git-watchtower 1.11.2 → 1.11.4

package/bin/git-watchtower.js

@@ -2110,10 +2110,23 @@ function createStaticServer() {
   pathname = path.normalize(pathname).replace(/^(\.\.[\/\\])+/, '');
   let filePath = path.join(STATIC_DIR, pathname);
 
-  // Security: ensure resolved path stays within STATIC_DIR to prevent path traversal
-  const resolvedPath = path.resolve(filePath);
+  // Security: ensure resolved path stays within STATIC_DIR to prevent path traversal.
+  // Use realpath to follow symlinks — without this, a symlink inside STATIC_DIR
+  // pointing outside would bypass the startsWith check.
   const resolvedStaticDir = path.resolve(STATIC_DIR);
-  if (!resolvedPath.startsWith(resolvedStaticDir + path.sep) && resolvedPath !== resolvedStaticDir) {
+  let resolvedPath = path.resolve(filePath);
+  try {
+    resolvedPath = fs.realpathSync(resolvedPath);
+  } catch {
+    // File doesn't exist — path.resolve is sufficient since there's no symlink to follow.
+  }
+  let realStaticDir;
+  try {
+    realStaticDir = fs.realpathSync(resolvedStaticDir);
+  } catch {
+    realStaticDir = resolvedStaticDir;
+  }
+  if (!resolvedPath.startsWith(realStaticDir + path.sep) && resolvedPath !== realStaticDir) {
     res.writeHead(403, { 'Content-Type': 'text/html' });
     res.end('<h1>403 Forbidden</h1>');
     addServerLog(`GET ${logPath} → 403 (path traversal blocked)`, true);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "git-watchtower",
-  "version": "1.11.2",
+  "version": "1.11.4",
   "description": "Terminal-based Git branch monitor with activity sparklines and optional dev server with live reload",
   "main": "bin/git-watchtower.js",
   "bin": {

package/src/git/commands.js

@@ -336,6 +336,8 @@ async function getChangedFiles(branchName, baseBranch = 'HEAD', cwd) {
  * @returns {{added: number, deleted: number}}
  */
 function parseDiffStats(diffStatOutput) {
+  if (!diffStatOutput) return { added: 0, deleted: 0 };
+
   // Parse the summary line: "X files changed, Y insertions(+), Z deletions(-)"
   const match = diffStatOutput.match(/(\d+) insertions?\(\+\).*?(\d+) deletions?\(-\)/);
   if (match) {

package/src/server/coordinator.js

@@ -318,7 +318,15 @@ class Coordinator {
    */
   _handleWorkerMessage(socket, msg, setWorkerId, getWorkerId) {
     switch (msg.type) {
-      case 'register':
+      case 'register': {
+        // Prevent re-registration: a socket that already registered cannot change its ID
+        const currentId = getWorkerId();
+        if (currentId) break;
+
+        // Reject if this ID is already claimed by a different socket
+        const existingSocket = this.workerSockets.get(msg.id);
+        if (existingSocket && existingSocket !== socket) break;
+
         setWorkerId(msg.id);
         this.workerSockets.set(msg.id, socket);
         this.projects.set(msg.id, {
@@ -331,6 +339,7 @@ class Coordinator {
         this._sendMessage(socket, { type: 'registered', id: msg.id });
         this._notifyProjectsChanged();
         break;
+      }
 
       case 'state': {
         // Validate sender — only accept state for the worker's own registered ID

package/src/server/static.js

@@ -63,33 +63,9 @@ function injectLiveReload(html) {
   return html;
 }
 
-/**
- * Parse git diff --stat output into { added, deleted } counts.
- * @param {string} diffOutput - Output from `git diff --stat`
- * @returns {{ added: number, deleted: number }}
- */
-function parseDiffStats(diffOutput) {
-  if (!diffOutput) return { added: 0, deleted: 0 };
-
-  // Parse the summary line: "X files changed, Y insertions(+), Z deletions(-)"
-  const match = diffOutput.match(/(\d+) insertions?\(\+\).*?(\d+) deletions?\(-\)/);
-  if (match) {
-    return { added: parseInt(match[1], 10), deleted: parseInt(match[2], 10) };
-  }
-
-  // Try to match just insertions or just deletions
-  const insertMatch = diffOutput.match(/(\d+) insertions?\(\+\)/);
-  const deleteMatch = diffOutput.match(/(\d+) deletions?\(-\)/);
-  return {
-    added: insertMatch ? parseInt(insertMatch[1], 10) : 0,
-    deleted: deleteMatch ? parseInt(deleteMatch[1], 10) : 0,
-  };
-}
-
 module.exports = {
   MIME_TYPES,
   getMimeType,
   LIVE_RELOAD_SCRIPT,
   injectLiveReload,
-  parseDiffStats,
 };