meshy-node 0.5.3 → 0.5.4

package/README.md

@@ -1,6 +1,6 @@
 # meshy-node
 
-Version: 0.5.3
+Version: 0.5.4
 
 This package contains the built Meshy standalone node runtime only.
 It intentionally excludes repository source files and TypeScript sources.

package/main.cjs

@@ -24269,7 +24269,7 @@ var require_send = __commonJS({
     var join17 = path23.join;
     var normalize = path23.normalize;
     var resolve15 = path23.resolve;
-    var sep4 = path23.sep;
+    var sep5 = path23.sep;
     var BYTES_RANGE_REGEXP = /^ *bytes=/;
     var MAX_MAXAGE = 60 * 60 * 24 * 365 * 1e3;
     var UP_PATH_REGEXP = /(?:^|[\\/])\.\.(?:[\\/]|$)/;
@@ -24477,14 +24477,14 @@ var require_send = __commonJS({
       var parts;
       if (root !== null) {
         if (path24) {
-          path24 = normalize("." + sep4 + path24);
+          path24 = normalize("." + sep5 + path24);
         }
         if (UP_PATH_REGEXP.test(path24)) {
           debug('malicious path "%s"', path24);
           this.error(403);
           return res;
         }
-        parts = path24.split(sep4);
+        parts = path24.split(sep5);
         path24 = normalize(join17(root, path24));
       } else {
         if (UP_PATH_REGEXP.test(path24)) {
@@ -24492,7 +24492,7 @@ var require_send = __commonJS({
           this.error(403);
           return res;
         }
-        parts = normalize(path24).split(sep4);
+        parts = normalize(path24).split(sep5);
         path24 = resolve15(path24);
       }
       if (containsDotFile(parts)) {
@@ -24590,7 +24590,7 @@ var require_send = __commonJS({
       var self2 = this;
       debug('stat "%s"', path24);
       fs24.stat(path24, function onstat(err, stat) {
-        if (err && err.code === "ENOENT" && !extname3(path24) && path24[path24.length - 1] !== sep4) {
+        if (err && err.code === "ENOENT" && !extname3(path24) && path24[path24.length - 1] !== sep5) {
           return next(err);
         }
         if (err) return self2.onStatError(err);
@@ -44577,12 +44577,22 @@ function resolveNodeWorkDirTarget(nodeId, rootPath, currentPath, allowAbsolute)
   }
   const useAbsolute = allowAbsolute && isAbsolutePath(currentPath);
   const resolvedPath = useAbsolute ? path16.resolve(currentPath) : currentPath;
+  const targetPath = useAbsolute ? resolvedPath : resolveRelativeNodeWorkDirTarget(rootPath, resolvedPath);
   return {
     rootPath,
     resolvedPath,
+    targetPath,
     useAbsolute
   };
 }
+function resolveRelativeNodeWorkDirTarget(rootPath, relativePath) {
+  const resolvedRoot = path16.resolve(rootPath);
+  const resolved = path16.resolve(resolvedRoot, relativePath);
+  if (!resolved.startsWith(resolvedRoot + path16.sep) && resolved !== resolvedRoot) {
+    throw new MeshyError("VALIDATION_ERROR", "Invalid directory path", 400);
+  }
+  return resolved;
+}
 function getLocalNodeWorkDirTree(nodeId, rootPath, currentPath, options) {
   const { rootPath: resolvedRootPath, resolvedPath, useAbsolute } = resolveNodeWorkDirTarget(
     nodeId,
@@ -44616,24 +44626,24 @@ function getLocalNodeWorkDirTree(nodeId, rootPath, currentPath, options) {
   }
 }
 function getLocalNodeWorkDirBranchInfo(nodeId, rootPath, currentPath, options) {
-  const { resolvedPath } = resolveNodeWorkDirTarget(
+  const { targetPath } = resolveNodeWorkDirTarget(
     nodeId,
     rootPath,
     currentPath,
     options.allowAbsolute
   );
-  const branchInfo = getGitBranchInfo(resolvedPath, {
+  const branchInfo = getGitBranchInfo(targetPath, {
     limit: options.limit,
     offset: options.offset
   });
   return {
     nodeId,
-    path: resolvedPath,
+    path: targetPath,
     ...branchInfo
   };
 }
 function createLocalNodeWorkDirBranch(nodeId, rootPath, currentPath, options) {
-  const { resolvedPath } = resolveNodeWorkDirTarget(
+  const { targetPath } = resolveNodeWorkDirTarget(
     nodeId,
     rootPath,
     currentPath,
@@ -44641,14 +44651,14 @@ function createLocalNodeWorkDirBranch(nodeId, rootPath, currentPath, options) {
   );
   try {
     const result = createGitBranch(
-      resolvedPath,
+      targetPath,
       options.branchName,
       options.startPoint,
       { limit: options.limit, offset: options.offset }
     );
     return {
       nodeId,
-      path: resolvedPath,
+      path: targetPath,
       ...result
     };
   } catch (err) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "meshy-node",
-  "version": "0.5.3",
+  "version": "0.5.4",
   "private": false,
   "description": "Standalone Meshy node package with bundled runtime and dashboard assets.",
   "type": "commonjs",

package/runtime-metadata.json

@@ -1,14 +1,14 @@
 {
   "packageName": "meshy-node",
-  "packageVersion": "0.5.3",
+  "packageVersion": "0.5.4",
   "packages": {
     "workspace": {
       "name": "meshy",
-      "version": "0.5.3"
+      "version": "0.5.4"
     },
     "node": {
       "name": "meshy-node",
-      "version": "0.5.3"
+      "version": "0.5.4"
     },
     "core": {
       "name": "@meshy/core",