Rebuild printable roast plans and remove machine-based adjustments

server/alog-library.js

@@ -4,6 +4,7 @@
 // and asserted to stay inside ALOG_DIR.
 
 import * as fs from "node:fs/promises";
+import { constants } from "node:fs";
 import * as path from "node:path";
 import * as os from "node:os";
 import { parseAlog } from "./alog.js";
@@ -41,7 +42,7 @@ export async function listAlogLibrary() {
 
 export async function readAlogFromLibrary(filenameParam) {
   const base = path.basename(String(filenameParam ?? ""));
-  if (!base || !base.toLowerCase().endsWith(".alog")) {
+  if (!base || base !== String(filenameParam) || !base.toLowerCase().endsWith(".alog")) {
     const err = new Error("Filename must end in .alog");
     err.code = "bad_filename";
     throw err;
@@ -59,12 +60,19 @@ export async function readAlogFromLibrary(filenameParam) {
     throw err;
   }
   let content;
+  let handle;
   try {
-    content = await fs.readFile(full, "utf8");
+    // Do not follow a symlink outside the operator's configured library.
+    handle = await fs.open(full, constants.O_RDONLY | constants.O_NOFOLLOW);
+    const stat = await handle.stat();
+    if (!stat.isFile() || stat.size > 8 * 1024 * 1024) throw new Error("Invalid library file");
+    content = await handle.readFile("utf8");
   } catch {
     const err = new Error(`${base} not found in the .alog library.`);
     err.code = "not_found";
     throw err;
+  } finally {
+    await handle?.close();
   }
   return parseAlog(content, base);
 }