Security hardening from audit findings

.github/workflows/ci.yml

@@ -16,6 +16,7 @@ jobs:
           node-version: 22
           cache: npm
       - run: npm ci
+      - run: npm audit --audit-level=high
       - run: npm run lint --workspace @larkiny/astro-github-loader
       - run: npm test --workspace @larkiny/astro-github-loader
       - run: cd packages/astro-github-loader && npx tsc --noEmit

.gitignore

@@ -3,6 +3,10 @@ node_modules/
 
 *.tgz
 
+# environment variables
+.env
+.env.*
+
 # OS generated files
 .DS_Store
 .DS_Store?

packages/astro-github-loader/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@larkiny/astro-github-loader",
   "type": "module",
-  "version": "0.11.3",
+  "version": "0.12.0",
   "description": "Load content from GitHub repositories into Astro content collections with asset management and content transformations",
   "keywords": [
     "astro",

packages/astro-github-loader/src/github.link-transform.ts

@@ -189,6 +189,13 @@ function applyLinkMappings(
     let matched = false;
     let replacement = "";
 
+    const getLinkTransformContext = (): LinkTransformContext =>
+      context.currentFile.linkContext ?? {
+        sourcePath: context.currentFile.sourcePath,
+        targetPath: context.currentFile.targetPath,
+        basePath: "",
+      };
+
     if (typeof mapping.pattern === "string") {
       // String pattern - exact match or contains
       if (transformedPath.includes(mapping.pattern)) {
@@ -199,12 +206,10 @@ function applyLinkMappings(
             mapping.replacement,
           );
         } else {
-          const linkTransformContext =
-            context.currentFile.linkContext ?? ({} as LinkTransformContext);
           replacement = mapping.replacement(
             transformedPath,
             anchor,
-            linkTransformContext,
+            getLinkTransformContext(),
           );
         }
       }
@@ -219,12 +224,10 @@ function applyLinkMappings(
             mapping.replacement,
           );
         } else {
-          const linkTransformContext =
-            context.currentFile.linkContext ?? ({} as LinkTransformContext);
           replacement = mapping.replacement(
             transformedPath,
             anchor,
-            linkTransformContext,
+            getLinkTransformContext(),
           );
         }
       }

packages/astro-github-loader/src/github.storage.spec.ts

@@ -1,4 +1,5 @@
 import { beforeEach, describe, it, expect, vi } from "vitest";
+import { resolve } from "node:path";
 import { fileURLToPath, pathToFileURL } from "node:url";
 import { syncFile, storeProcessedFile } from "./github.storage.js";
 import { createMockContext } from "./test-helpers.js";
@@ -40,12 +41,14 @@ describe("syncFile", () => {
   it("creates directory and writes file when directory does not exist", async () => {
     await syncFile("some/nested/dir/file.md", "content");
 
-    expect(mockedExistsSync).toHaveBeenCalledWith("some/nested/dir");
-    expect(mockedMkdir).toHaveBeenCalledWith("some/nested/dir", {
+    const resolved = resolve("some/nested/dir/file.md");
+    const resolvedDir = resolved.substring(0, resolved.lastIndexOf("/"));
+    expect(mockedExistsSync).toHaveBeenCalledWith(resolvedDir);
+    expect(mockedMkdir).toHaveBeenCalledWith(resolvedDir, {
       recursive: true,
     });
     expect(mockedWriteFile).toHaveBeenCalledWith(
-      "some/nested/dir/file.md",
+      resolved,
       "content",
       "utf-8",
     );
@@ -56,10 +59,12 @@ describe("syncFile", () => {
 
     await syncFile("existing/dir/file.md", "content");
 
-    expect(mockedExistsSync).toHaveBeenCalledWith("existing/dir");
+    const resolved = resolve("existing/dir/file.md");
+    const resolvedDir = resolved.substring(0, resolved.lastIndexOf("/"));
+    expect(mockedExistsSync).toHaveBeenCalledWith(resolvedDir);
     expect(mockedMkdir).not.toHaveBeenCalled();
     expect(mockedWriteFile).toHaveBeenCalledWith(
-      "existing/dir/file.md",
+      resolved,
       "content",
       "utf-8",
     );
@@ -68,10 +73,9 @@ describe("syncFile", () => {
   it("skips mkdir when path has no directory component", async () => {
     await syncFile("file.md", "content");
 
-    // dir is "" which is falsy, so existsSync should not be called for dir check
-    expect(mockedMkdir).not.toHaveBeenCalled();
+    // resolved path still has a directory (cwd), but it exists
     expect(mockedWriteFile).toHaveBeenCalledWith(
-      "file.md",
+      resolve("file.md"),
       "content",
       "utf-8",
     );
@@ -82,11 +86,17 @@ describe("syncFile", () => {
     await syncFile("output/test.md", longContent);
 
     expect(mockedWriteFile).toHaveBeenCalledWith(
-      "output/test.md",
+      resolve("output/test.md"),
       longContent,
       "utf-8",
     );
   });
+
+  it("rejects paths that escape project root", async () => {
+    await expect(
+      syncFile("../../etc/passwd", "malicious"),
+    ).rejects.toThrow("resolves outside project root");
+  });
 });
 
 describe("storeProcessedFile", () => {

packages/astro-github-loader/src/github.storage.ts

@@ -1,18 +1,26 @@
 import { existsSync, promises as fs } from "node:fs";
+import { resolve } from "node:path";
 import { fileURLToPath, pathToFileURL } from "node:url";
 import type { ImportedFile } from "./github.link-transform.js";
 import type { ExtendedLoaderContext } from "./github.types.js";
 
 /**
  * Ensures directory exists and writes file to disk.
+ * Validates that the resolved path stays within the project root.
  * @internal
  */
-export async function syncFile(path: string, content: string) {
-  const dir = path.substring(0, path.lastIndexOf("/"));
+export async function syncFile(filePath: string, content: string) {
+  const resolved = resolve(filePath);
+  if (!resolved.startsWith(process.cwd())) {
+    throw new Error(
+      `syncFile: path "${filePath}" resolves outside project root`,
+    );
+  }
+  const dir = resolved.substring(0, resolved.lastIndexOf("/"));
   if (dir && !existsSync(dir)) {
     await fs.mkdir(dir, { recursive: true });
   }
-  await fs.writeFile(path, content, "utf-8");
+  await fs.writeFile(resolved, content, "utf-8");
 }
 
 /**