toolcraft-openapi 0.0.72 → 0.0.73

package/dist/bin/generate.js

@@ -554,20 +554,47 @@ async function assertSafeProjectPath(fs, cwd, filePath) {
         path.isAbsolute(relativePath)) {
         throw new Error("Generated skill output must remain inside the project directory.");
     }
-    const parentOfRoot = path.dirname(rootPath);
-    let currentPath = resolvedFilePath;
-    while (currentPath !== parentOfRoot) {
-        try {
-            if ((await fs.lstat(currentPath)).isSymbolicLink()) {
+    const canonicalRoot = await fs.realpath(cwd);
+    const canonicalFileParent = await realpathExistingAncestor(fs, path.dirname(filePath));
+    const relativeParentPath = path.relative(canonicalRoot, canonicalFileParent);
+    if (relativeParentPath === ".." ||
+        relativeParentPath.startsWith(`..${path.sep}`) ||
+        path.isAbsolute(relativeParentPath)) {
+        throw new Error("Generated skill output must remain inside the project directory.");
+    }
+    try {
+        if ((await fs.lstat(filePath)).isSymbolicLink()) {
+            const canonicalFilePath = await fs.realpath(filePath);
+            const relativeFilePath = path.relative(canonicalRoot, canonicalFilePath);
+            if (relativeFilePath === ".." ||
+                relativeFilePath.startsWith(`..${path.sep}`) ||
+                path.isAbsolute(relativeFilePath)) {
                 throw new Error("Generated skill output must remain inside the project directory.");
             }
         }
+    }
+    catch (error) {
+        if (!isNotFoundError(error)) {
+            throw error;
+        }
+    }
+}
+async function realpathExistingAncestor(fs, targetPath) {
+    let currentPath = targetPath;
+    while (true) {
+        try {
+            return await fs.realpath(currentPath);
+        }
         catch (error) {
             if (!isNotFoundError(error)) {
                 throw error;
             }
+            const parentPath = path.dirname(currentPath);
+            if (parentPath === currentPath) {
+                throw error;
+            }
+            currentPath = parentPath;
         }
-        currentPath = path.dirname(currentPath);
     }
 }
 async function atomicWriteGeneratedFile(fs, outputDir, filePath, contents) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "toolcraft-openapi",
-  "version": "0.0.72",
+  "version": "0.0.73",
   "type": "module",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -28,7 +28,7 @@
     "toolcraft-openapi-generate": "dist/bin/generate.js"
   },
   "dependencies": {
-    "toolcraft": "0.0.72",
+    "toolcraft": "0.0.73",
     "auth-store": "^0.0.1",
     "fast-string-width": "^3.0.2",
     "fast-wrap-ansi": "^0.2.0",