datacontract-editor 0.1.11 → 0.1.12

package/README.md

@@ -92,12 +92,10 @@ docker run -d -p 4173:4173 \
 
 ### Data Contract CLI
 
-Coming soon!
-
 You can start the editor from the Data Contract CLI:
 
 ```
-datacontract editor datacontract.yaml
+datacontract edit datacontract.yaml
 ```
 
 

package/bin/datacontract-editor.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 
 import { createServer } from 'http';
-import { readFileSync, writeFileSync, existsSync } from 'fs';
+import { readFileSync, writeFileSync, existsSync, readdirSync } from 'fs';
 import { join, extname, resolve, basename } from 'path';
 import { fileURLToPath } from 'url';
 import { createRequire } from 'module';
@@ -111,7 +111,7 @@ async function findPort(start = 9090) {
 
   return new Promise((resolve) => {
     const server = net.createServer();
-    server.listen(start, () => {
+    server.listen(start, '127.0.0.1', () => {
       const port = server.address().port;
       server.close(() => resolve(port));
     });
@@ -123,13 +123,52 @@ async function findPort(start = 9090) {
 
 // Helper to send JSON response
 function sendJson(res, statusCode, data) {
-  res.writeHead(statusCode, {
-    'Content-Type': 'application/json',
-    'Access-Control-Allow-Origin': '*'
-  });
+  res.writeHead(statusCode, { 'Content-Type': 'application/json' });
   res.end(JSON.stringify(data));
 }
 
+// Index every file under dist/ once at startup, keyed by the URL path it is
+// served at. Requests then only ever look up a key in this map: the paths handed
+// to the filesystem come from readdirSync, never from the request, so a request
+// path cannot address a file outside dist/ no matter how it is encoded.
+function indexDistFiles(dir, urlPrefix = '') {
+  const files = new Map();
+
+  for (const entry of readdirSync(dir, { withFileTypes: true })) {
+    const urlPath = `${urlPrefix}/${entry.name}`;
+    if (entry.isDirectory()) {
+      for (const [key, value] of indexDistFiles(join(dir, entry.name), urlPath)) {
+        files.set(key, value);
+      }
+    } else if (entry.isFile()) {
+      files.set(urlPath, join(dir, entry.name));
+    }
+  }
+
+  return files;
+}
+
+// dist/ is a build artifact and does not change while the server runs.
+const distFiles = indexDistFiles(distDir);
+
+// Turn a request path into a lookup key. Returns null when the percent-encoding
+// is malformed, which simply means no file will match.
+function toLookupKey(url) {
+  try {
+    return decodeURIComponent(url);
+  } catch {
+    return null;
+  }
+}
+
+// The server is only ever meant to be reached by a browser on this machine.
+// Requiring a loopback Host blocks DNS rebinding, where a page on an attacker
+// domain resolves that domain to 127.0.0.1 and then talks to us same-origin.
+function isLocalRequest(req) {
+  const host = (req.headers.host || '').replace(/:\d+$/, '').replace(/^\[|\]$/g, '');
+  return host === 'localhost' || host === '127.0.0.1' || host === '::1';
+}
+
 // Helper to read request body
 function readBody(req) {
   return new Promise((resolve, reject) => {
@@ -144,6 +183,13 @@ function readBody(req) {
 function generateCliIndexHtml() {
   const baseHtml = readFileSync(indexPath, 'utf-8');
 
+  // The filename comes from argv and can contain quotes or '</script>', so every
+  // injection point below goes through JSON.stringify rather than raw
+  // interpolation. encodeURIComponent alone is not enough: it leaves apostrophes
+  // untouched, which is enough to break out of a single-quoted string literal.
+  const fileUrl = JSON.stringify('/api/files/' + encodeURIComponent(targetFileName));
+  const fileNameLiteral = JSON.stringify(targetFileName);
+
   // Replace the init call with CLI-specific configuration
   const cliInitScript = `
       import { init } from './datacontract-editor.es.js';
@@ -152,7 +198,7 @@ function generateCliIndexHtml() {
       async function initCli() {
         try {
           // Fetch the file content from CLI server
-          const response = await fetch('/api/files/${encodeURIComponent(targetFileName)}');
+          const response = await fetch(${fileUrl});
           if (!response.ok) {
             throw new Error('Failed to load file: ' + response.statusText);
           }
@@ -165,7 +211,7 @@ function generateCliIndexHtml() {
             persistence: 'none',
             initialView: 'form',
             onSave: async (yamlContent) => {
-              const saveResponse = await fetch('/api/files/${encodeURIComponent(targetFileName)}', {
+              const saveResponse = await fetch(${fileUrl}, {
                 method: 'PUT',
                 headers: { 'Content-Type': 'text/yaml' },
                 body: yamlContent
@@ -177,7 +223,7 @@ function generateCliIndexHtml() {
             }
           });
 
-          console.log('CLI mode: Loaded ${targetFileName}');
+          console.log('CLI mode: Loaded ' + ${fileNameLiteral});
         } catch (error) {
           console.error('Failed to initialize CLI mode:', error);
           alert('Failed to load file: ' + error.message);
@@ -201,13 +247,17 @@ const server = createServer(async (req, res) => {
   let url = req.url.split('?')[0]; // Remove query string
   const method = req.method;
 
-  // Handle CORS preflight
+  if (!isLocalRequest(req)) {
+    res.writeHead(403);
+    res.end('Forbidden');
+    return;
+  }
+
+  // The editor is served from this same origin, so it never needs CORS. Not
+  // answering preflights is what stops another site from PUTing over the file
+  // being edited.
   if (method === 'OPTIONS') {
-    res.writeHead(204, {
-      'Access-Control-Allow-Origin': '*',
-      'Access-Control-Allow-Methods': 'GET, PUT, POST, OPTIONS',
-      'Access-Control-Allow-Headers': 'Content-Type'
-    });
+    res.writeHead(204);
     res.end();
     return;
   }
@@ -264,10 +314,7 @@ const server = createServer(async (req, res) => {
       if (method === 'GET') {
         try {
           const content = readFileSync(targetFilePath, 'utf-8');
-          res.writeHead(200, {
-            'Content-Type': 'text/yaml',
-            'Access-Control-Allow-Origin': '*'
-          });
+          res.writeHead(200, { 'Content-Type': 'text/yaml' });
           res.end(content);
         } catch (err) {
           sendJson(res, 500, { error: 'Failed to read file', details: err.message });
@@ -298,16 +345,11 @@ const server = createServer(async (req, res) => {
     url = '/index.html';
   }
 
-  let filePath = join(distDir, url);
-  const ext = extname(filePath).toLowerCase();
-
-  // If no extension, serve index.html (SPA routing)
-  if (!ext && !existsSync(filePath)) {
-    filePath = indexPath;
-  }
+  // Serve a known file from dist/, or fall back to index.html for SPA routes
+  const lookupKey = toLookupKey(url);
+  const filePath = lookupKey === null ? undefined : distFiles.get(lookupKey);
 
-  // Try to serve the file
-  if (existsSync(filePath)) {
+  if (filePath) {
     try {
       const content = readFileSync(filePath);
       const contentType = mimeTypes[extname(filePath).toLowerCase()] || 'application/octet-stream';
@@ -335,7 +377,9 @@ async function start() {
   const port = requestedPort || await findPort(9090);
   const url = `http://localhost:${port}`;
 
-  server.listen(port, async () => {
+  // Bind to loopback only: this server exposes local files and has no auth,
+  // so it must not be reachable from the network.
+  server.listen(port, '127.0.0.1', async () => {
     console.log(`
   datacontract-editor v${pkg.version}