mdv-live 0.5.2 → 0.5.3

package/CHANGELOG.md

@@ -5,6 +5,22 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.5.3] - 2026-03-29
+
+### Fixed
+
+- Security: exec/execSync → execFile/process.kill でコマンドインジェクション防止（PDF生成・サーバーkill）
+- Security: PIDバリデーション厳密化（数字のみ許可、部分一致を拒否）
+- Range Requestのバリデーション追加（不正ヘッダで416、end超過はRFC準拠でclamp）
+- ファイル監視の再描画でrelativeDirを渡すように修正（サブフォルダ内Markdownの画像パス解決）
+- バージョン表示をpackage.jsonから動的取得に統一（CLI・サーバー・テスト全箇所）
+
+## [0.5.2] - 2026-03-27
+
+### Fixed
+
+- CJK + Unicode句読点で太字・斜体が壊れる問題を修正
+
 ## [0.5.1] - 2026-03-20
 
 ### Fixed

package/bin/mdv.js

@@ -5,10 +5,12 @@
  * Compatible with the original Python mdv-live CLI
  */
 
-import { execSync } from 'node:child_process';
+import { execFileSync, execSync } from 'node:child_process';
+import { readFileSync } from 'node:fs';
 import fs from 'node:fs/promises';
 import { createServer as createNetServer } from 'node:net';
 import path from 'node:path';
+import { fileURLToPath } from 'node:url';
 import { parseArgs } from 'node:util';
 
 import open from 'open';
@@ -184,12 +186,17 @@ function listServers() {
 function killServers(target, killAll) {
   if (target) {
     // Kill specific PID
+    if (!/^\d+$/.test(target)) {
+      console.log(`無効なPID: ${target}`);
+      return 1;
+    }
+    const pid = Number(target);
     try {
-      execSync(`kill ${target}`, { encoding: 'utf-8' });
-      console.log(`PID ${target} を停止しました`);
+      process.kill(pid);
+      console.log(`PID ${pid} を停止しました`);
       return 0;
     } catch {
-      console.log(`PID ${target} の停止に失敗しました`);
+      console.log(`PID ${pid} の停止に失敗しました`);
       return 1;
     }
   }
@@ -214,7 +221,7 @@ function killServers(target, killAll) {
   let killed = 0;
   for (const proc of processes) {
     try {
-      execSync(`kill ${proc.pid}`, { encoding: 'utf-8' });
+      process.kill(proc.pid);
       console.log(`  PID ${proc.pid} (port ${proc.port}) を停止`);
       killed++;
     } catch {
@@ -279,7 +286,7 @@ async function convertToPdf(inputPath, outputPath) {
  */
 async function convertMarpToPdf(inputPath, outputPath) {
   try {
-    execSync(`npx @marp-team/marp-cli --no-stdin "${inputPath}" --pdf --html --allow-local-files -o "${outputPath}"`, {
+    execFileSync('npx', ['@marp-team/marp-cli', '--no-stdin', inputPath, '--pdf', '--html', '--allow-local-files', '-o', outputPath], {
       encoding: 'utf-8',
       stdio: 'inherit'
     });
@@ -302,7 +309,7 @@ async function convertMarkdownToPdf(inputPath, outputPath) {
 
   try {
     const pdfOptions = '{"format":"A4","margin":{"top":"20mm","right":"20mm","bottom":"20mm","left":"20mm"}}';
-    execSync(`npx md-to-pdf "${inputPath}" --pdf-options '${pdfOptions}'`, {
+    execFileSync('npx', ['md-to-pdf', inputPath, '--pdf-options', pdfOptions], {
       encoding: 'utf-8',
       stdio: 'inherit',
       cwd: path.dirname(inputPath)
@@ -453,7 +460,11 @@ async function main() {
   }
 
