qumra-engine 2.0.160 → 2.0.162

package/dist/middleware.js

@@ -86,8 +86,13 @@ const startEngine = async ({ renderApi, mode, getRender, setRender, port = 3000,
             // app.use("/api", devRouter);
         }
         app.use((req, res, next) => {
-            if (!(0, isPathAllowedToRender_1.isPathAllowedToRender)(res.locals.parsedUrl?.pathname || req.path)) {
-                return res.status(404).end();
+            const path = res.locals.parsedUrl?.pathname || req.path;
+            const result = (0, isPathAllowedToRender_1.validatePathForRender)(path);
+            if (!result.allowed) {
+                return res.status(result.status).json({
+                    success: false,
+                    message: result.reason,
+                });
             }
             next();
         });

package/dist/utils/isPathAllowedToRender.d.ts

@@ -1 +1,9 @@
-export declare const isPathAllowedToRender: (filePath: string) => boolean;
+export declare const validatePathForRender: (filePath: string) => {
+    allowed: boolean;
+    status: number;
+    reason: string;
+} | {
+    allowed: boolean;
+    status: number;
+    reason?: undefined;
+};

package/dist/utils/isPathAllowedToRender.js

@@ -1,8 +1,57 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.isPathAllowedToRender = void 0;
-const isPathAllowedToRender = (filePath) => {
-    // نتاكد إنه مفيهوش امتداد
-    return !/\.[a-z0-9]+$/i.test(filePath);
+exports.validatePathForRender = void 0;
+const validatePathForRender = (filePath) => {
+    const lower = filePath.toLowerCase();
+    // ❌ لو فيه امتداد → مرفوض
+    if (/\.[a-z0-9]+$/i.test(lower)) {
+        return {
+            allowed: false,
+            status: 400,
+            reason: "File path must not contain an extension",
+        };
+    }
+    // ❌ امتدادات خطيرة للهكر والبوتات
+    if (/\.(php|php5|php7|phtml|phar)$/i.test(lower)) {
+        return {
+            allowed: false,
+            status: 403,
+            reason: "Dangerous extension blocked",
+        };
+    }
+    // ❌ مسارات الهجمات الشائعة
+    const blockedPaths = [
+        "wp-admin",
+        "wp-login",
+        "xmlrpc",
+        ".env",
+        "config",
+        "config.php",
+        "adminer",
+        "vendor",
+        "composer.json",
+        "composer.lock",
+        "shell",
+        "id_rsa",
+        "phpinfo",
+        "server-status",
+        "cgi-bin",
+        "backup",
+        "backups",
+        "dump",
+        "database",
+    ];
+    if (blockedPaths.some(p => lower.includes(p))) {
+        return {
+            allowed: false,
+            status: 403,
+            reason: "Blocked path pattern detected",
+        };
+    }
+    // ✅ لو كل شيء تمام
+    return {
+        allowed: true,
+        status: 200,
+    };
 };
-exports.isPathAllowedToRender = isPathAllowedToRender;
+exports.validatePathForRender = validatePathForRender;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "qumra-engine",
-  "version": "2.0.160",
+  "version": "2.0.162",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
   "scripts": {