decap-server 3.10.0 → 3.11.0

package/src/middlewares/utils/fs.ts

@@ -1,6 +1,8 @@
 import path from 'path';
 import { promises as fs } from 'fs';
 
+import { resolveExistingRepoPath, resolveNewRepoPath } from './path';
+
 async function listFiles(dir: string, extension: string, depth: number): Promise<string[]> {
   if (depth <= 0) {
     return [];
@@ -28,17 +30,20 @@ export async function listRepoFiles(
   extension: string,
   depth: number,
 ) {
-  const files = await listFiles(path.join(repoPath, folder), extension, depth);
-  return files.map(f => f.slice(repoPath.length + 1));
+  const repoRoot = await fs.realpath(path.resolve(repoPath));
+  const files = await listFiles(await resolveExistingRepoPath(repoRoot, folder), extension, depth);
+  return files.map(f => path.relative(repoRoot, f));
 }
 
-export async function writeFile(filePath: string, content: Buffer | string) {
-  await fs.mkdir(path.dirname(filePath), { recursive: true });
-  await fs.writeFile(filePath, content);
+export async function writeFile(repoPath: string, filePath: string, content: Buffer | string) {
+  const resolvedPath = await resolveNewRepoPath(repoPath, filePath);
+  await fs.mkdir(path.dirname(resolvedPath), { recursive: true });
+  await fs.writeFile(resolvedPath, content);
 }
 
 export async function deleteFile(repoPath: string, filePath: string) {
-  await fs.unlink(path.join(repoPath, filePath)).catch(() => undefined);
+  const resolvedPath = await resolveNewRepoPath(repoPath, filePath);
+  await fs.unlink(resolvedPath).catch(() => undefined);
 }
 
 async function moveFile(from: string, to: string) {
@@ -46,23 +51,29 @@ async function moveFile(from: string, to: string) {
   await fs.rename(from, to);
 }
 
-export async function move(from: string, to: string, hasSubfolders = true) {
+export async function move(repoPath: string, from: string, to: string, hasSubfolders = true) {
+  const resolvedFrom = await resolveExistingRepoPath(repoPath, from);
+  const resolvedTo = await resolveNewRepoPath(repoPath, to);
+
   // move file
-  await moveFile(from, to);
+  await moveFile(resolvedFrom, resolvedTo);
 
   if (hasSubfolders) {
     // Legacy behavior (subfolders: true, default): move all files in the directory
     // This is for collections where all files in a folder represent a single entry
-    const sourceDir = path.dirname(from);
-    const destDir = path.dirname(to);
+    const sourceDir = path.dirname(resolvedFrom);
+    const destDir = path.dirname(resolvedTo);
     const allFiles = await listFiles(sourceDir, '', 100);
     await Promise.all(allFiles.map(file => moveFile(file, file.replace(sourceDir, destDir))));
   }
 }
 
 export async function getUpdateDate(repoPath: string, filePath: string) {
-  return fs
-    .stat(path.join(repoPath, filePath))
-    .then(stat => stat.mtime)
-    .catch(() => new Date());
+  try {
+    return await fs
+      .stat(await resolveExistingRepoPath(repoPath, filePath))
+      .then(stat => stat.mtime);
+  } catch (e) {
+    return new Date();
+  }
 }

package/src/middlewares/utils/path.spec.ts

@@ -0,0 +1,27 @@
+import path from 'path';
+
+import { resolveRepoPath } from './path';
+
+describe('resolveRepoPath', () => {
+  const repoPath = path.resolve('projects', 'repo');
+
+  it('resolves paths within the repository', () => {
+    expect(resolveRepoPath(repoPath, 'content/posts/post.md')).toBe(
+      path.join(repoPath, 'content', 'posts', 'post.md'),
+    );
+  });
+
+  it('rejects sibling paths that share the repository prefix', () => {
+    expect(() => resolveRepoPath(repoPath, path.join('..', 'repo-owned', 'secret.txt'))).toThrow(
+      'Path must resolve under the configured repository',
+    );
+  });
+
+  it('rejects absolute paths outside the repository', () => {
+    const outsidePath = path.resolve(repoPath, '..', 'outside', 'secret.txt');
+
+    expect(() => resolveRepoPath(repoPath, outsidePath)).toThrow(
+      'Path must resolve under the configured repository',
+    );
+  });
+});

package/src/middlewares/utils/path.ts

@@ -0,0 +1,59 @@
+import path from 'path';
+import { promises as fs } from 'fs';
+
+const invalidPathMessage = 'Path must resolve under the configured repository';
+
+function assertPathUnderRoot(repoRoot: string, resolvedPath: string) {
+  const relativePath = path.relative(repoRoot, resolvedPath);
+
+  if (
+    relativePath === '..' ||
+    relativePath.startsWith(`..${path.sep}`) ||
+    path.isAbsolute(relativePath)
+  ) {
+    throw new Error(invalidPathMessage);
+  }
+}
+
+export function resolveRepoPath(repoPath: string, filePath: string) {
+  const repoRoot = path.resolve(repoPath);
+  const resolvedPath = path.resolve(repoRoot, filePath);
+  assertPathUnderRoot(repoRoot, resolvedPath);
+
+  return resolvedPath;
+}
+
+export async function resolveExistingRepoPath(repoPath: string, filePath: string) {
+  const repoRoot = await fs.realpath(path.resolve(repoPath));
+  const resolvedPath = await fs.realpath(resolveRepoPath(repoPath, filePath));
+  assertPathUnderRoot(repoRoot, resolvedPath);
+
+  return resolvedPath;
+}
+
+export async function resolveNewRepoPath(repoPath: string, filePath: string) {
+  const repoRoot = await fs.realpath(path.resolve(repoPath));
+  const resolvedPath = resolveRepoPath(repoPath, filePath);
+  const missingSegments: string[] = [];
+  let existingPath = resolvedPath;
+  let realExistingPath: string | undefined;
+
+  while (!realExistingPath) {
+    try {
+      await fs.lstat(existingPath);
+    } catch (e) {
+      if ((e as NodeJS.ErrnoException).code !== 'ENOENT') {
+        throw e;
+      }
+      missingSegments.unshift(path.basename(existingPath));
+      existingPath = path.dirname(existingPath);
+      continue;
+    }
+
+    realExistingPath = await fs.realpath(existingPath);
+  }
+
+  assertPathUnderRoot(repoRoot, realExistingPath);
+
+  return path.join(realExistingPath, ...missingSegments);
+}