oh-my-adhd 0.2.14 → 0.2.15
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
|
@@ -2,6 +2,9 @@ import { z } from "zod";
|
|
|
2
2
|
import { ensureBrainDirs, BRAIN_DIR, SCHEMA_VERSION, UUID_RE, withBrainLock } from "../../lib/brain.js";
|
|
3
3
|
import fs from "fs/promises";
|
|
4
4
|
import path from "path";
|
|
5
|
+
import os from "os";
|
|
6
|
+
const SENSITIVE_DIRS = [".ssh", ".aws", ".gnupg", ".kube", ".docker",
|
|
7
|
+
path.join(".config", "git"), path.join(".config", "gh")];
|
|
5
8
|
const SLUG_RE = /^[a-z0-9가-힣][a-z0-9가-힣_-]{0,127}$/;
|
|
6
9
|
const MAX_CONTENT_BYTES = 5 * 1024 * 1024; // 5MB per thread
|
|
7
10
|
const MAX_ITEMS = 10000; // max threads or pages per import
|
|
@@ -18,6 +21,21 @@ export function registerWikiImport(server) {
|
|
|
18
21
|
isError: true,
|
|
19
22
|
};
|
|
20
23
|
}
|
|
24
|
+
// Block reads from sensitive dirs — mirrors wiki_export denylist
|
|
25
|
+
const homeDir = os.homedir();
|
|
26
|
+
let realInputDir = path.dirname(resolved);
|
|
27
|
+
try {
|
|
28
|
+
realInputDir = await fs.realpath(realInputDir);
|
|
29
|
+
}
|
|
30
|
+
catch { /* dir may not exist */ }
|
|
31
|
+
const realHome = await fs.realpath(homeDir).catch(() => homeDir);
|
|
32
|
+
const relInputDir = path.relative(realHome, realInputDir).toLowerCase();
|
|
33
|
+
if (SENSITIVE_DIRS.some(d => relInputDir === d.toLowerCase() || relInputDir.startsWith(d.toLowerCase() + path.sep))) {
|
|
34
|
+
return {
|
|
35
|
+
content: [{ type: "text", text: "오류: 보안상 해당 경로에서는 가져올 수 없습니다." }],
|
|
36
|
+
isError: true,
|
|
37
|
+
};
|
|
38
|
+
}
|
|
21
39
|
// Check file size before reading into memory
|
|
22
40
|
try {
|
|
23
41
|
const stat = await fs.stat(resolved);
|
|
@@ -132,6 +150,7 @@ export function registerWikiImport(server) {
|
|
|
132
150
|
manifest[idx] = meta;
|
|
133
151
|
else
|
|
134
152
|
manifest.push(meta);
|
|
153
|
+
existingIds.add(id); // prevent duplicate IDs within same import
|
|
135
154
|
importedThreads++;
|
|
136
155
|
}
|
|
137
156
|
// Write updated manifest atomically inside lock
|
package/package.json
CHANGED