   if (values.version) {
-    console.log('mdv v0.5.0');
+    const __cliDir = path.dirname(fileURLToPath(import.meta.url));
+    const { version } = JSON.parse(
+      readFileSync(path.join(__cliDir, '..', 'package.json'), 'utf-8')
+    );
+    console.log(`mdv v${version}`);
     process.exit(0);
   }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mdv-live",
-  "version": "0.5.2",
+  "version": "0.5.3",
   "description": "Markdown Viewer - File tree + Live preview + Marp support + Hot reload",
   "main": "src/server.js",
   "bin": {

package/src/api/file.js

@@ -292,9 +292,15 @@ export function setupFileRoutes(app) {
 
       // Range Request for video/audio streaming
       const fileSize = stat.size;
-      const parts = rangeHeader.replace(/bytes=/, '').split('-');
-      const start = parseInt(parts[0], 10);
-      const end = parts[1] ? parseInt(parts[1], 10) : fileSize - 1;
+      const match = /^bytes=(\d+)-(\d+)?$/.exec(rangeHeader);
+      if (!match) {
+        return res.status(416).set('Content-Range', `bytes */${fileSize}`).end();
+      }
+      const start = Number(match[1]);
+      if (start >= fileSize) {
+        return res.status(416).set('Content-Range', `bytes */${fileSize}`).end();
+      }
+      const end = Math.min(match[2] ? Number(match[2]) : fileSize - 1, fileSize - 1);
       const chunkSize = end - start + 1;
       const mimeType = mime.lookup(fullPath) || 'application/octet-stream';
 

package/src/api/pdf.js

@@ -3,14 +3,14 @@
  * Uses marp-cli for Marp presentations
  */
 
-import { exec } from 'child_process';
+import { execFile } from 'child_process';
 import { promisify } from 'util';
 import fs from 'fs/promises';
 import path from 'path';
 import { fileURLToPath } from 'url';
 import { validatePath } from '../utils/path.js';
 
-const execAsync = promisify(exec);
+const execFileAsync = promisify(execFile);
 const marpBin = path.join(
   path.dirname(fileURLToPath(import.meta.url)),
   '..',
@@ -49,10 +49,9 @@ export function setupPdfRoutes(app) {
 
     const outputPath = fullPath.replace(/\.md$/, '.pdf');
     const outputFileName = path.basename(outputPath);
-    const command = `"${marpBin}" "${fullPath}" -o "${outputPath}" --html --allow-local-files --no-stdin`;
 
     try {
-      await execAsync(command, { timeout: 60000 });
+      await execFileAsync(marpBin, [fullPath, '-o', outputPath, '--html', '--allow-local-files', '--no-stdin'], { timeout: 60000 });
       res.download(outputPath, outputFileName, (err) => {
         if (err) {
           console.error('Download error:', err);

package/src/server.js

@@ -4,6 +4,7 @@
  */
 
 import express from 'express';
+import { readFileSync } from 'fs';
 import { createServer } from 'http';
 import path from 'path';
 import { fileURLToPath } from 'url';
@@ -17,7 +18,9 @@ import { setupWebSocket } from './websocket.js';
 
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
 const STATIC_DIR = path.join(__dirname, 'static');
-const VERSION = '0.5.0';
+const { version: VERSION } = JSON.parse(
+  readFileSync(path.join(__dirname, '..', 'package.json'), 'utf-8')
+);
 
 /**
  * Setup API routes for the Express app

package/src/watcher.js

@@ -65,9 +65,10 @@ export function setupWatcher(rootDir, wss, options = {}) {
 
   watcher.on('change', async (filePath) => {
     const relativePath = toRelativePath(filePath);
+    const relativeDir = path.dirname(relativePath);
 
     try {
-      const rendered = await renderFile(filePath);
+      const rendered = await renderFile(filePath, relativeDir === '.' ? '' : relativeDir);
       wss.broadcastFileUpdate(relativePath, {
         type: 'file_update',
         path: relativePath,