mock-service-cli 3.6.0 → 3.6.2

package/lib/fileExplorerServer.js

@@ -48,11 +48,19 @@ function init() {
     let dirPath = req.query.path || '/';
     dirPath = decodeURIComponent(dirPath);
 
-    const fullPath = path.resolve(explorerRoot, '.' + dirPath);
+    let fullPath;
+    if (dirPath.startsWith('/')) {
+      fullPath = dirPath;
+    } else {
+      fullPath = path.resolve(explorerRoot, dirPath);
+    }
 
-    // 防止路径遍历攻击
-    if (!fullPath.startsWith(path.resolve(explorerRoot))) {
-      return res.status(403).json({ error: 'Access denied' });
+    // 防止路径遍历攻击 - 确保路径不会越界
+    if (explorerRoot !== '/') {
+      const resolvedRoot = path.resolve(explorerRoot);
+      if (!fullPath.startsWith(resolvedRoot)) {
+        return res.status(403).json({ error: 'Access denied' });
+      }
     }
 
     if (!existsSync(fullPath)) {
@@ -70,16 +78,28 @@ function init() {
 
       files.forEach(file => {
         const filePath = path.join(fullPath, file.name);
-        const fileStats = statSync(filePath);
+        let fileStats;
+        let hasError = false;
+
+        try {
+          fileStats = statSync(filePath);
+        } catch (statError) {
+          hasError = true;
+        }
+
         const relativePath = path.join(dirPath, file.name);
 
+        // 使用 statSync 的结果，因为 readdirSync 在根目录对某些特殊目录识别不准确
+        const isDirectory = hasError ? file.isDirectory() : fileStats.isDirectory();
+
         result.push({
           name: file.name,
           path: relativePath.replace(/\\/g, '/'),
-          isDirectory: file.isDirectory(),
-          size: fileStats.size,
-          mtime: fileStats.mtime,
-          isHidden: file.name.startsWith('.')
+          isDirectory: isDirectory,
+          size: hasError ? 0 : fileStats.size,
+          mtime: hasError ? new Date() : fileStats.mtime,
+          isHidden: file.name.startsWith('.'),
+          error: hasError ? 'Cannot access file' : null
         });
       });
 
@@ -106,11 +126,19 @@ function init() {
     let filePath = req.query.path || '/';
     filePath = decodeURIComponent(filePath);
 
-    const fullPath = path.resolve(explorerRoot, '.' + filePath);
+    let fullPath;
+    if (filePath.startsWith('/')) {
+      fullPath = filePath;
+    } else {
+      fullPath = path.resolve(explorerRoot, filePath);
+    }
 
-    // 防止路径遍历攻击
-    if (!fullPath.startsWith(path.resolve(explorerRoot))) {
-      return res.status(403).json({ error: 'Access denied' });
+    // 防止路径遍历攻击 - 确保路径不会越界
+    if (explorerRoot !== '/') {
+      const resolvedRoot = path.resolve(explorerRoot);
+      if (!fullPath.startsWith(resolvedRoot)) {
+        return res.status(403).json({ error: 'Access denied' });
+      }
     }
 
     if (!existsSync(fullPath)) {
@@ -152,11 +180,19 @@ function init() {
     let filePath = req.body.path || '/';
     filePath = decodeURIComponent(filePath);
 
-    const fullPath = path.resolve(explorerRoot, '.' + filePath);
+    let fullPath;
+    if (filePath.startsWith('/')) {
+      fullPath = filePath;
+    } else {
+      fullPath = path.resolve(explorerRoot, filePath);
+    }
 
-    // 防止路径遍历攻击
-    if (!fullPath.startsWith(path.resolve(explorerRoot))) {
-      return res.status(403).json({ error: 'Access denied' });
+    // 防止路径遍历攻击 - 确保路径不会越界
+    if (explorerRoot !== '/') {
+      const resolvedRoot = path.resolve(explorerRoot);
+      if (!fullPath.startsWith(resolvedRoot)) {
+        return res.status(403).json({ error: 'Access denied' });
+      }
     }
 
     if (!existsSync(fullPath)) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mock-service-cli",
-  "version": "3.6.0",
+  "version": "3.6.2",
   "description": "🦅 Local Mock/Static/SPA server, Http?s request proxy, API overview page, File explorer",
   "main": "./lib/mockServer.js",
   "bin": {
@@ -13,6 +13,7 @@
     "test-watch": "tap --reporter=spec --watch test/*.test.js",
     "fix": "eslint --ext .js,.vue,.css --fix",
     "prettier": "prettier -c --write \"**/*.{ts,js,jsx,css,less,scss,json}\"",
+    "coverage": "cat ./coverage/lcov.info | ./node_modules/.bin/coveralls -v",
     "release:prerelease": "standard-version --prerelease",
     "release:prefix": "standard-version --prerelease alpha",
     "release:patch": "standard-version --release-as patch && git push --follow-tags origin master",