openship 0.6.0 → 0.6.5

package/dist/{chunk-EMXI4UCU.js → chunk-LFCSC4IU.js}

@@ -7,14 +7,14 @@ import {
   localGitSshWriter,
   materializeGitSsh,
   sq
-} from "./chunk-VDDMADOF.js";
+} from "./chunk-TM2IQPYU.js";
 import {
   getTarCreateEnv,
   prepareSourceTarArgs
-} from "./chunk-6ODUBKUB.js";
+} from "./chunk-5OUWIPOB.js";
 import {
   packageManagerEnsureCommand
-} from "./chunk-OTLSJYAC.js";
+} from "./chunk-LEYSL46B.js";
 import {
   __commonJS,
   __toESM
@@ -480,16 +480,34 @@ var require_ignore = __commonJS({
 
 // ../../packages/adapters/src/runtime/docker-paths.ts
 import { access, readdir } from "fs/promises";
-import { isAbsolute, join, relative, sep } from "path";
+import { isAbsolute, join, relative, resolve, sep } from "path";
 function toPosixPath(value) {
   return value.split(sep).filter(Boolean).join("/");
 }
+function toSafeSegments(value, label) {
+  const segments = value.split(/[\\/]/).filter((segment) => segment && segment !== ".");
+  if (segments.includes("..")) {
+    throw new Error(
+      `Invalid ${label} ${JSON.stringify(value)}: path segments must not contain "..".`
+    );
+  }
+  return segments;
+}
 function normalizeDockerRelativePath(value) {
   const normalized = value?.trim().replace(/^\.\//, "").replace(/^\/+|\/+$/g, "");
   if (!normalized || normalized === ".") {
     return "";
   }
-  return normalized.split(/[\\/]/).filter(Boolean).join("/");
+  return toSafeSegments(normalized, "path").join("/");
+}
+function resolveWithinDirectory(baseDir, relativePath) {
+  const base = resolve(baseDir);
+  const target = resolve(base, ...toSafeSegments(relativePath?.trim() ?? "", "path"));
+  const escape = relative(base, target);
+  if (escape === ".." || escape.startsWith(`..${sep}`) || isAbsolute(escape)) {
+    throw new Error(`Resolved path ${JSON.stringify(target)} escapes ${JSON.stringify(base)}.`);
+  }
+  return target;
 }
 function normalizeDockerRootDirectory(rootDirectory, localPath) {
   let normalized = rootDirectory?.trim() ?? "";
@@ -509,7 +527,7 @@ function normalizeDockerRootDirectory(rootDirectory, localPath) {
   if (!normalized || normalized === ".") {
     return "";
   }
-  return toPosixPath(normalized);
+  return toSafeSegments(normalized, "rootDirectory").join("/");
 }
 function resolveExplicitDockerfileCandidate(rootDirectory, dockerfilePath) {
   const normalizedRootDirectory = normalizeDockerRelativePath(rootDirectory);
@@ -904,7 +922,7 @@ import { join as join2, relative as relative2, sep as sep2 } from "path";
 var GIT_CLONE_IDLE_TIMEOUT_MS = 5 * 6e4;
 var GIT_CHECKOUT_IDLE_TIMEOUT_MS = 6e4;
 function spawnGit(args, opts) {
-  return new Promise((resolve, reject) => {
+  return new Promise((resolve2, reject) => {
     const child = spawn("git", args, {
       stdio: ["ignore", "pipe", "pipe"],
       env: {
@@ -954,7 +972,7 @@ function spawnGit(args, opts) {
     });
     child.on("close", (code) => {
       clearTimeout(idleTimer);
-      if (code === 0) resolve();
+      if (code === 0) resolve2();
       else reject(new Error(`git exited with code ${code}: ${stderr.trim().slice(-500) || "no stderr"}`));
     });
   });
@@ -1014,7 +1032,7 @@ async function applyDockerignore(contextDir, config) {
 async function materializeLocalSource(sourcePath, targetPath) {
   const { args, cleanup } = await prepareSourceTarArgs(sourcePath);
   try {
-    await new Promise((resolve, reject) => {
+    await new Promise((resolve2, reject) => {
       const create = spawn("tar", args, { env: getTarCreateEnv() });
       const extract = spawn("tar", ["-xzf", "-", "-C", targetPath]);
       let err = "";
@@ -1027,7 +1045,7 @@ async function materializeLocalSource(sourcePath, targetPath) {
       create.on("close", (code) => createCode = code);
       create.stdout.pipe(extract.stdin);
       extract.on("close", (code) => {
-        if (code === 0 && (createCode ?? 0) === 0) return resolve();
+        if (code === 0 && (createCode ?? 0) === 0) return resolve2();
         const parts = [
           createCode ? `pack exited ${createCode}: ${createErr.trim().slice(-500)}` : "",
           code ? `extract exited ${code}: ${err.trim().slice(-500)}` : ""
@@ -1173,6 +1191,7 @@ async function createDockerBuildContext(config, opts) {
 
 export {
   normalizeDockerRelativePath,
+  resolveWithinDirectory,
   resolveDockerfileCandidates,
   staticBuilderOutputPath,
   generateDockerfile,

package/dist/{chunk-JIMUYEKN.js → chunk-MSZUCNPV.js}

@@ -6,7 +6,7 @@ import {
   detectBuildKillHint,
   runBuildPipeline,
   transferLocalDirectory
-} from "./chunk-VDDMADOF.js";
+} from "./chunk-TM2IQPYU.js";
 import {
   LocalExecutor
 } from "./chunk-6FH4AXVY.js";