qumra-engine 2.0.162 → 2.0.163
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
|
@@ -2,53 +2,18 @@
|
|
|
2
2
|
Object.defineProperty(exports, "__esModule", { value: true });
|
|
3
3
|
exports.validatePathForRender = void 0;
|
|
4
4
|
const validatePathForRender = (filePath) => {
|
|
5
|
-
|
|
6
|
-
|
|
7
|
-
|
|
5
|
+
// نشيل أي query string
|
|
6
|
+
const path = filePath.split("?")[0].toLowerCase();
|
|
7
|
+
// whitelist بدون لمس الـ query
|
|
8
|
+
const whitelistRegex = /^\/($|collections$|collection$|collection\/[^\/]+$|latest$|product\/[^\/]+$|blog\/[^\/]+$|cart$|search$)/;
|
|
9
|
+
if (!whitelistRegex.test(path)) {
|
|
8
10
|
return {
|
|
9
11
|
allowed: false,
|
|
10
|
-
status:
|
|
11
|
-
reason: "
|
|
12
|
+
status: 404,
|
|
13
|
+
reason: "Path not allowed",
|
|
12
14
|
};
|
|
13
15
|
}
|
|
14
|
-
//
|
|
15
|
-
if (/\.(php|php5|php7|phtml|phar)$/i.test(lower)) {
|
|
16
|
-
return {
|
|
17
|
-
allowed: false,
|
|
18
|
-
status: 403,
|
|
19
|
-
reason: "Dangerous extension blocked",
|
|
20
|
-
};
|
|
21
|
-
}
|
|
22
|
-
// ❌ مسارات الهجمات الشائعة
|
|
23
|
-
const blockedPaths = [
|
|
24
|
-
"wp-admin",
|
|
25
|
-
"wp-login",
|
|
26
|
-
"xmlrpc",
|
|
27
|
-
".env",
|
|
28
|
-
"config",
|
|
29
|
-
"config.php",
|
|
30
|
-
"adminer",
|
|
31
|
-
"vendor",
|
|
32
|
-
"composer.json",
|
|
33
|
-
"composer.lock",
|
|
34
|
-
"shell",
|
|
35
|
-
"id_rsa",
|
|
36
|
-
"phpinfo",
|
|
37
|
-
"server-status",
|
|
38
|
-
"cgi-bin",
|
|
39
|
-
"backup",
|
|
40
|
-
"backups",
|
|
41
|
-
"dump",
|
|
42
|
-
"database",
|
|
43
|
-
];
|
|
44
|
-
if (blockedPaths.some(p => lower.includes(p))) {
|
|
45
|
-
return {
|
|
46
|
-
allowed: false,
|
|
47
|
-
status: 403,
|
|
48
|
-
reason: "Blocked path pattern detected",
|
|
49
|
-
};
|
|
50
|
-
}
|
|
51
|
-
// ✅ لو كل شيء تمام
|
|
16
|
+
// ✔ مسموح + query مسموح
|
|
52
17
|
return {
|
|
53
18
|
allowed: true,
|
|
54
19
|
status: 200,
|