golem15/msd-core
4
0
Fork 0
Code Issues 1 Pull Requests Actions Packages Projects Releases Wiki Activity

fix: harden installer migration paths

Browse Source
This commit is contained in:
Tom Boucher
2026-05-11 14:29:33 -04:00
parent 162935969f
commit 4e40ee8b2f
4 changed files with 114 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
get-shit-done/bin/lib/installer-migrations.cjs
View File

@@ -56,10 +56,14 @@ function normalizeRelPath(relPath) {
throw new Error('migration action relPath must be a non-empty string');
}
const normalized = relPath.replace(/\\/g, '/');
if (normalized.startsWith('/') || normalized.includes('../') || normalized === '..') {
if (path.isAbsolute(normalized) || path.win32.isAbsolute(normalized)) {
throw new Error(`migration action relPath must stay inside configDir: ${relPath}`);
}
return normalized;
const segments = normalized.split('/');
if (segments.some((segment) => segment === '' || segment === '.' || segment === '..')) {
throw new Error(`migration action relPath must stay inside configDir: ${relPath}`);
}
return segments.join('/');
}
function classifyArtifact(configDir, relPath, manifest) {