spark-html-bun 0.1.0 → 0.1.2

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "spark-html-bun",
-  "version": "0.1.0",
-  "description": "Dev server, build, and preview for spark-html apps — built entirely on Bun. Scoped component HMR over a plain WebSocket, import-map dev serving (no bundling in dev), Bun.build for the app shell, and an explicit post-build pipeline (prerender, image, font, manifest, offline, sri). Zero dependencies.",
+  "version": "0.1.2",
+  "description": "Dev server, build, and preview for spark-html apps \u2014 built entirely on Bun. Scoped component HMR over a plain WebSocket, import-map dev serving (no bundling in dev), Bun.build for the app shell, and an explicit post-build pipeline (prerender, image, font, manifest, offline, sri). Zero dependencies.",
   "homepage": "https://wilkinnovo.github.io/spark",
   "type": "module",
   "main": "./src/index.js",

package/src/index.js

@@ -42,10 +42,31 @@
  *     devRoutes?({ config }) → { '/path': { type, body() } },  // dev serving
  *     transformHtml?(html, { dev }) }                  // dev page injection
  */
-import { join, resolve, extname } from 'node:path';
+import { join, resolve, extname, basename, sep } from 'node:path';
 import { existsSync, watch, readdirSync, statSync, readFileSync } from 'node:fs';
 import { rm, mkdir, cp, readFile } from 'node:fs/promises';
 
+// Resolve `rel` under `base` and refuse anything that escapes it — a static
+// server must never serve outside its root. `..` is normalized away by the URL
+// parser, but `decodeURIComponent` can reintroduce it (e.g. `%2e%2e%2f`), so
+// the check runs on the final resolved path.
+function safeJoin(base, rel) {
+  const p = resolve(base, rel);
+  return p === base || p.startsWith(base + sep) ? p : null;
+}
+
+// URL pathname, decoded — null on malformed percent-encoding (rejected as 400).
+function decodePath(pathname) {
+  try { return decodeURIComponent(pathname); } catch { return null; }
+}
+
+// One stat instead of existsSync + statSync — this runs per request candidate
+// on the dev/preview hot path.
+function isFile(p) {
+  const s = statSync(p, { throwIfNoEntry: false });
+  return s !== undefined && s.isFile();
+}
+
 const MIME = {
   '.html': 'text/html', '.js': 'text/javascript', '.mjs': 'text/javascript',
   '.css': 'text/css', '.json': 'application/json', '.svg': 'image/svg+xml',
@@ -208,7 +229,8 @@ export async function dev(overrides = {}) {
     development: true,
     async fetch(req, srv) {
       const url = new URL(req.url);
-      let path = decodeURIComponent(url.pathname);
+      const path = decodePath(url.pathname);
+      if (path === null) return new Response('Bad request', { status: 400 });
 
       // WebSocket channel for scoped component HMR.
       if (path === '/__spark_hmr') {
@@ -233,11 +255,12 @@ export async function dev(overrides = {}) {
       }
 
       // Static lookup: project root first (index.html, src/…), then publicDir.
+      // Each candidate is guarded against escaping its own base (path traversal).
       const rel = path.replace(/^\/+/, '');
-      const candidates = [join(projectRoot, rel), join(pub, rel)];
       let file = null;
-      for (const c of candidates) {
-        if (existsSync(c) && statSync(c).isFile()) { file = c; break; }
+      for (const b of [projectRoot, pub]) {
+        const c = safeJoin(b, rel);
+        if (c && isFile(c)) { file = c; break; }
       }
 
       // SPA fallback: extensionless paths serve the app shell (the router
@@ -327,12 +350,17 @@ export async function build(overrides = {}) {
       const file = clean.startsWith('/') ? join(projectRoot, clean.slice(1)) : join(entryDir, clean);
       // Only bundle files that live in the PROJECT (src/…) — anything served
       // from publicDir ships verbatim and its URL already works.
-      if (existsSync(file) && !file.startsWith(pub + '/')) found.push({ url, file });
+      if (existsSync(file) && !file.startsWith(pub + sep)) found.push({ url, file });
     }
 
     if (found.length) {
+      // Bun.build DEDUPES duplicate entrypoints (the same file listed twice —
+      // or reached via two URL spellings — yields ONE output), so bundle the
+      // UNIQUE files and map file → hashed name; never map outputs back by
+      // found-index, which would splice the wrong asset URL into the page.
+      const files = [...new Set(found.map((f) => f.file))];
       const result = await Bun.build({
-        entrypoints: found.map((f) => f.file),
+        entrypoints: files,
         outdir: join(outDir, 'assets'),
         minify: true,
         splitting: true,
@@ -345,12 +373,20 @@ export async function build(overrides = {}) {
         const msgs = (result.logs || []).map((l) => l.message || String(l)).join('\n');
         throw new Error(`[spark] build failed:\n${msgs}`);
       }
-      // Entry outputs come back in entrypoint order — map each to its URL.
+      // Entry outputs come back in entrypoint order (verified for Bun's
+      // splitting output, incl. same-basename entries) — map each unique
+      // file to its hashed name, then rewrite every tag that referenced it.
       const entryOuts = result.outputs.filter((o) => o.kind === 'entry-point');
-      found.forEach((f, i) => {
-        const name = entryOuts[i] && entryOuts[i].path.split('/').pop();
-        if (name) html = html.replaceAll(f.url, `${base}assets/${name}`);
-      });
+      const outName = new Map(files.map((file, i) => [file, entryOuts[i] && basename(entryOuts[i].path)]));
+      for (const f of found) {
+        const name = outName.get(f.file);
+        if (!name) continue;
+        const to = `${base}assets/${name}`;
+        // Replace only the quoted attribute value, so a longer URL that ends
+        // with this one (e.g. /lib/app.js vs /app.js) is never corrupted the
+        // way a bare replaceAll(url) would corrupt it.
+        for (const q of ['"', "'"]) html = html.split(`${q}${f.url}${q}`).join(`${q}${to}${q}`);
+      }
     }
     await Bun.write(join(outDir, config.entry.split('/').pop()), html);
   }
@@ -378,16 +414,18 @@ export async function preview(overrides = {}) {
     port: overrides.port ?? config.port ?? 4173,
     fetch(req) {
       const url = new URL(req.url);
-      let path = decodeURIComponent(url.pathname);
+      let path = decodePath(url.pathname);
+      if (path === null) return new Response('Bad request', { status: 400 });
       if (base !== '/' && path.startsWith(base)) path = '/' + path.slice(base.length);
       const rel = path.replace(/^\/+/, '');
+      // Guard every candidate against escaping outDir (path traversal).
       const tryFiles = [
-        join(outDir, rel === '' ? 'index.html' : rel),
-        join(outDir, rel + '.html'),
-        rel !== '' && rel.endsWith('/') ? join(outDir, rel, 'index.html') : null,
+        safeJoin(outDir, rel === '' ? 'index.html' : rel),
+        safeJoin(outDir, rel + '.html'),
+        rel !== '' && rel.endsWith('/') ? safeJoin(outDir, join(rel, 'index.html')) : null,
       ].filter(Boolean);
       for (const f of tryFiles) {
-        if (existsSync(f) && statSync(f).isFile()) {
+        if (isFile(f)) {
           return new Response(Bun.file(f), { headers: { 'Content-Type': mime(f) } });
         }
       }