qumra-engine 2.0.161 → 2.0.163

package/dist/middleware.js

@@ -86,8 +86,13 @@ const startEngine = async ({ renderApi, mode, getRender, setRender, port = 3000,
             // app.use("/api", devRouter);
         }
         app.use((req, res, next) => {
-            if (!(0, isPathAllowedToRender_1.isPathAllowedToRender)(res.locals.parsedUrl?.pathname || req.path)) {
-                return res.status(404).end();
+            const path = res.locals.parsedUrl?.pathname || req.path;
+            const result = (0, isPathAllowedToRender_1.validatePathForRender)(path);
+            if (!result.allowed) {
+                return res.status(result.status).json({
+                    success: false,
+                    message: result.reason,
+                });
             }
             next();
         });

package/dist/utils/isPathAllowedToRender.d.ts

@@ -1 +1,9 @@
-export declare const isPathAllowedToRender: (filePath: string) => boolean;
+export declare const validatePathForRender: (filePath: string) => {
+    allowed: boolean;
+    status: number;
+    reason: string;
+} | {
+    allowed: boolean;
+    status: number;
+    reason?: undefined;
+};

package/dist/utils/isPathAllowedToRender.js

@@ -1,39 +1,22 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.isPathAllowedToRender = void 0;
-const isPathAllowedToRender = (filePath) => {
-    const lower = filePath.toLowerCase();
-    // ❌ ممنوع أي امتداد (html/js/php/…)
-    if (/\.[a-z0-9]+$/i.test(lower))
-        return false;
-    // ❌ امتدادات خطيرة للبوتات والهكر
-    if (/\.(php|php5|php7|phtml|phar)$/i.test(lower))
-        return false;
-    // ❌ مسارات مشهورة للهجمات
-    const blockedPaths = [
-        "wp-admin",
-        "wp-login",
-        "xmlrpc",
-        ".env",
-        "config",
-        "config.php",
-        "adminer",
-        "vendor",
-        "composer.json",
-        "composer.lock",
-        "shell",
-        "id_rsa",
-        "login",
-        "phpinfo",
-        "server-status",
-        "cgi-bin",
-        "backup",
-        "backups",
-        "dump",
-        "database",
-    ];
-    if (blockedPaths.some(p => lower.includes(p)))
-        return false;
-    return true;
+exports.validatePathForRender = void 0;
+const validatePathForRender = (filePath) => {
+    // نشيل أي query string
+    const path = filePath.split("?")[0].toLowerCase();
+    // whitelist بدون لمس الـ query
+    const whitelistRegex = /^\/($|collections$|collection$|collection\/[^\/]+$|latest$|product\/[^\/]+$|blog\/[^\/]+$|cart$|search$)/;
+    if (!whitelistRegex.test(path)) {
+        return {
+            allowed: false,
+            status: 404,
+            reason: "Path not allowed",
+        };
+    }
+    // ✔ مسموح + query مسموح
+    return {
+        allowed: true,
+        status: 200,
+    };
 };
-exports.isPathAllowedToRender = isPathAllowedToRender;
+exports.validatePathForRender = validatePathForRender;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "qumra-engine",
-  "version": "2.0.161",
+  "version": "2.0.163",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
   "scripts": {