xedoc-cli 0.1.5 → 0.1.6

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "xedoc-cli",
-  "version": "0.1.5",
+  "version": "0.1.6",
   "description": "Local web UI for Codex account, chat, execution, and workspace management.",
   "author": "Edward Nguyen <monokaijs@gmail.com>",
   "type": "module",

package/server/index.mjs

@@ -3,8 +3,16 @@ import { createHmac, createHash, timingSafeEqual } from "node:crypto"
 import { createReadStream, mkdirSync, statSync } from "node:fs"
 import { createServer } from "node:http"
 import { homedir } from "node:os"
-import { dirname, extname, join, normalize, resolve } from "node:path"
-import { fileURLToPath } from "node:url"
+import {
+  dirname,
+  extname,
+  isAbsolute,
+  join,
+  normalize,
+  relative,
+  resolve,
+} from "node:path"
+import { fileURLToPath, pathToFileURL } from "node:url"
 import { PrismaClient } from "@prisma/client"
 import { createRequestListener } from "@react-router/node"
 import { Server as SocketServer } from "socket.io"
@@ -24,7 +32,9 @@ mkdirSync(dirname(databasePath), { recursive: true, mode: 0o700 })
 const prisma = new PrismaClient({
   datasources: { db: { url: databaseUrl } },
 })
-const build = await import(join(packageRoot, "build/server/index.js"))
+const build = await import(
+  pathToFileURL(join(packageRoot, "build/server/index.js")).href
+)
 const clientRoot = join(packageRoot, "build/client")
 const requestListener = createRequestListener({
   build,
@@ -161,7 +171,12 @@ function serveStaticAsset(request, response) {
   }
 
   const candidate = resolve(clientRoot, `.${normalize(pathname)}`)
-  if (!candidate.startsWith(`${clientRoot}/`) && candidate !== clientRoot) {
+  const relativeCandidate = relative(clientRoot, candidate)
+  if (
+    relativeCandidate.startsWith("..") ||
+    relativeCandidate === ".." ||
+    isAbsolute(relativeCandidate)
+  ) {
     return false
   }
 

package/build/client/assets/app-layout-BlCsViOn.js

@@ -1 +0,0 @@
-import{j as t,t as r}from"./jsx-runtime-Dafdqr5g.js";import{t as s}from"./app-shell-DuerBOKJ.js";var a=r(),o=t(function(){return(0,a.jsx)(s,{})});export{o as default};

package/build/client/assets/chat-DFejNUT4.js

@@ -1 +0,0 @@
-import{j as r,t as s}from"./jsx-runtime-Dafdqr5g.js";import{n as t}from"./app-shell-DuerBOKJ.js";var a=s(),o=r(function(){return(0,a.jsx)(t,{})});export{o as default};

package/build/client/assets/home-JBFbZcNX.js

@@ -1 +0,0 @@
-import{j as r,t as s}from"./jsx-runtime-Dafdqr5g.js";import{r as t}from"./app-shell-DuerBOKJ.js";var a=s(),o=r(function(){return(0,a.jsx)(t,{})});export{o as default};