qumra-engine 2.0.161 → 2.0.162

package/dist/middleware.js

@@ -86,8 +86,13 @@ const startEngine = async ({ renderApi, mode, getRender, setRender, port = 3000,
             // app.use("/api", devRouter);
         }
         app.use((req, res, next) => {
-            if (!(0, isPathAllowedToRender_1.isPathAllowedToRender)(res.locals.parsedUrl?.pathname || req.path)) {
-                return res.status(404).end();
+            const path = res.locals.parsedUrl?.pathname || req.path;
+            const result = (0, isPathAllowedToRender_1.validatePathForRender)(path);
+            if (!result.allowed) {
+                return res.status(result.status).json({
+                    success: false,
+                    message: result.reason,
+                });
             }
             next();
         });

package/dist/utils/isPathAllowedToRender.d.ts

@@ -1 +1,9 @@
-export declare const isPathAllowedToRender: (filePath: string) => boolean;
+export declare const validatePathForRender: (filePath: string) => {
+    allowed: boolean;
+    status: number;
+    reason: string;
+} | {
+    allowed: boolean;
+    status: number;
+    reason?: undefined;
+};

package/dist/utils/isPathAllowedToRender.js

@@ -1,15 +1,25 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.isPathAllowedToRender = void 0;
-const isPathAllowedToRender = (filePath) => {
+exports.validatePathForRender = void 0;
+const validatePathForRender = (filePath) => {
     const lower = filePath.toLowerCase();
-    // ❌ ممنوع أي امتداد (html/js/php/…)
-    if (/\.[a-z0-9]+$/i.test(lower))
-        return false;
-    // ❌ امتدادات خطيرة للبوتات والهكر
-    if (/\.(php|php5|php7|phtml|phar)$/i.test(lower))
-        return false;
-    // ❌ مسارات مشهورة للهجمات
+    // ❌ لو فيه امتداد → مرفوض
+    if (/\.[a-z0-9]+$/i.test(lower)) {
+        return {
+            allowed: false,
+            status: 400,
+            reason: "File path must not contain an extension",
+        };
+    }
+    // ❌ امتدادات خطيرة للهكر والبوتات
+    if (/\.(php|php5|php7|phtml|phar)$/i.test(lower)) {
+        return {
+            allowed: false,
+            status: 403,
+            reason: "Dangerous extension blocked",
+        };
+    }
+    // ❌ مسارات الهجمات الشائعة
     const blockedPaths = [
         "wp-admin",
         "wp-login",
@@ -23,7 +33,6 @@ const isPathAllowedToRender = (filePath) => {
         "composer.lock",
         "shell",
         "id_rsa",
-        "login",
         "phpinfo",
         "server-status",
         "cgi-bin",
@@ -32,8 +41,17 @@ const isPathAllowedToRender = (filePath) => {
         "dump",
         "database",
     ];
-    if (blockedPaths.some(p => lower.includes(p)))
-        return false;
-    return true;
+    if (blockedPaths.some(p => lower.includes(p))) {
+        return {
+            allowed: false,
+            status: 403,
+            reason: "Blocked path pattern detected",
+        };
+    }
+    // ✅ لو كل شيء تمام
+    return {
+        allowed: true,
+        status: 200,
+    };
 };
-exports.isPathAllowedToRender = isPathAllowedToRender;
+exports.validatePathForRender = validatePathForRender;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "qumra-engine",
-  "version": "2.0.161",
+  "version": "2.0.162",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
   "scripts": {