snowspeeder/pi-web
Archived
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat: add external path access allowlist

Browse Source
This commit is contained in:
Federico Jaramillo Martinez
2026-06-23 12:30:30 +02:00
parent 997b821717
commit 9cc20d65fb
35 changed files with 1417 additions and 111 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/server/workspaces/pathSafety.ts
-16
View File
@@ -1,18 +1,6 @@
import { realpath } from "node:fs/promises";
import { isAbsolute, join, relative, sep } from "node:path";
export async function resolveInsideWorkspace(rootPath: string, relativePath: string | undefined): Promise<{ root: string; target: string; relativePath: string }> {
const requested = normalizeRelativePath(relativePath);
const root = await realpath(rootPath);
const joined = join(root, requested);
const target = await realpath(joined).catch((error: unknown) => {
if (isNodeErrorWithCode(error, "ENOENT")) throw new Error("Path does not exist");
throw error;
});
ensureInside(root, target);
return { root, target, relativePath: requested };
}
export async function resolveParentInsideWorkspace(rootPath: string, relativePath: string): Promise<{ root: string; target: string; relativePath: string }> {
const requested = normalizeRelativePath(relativePath);
const root = await realpath(rootPath);
@@ -30,10 +18,6 @@ export function normalizeRelativePath(input: string | undefined): string {
return parts.join("/");
}
function isNodeErrorWithCode(error: unknown, code: string): error is NodeJS.ErrnoException {
return typeof error === "object" && error !== null && "code" in error && error.code === code;
}
function ensureInside(root: string, target: string): void {
const rel = relative(root, target);
if (rel === "") return;