diffx-cli 0.7.1 → 0.8.1

package/dist/cli.mjs

@@ -1,15 +1,30 @@
 #!/usr/bin/env node
 import { parseArgs } from "node:util";
 import { fileURLToPath } from "node:url";
-import { basename, dirname, extname, join, resolve } from "node:path";
+import { basename, dirname, extname, isAbsolute, join, resolve } from "node:path";
 import { mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import getPort from "get-port";
-import { execSync } from "node:child_process";
+import { execFileSync } from "node:child_process";
 import { parseSync } from "editorconfig";
 import { readFile } from "node:fs/promises";
 import { Hono } from "hono";
 import { serve } from "@hono/node-server";
 import { homedir } from "node:os";
+//#region src/path.ts
+function decodeAndNormalize(p) {
+	let decoded = p;
+	try {
+		decoded = decodeURIComponent(p);
+	} catch {}
+	return decoded.replace(/\\/g, "/");
+}
+function isSafePath(relativePath, baseDir) {
+	const normalized = decodeAndNormalize(relativePath);
+	if (normalized.includes("..") || normalized.includes("\0") || isAbsolute(normalized)) return false;
+	const resolved = resolve(baseDir, normalized);
+	return resolved.startsWith(resolve(baseDir) + "/") || resolved === resolve(baseDir);
+}
+//#endregion
 //#region src/git.ts
 function isBinaryFile(absolutePath) {
 	try {
@@ -23,57 +38,59 @@ function isBinaryFile(absolutePath) {
 }
 function getFileContent(filePath, version) {
 	const root = getRepoRoot();
+	if (!isSafePath(filePath, root)) return null;
+	const resolved = resolve(root, filePath);
 	if (version === "new") try {
-		return readFileSync(join(root, filePath));
+		return readFileSync(resolved);
 	} catch {
 		return null;
 	}
 	try {
-		return execSync(`git show HEAD:${filePath}`, { maxBuffer: 50 * 1024 * 1024 });
+		return execFileSync("git", ["show", `HEAD:${filePath}`], { maxBuffer: 50 * 1024 * 1024 });
 	} catch {
 		return null;
 	}
 }
 function isGitRepo() {
 	try {
-		execSync("git rev-parse --is-inside-work-tree", { stdio: "pipe" });
+		execFileSync("git", ["rev-parse", "--is-inside-work-tree"], { stdio: "pipe" });
 		return true;
 	} catch {
 		return false;
 	}
 }
 function getRepoRoot() {
-	return execSync("git rev-parse --show-toplevel", { encoding: "utf-8" }).trim();
+	return execFileSync("git", ["rev-parse", "--show-toplevel"], { encoding: "utf-8" }).trim();
 }
 function getRepoName() {
 	return basename(getRepoRoot());
 }
 function getBranchName() {
 	try {
-		return execSync("git rev-parse --abbrev-ref HEAD", { encoding: "utf-8" }).trim();
+		return execFileSync("git", [
+			"rev-parse",
+			"--abbrev-ref",
+			"HEAD"
+		], { encoding: "utf-8" }).trim();
 	} catch {
 		return "";
 	}
 }
 function getCustomGitDiff(args) {
-	return execSync([
-		"git",
-		"diff",
-		...args
-	].join(" "), {
+	return execFileSync("git", ["diff", ...args], {
 		encoding: "utf-8",
 		maxBuffer: 50 * 1024 * 1024
 	});
 }
 function getGitDiff(options = {}) {
 	const parts = [];
-	const unstaged = execSync("git diff", {
+	const unstaged = execFileSync("git", ["diff"], {
 		encoding: "utf-8",
 		maxBuffer: 50 * 1024 * 1024
 	});
 	if (unstaged) parts.push(unstaged);
 	if (options.staged) {
-		const staged = execSync("git diff --staged", {
+		const staged = execFileSync("git", ["diff", "--staged"], {
 			encoding: "utf-8",
 			maxBuffer: 50 * 1024 * 1024
 		});
@@ -98,7 +115,11 @@ function getTabSizeForFiles(filePaths) {
 }
 function getUntrackedFilesDiff() {
 	const root = getRepoRoot();
-	const output = execSync("git ls-files --others --exclude-standard", {
+	const output = execFileSync("git", [
+		"ls-files",
+		"--others",
+		"--exclude-standard"
+	], {
 		encoding: "utf-8",
 		maxBuffer: 50 * 1024 * 1024
 	}).trim();
@@ -333,7 +354,9 @@ function createApp(clientDir, customDiffArgs, commentStore) {
 	app.get("/*", async (c) => {
 		let filePath = c.req.path;
 		if (filePath === "/") filePath = "/index.html";
-		const fullPath = join(clientDir, filePath);
+		const relativePath = filePath.slice(1);
+		if (!isSafePath(relativePath, clientDir)) return c.text("Forbidden", 403);
+		const fullPath = resolve(clientDir, relativePath);
 		try {
 			const content = await readFile(fullPath);
 			const contentType = MIME_TYPES[extname(fullPath)] || "application/octet-stream";
@@ -350,7 +373,8 @@ function startServer(options) {
 	return new Promise((resolve) => {
 		serve({
 			fetch: app.fetch,
-			port: options.port
+			port: options.port,
+			hostname: "127.0.0.1"
 		}, (info) => {
 			resolve({ port: info.port });
 		});
@@ -382,7 +406,7 @@ if (values.help) {
 Usage: diffx [options] [-- <git diff args>]
 
 Options:
-  -p, --port <port>  Port to run the server on (default: 3433)
+  -p, --port <port>  Port to run the server on (default: random available port)
   --no-open          Don't open the browser automatically
   -v, --version      Show version number
   -h, --help         Show this help message
@@ -405,7 +429,7 @@ if (!isGitRepo()) {
 	console.error("Error: not inside a git repository");
 	process.exit(1);
 }
-const port = await getPort({ port: values.port ? parseInt(values.port, 10) : 3433 });
+const port = await getPort(values.port ? { port: parseInt(values.port, 10) } : void 0);
 const clientDir = resolve(dirname(fileURLToPath(import.meta.url)), "client");
 const { existsSync } = await import("node:fs");
 const { port: actualPort } = await startServer({
@@ -413,12 +437,9 @@ const { port: actualPort } = await startServer({
 	clientDir: existsSync(clientDir) ? clientDir : resolve(process.cwd(), "dist/client"),
 	customDiffArgs
 });
-console.log(`diffx server running at http://localhost:${actualPort}`);
-if (!values["no-open"]) {
-	const openModule = await import("open");
-	const url = `http://localhost:${actualPort}`;
-	openModule.default(url);
-}
+const localUrl = `http://127.0.0.1:${actualPort}`;
+console.log(`diffx server running at ${localUrl}`);
+if (!values["no-open"]) (await import("open")).default(localUrl);
 process.on("SIGINT", () => {
 	console.log("\nShutting down...");
 	process.exit(0);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "diffx-cli",
-  "version": "0.7.1",
+  "version": "0.8.1",
   "description": "Local code review tool for git diffs with a GitHub PR-like web UI",
   "type": "module",
   "license": "MIT",
@@ -33,6 +33,7 @@
     "open": "^11.0.0"
   },
   "devDependencies": {
+    "@changesets/changelog-git": "^0.2.1",
     "@changesets/cli": "^2.30.0",
     "@pierre/diffs": "^1.1.11",
     "@types/react": "^19.1.2",