data : new Uint8Array(data);
@@ -13,14 +22,14 @@ export async function putFile(storagePath: string, data: ArrayBuffer | Uint8Arra
 }
 
 export async function getFile(storagePath: string): Promise<ArrayBuffer | null> {
-  const filePath = path.join(publicDir, storagePath);
+  const filePath = safeResolve(storagePath);
   if (!existsSync(filePath)) return null;
   const buffer = await readFile(filePath);
   return buffer.buffer.slice(buffer.byteOffset, buffer.byteOffset + buffer.byteLength);
 }
 
 export async function deleteFile(storagePath: string): Promise<void> {
-  const filePath = path.join(publicDir, storagePath);
+  const filePath = safeResolve(storagePath);
   try {
     await unlink(filePath);
   } catch {

package/templates/local/drizzle.config.ts

@@ -1,3 +1,4 @@
+import path from "node:path";
 import { defineConfig } from "drizzle-kit";
 
 export default defineConfig({
@@ -5,6 +6,6 @@ export default defineConfig({
   out: "./src/cms/migrations",
   dialect: "sqlite",
   dbCredentials: {
-    url: process.env.CMS_DATABASE_URL ?? "file:./data/cms.db",
+    url: process.env.CMS_DATABASE_URL ?? `file:${path.resolve("./data/cms.db")}`,
   },
 });