Repository navigation
Conversation
Transition the server from manual file-system resolution to Bun's built-in routing system. This change optimizes performance by eliminating redundant disk I/O checks for the SPA entry point and simplifies the overall deployment pipeline. - Remove the `copyFrontend` task from the build script, as the frontend index is now handled via static imports at the code level. - Configure the `serve` object with explicit routes for '/', '/index.html', and '/view' to serve the imported index file. - Replace legacy file-serving logic and manual path validation in the `fetch` handler with a streamlined 404 fallback. - Introduce a `prod` helper function to maintain the development workflow by ensuring the backend continues to redirect to the Vite dev server when not in production. BREAKING CHANGE: - Internal Development: The deployment artifact structure has changed. The server executable no longer requires or expects a `frontend` folder to be present in its root directory at runtime, as the entry point is now resolved via internal Bun routes.
Ensure the application correctly resolves file paths when running as a compiled binary and prevent unauthorized access to system files through the static file server. - Centralize directory resolution in persistence helpers to handle production vs. development environment differences effectively. - Implement path traversal protection in the fetch handler by validating that requested files reside within the execution root. - Standardize JSON persistence to use provided paths directly instead of forcing a relative join with the current working directory. - Update the settings file path to dynamically resolve based on the environment-specific public directory. BREAKING CHANGE: JSON utility functions in the persistence layer no longer automatically resolve paths relative to the process root. - Internal Development: Developers must now use the `publicDir` or `execDir` helpers when specifying file paths to ensure consistent behavior across different deployment environments.
Refactor the file import handler to use centralized path resolution and enforce stricter security boundaries for asset management. - Replace manual environment-based path joining with the `publicDir` persistence helper to ensure consistent asset location regardless of the execution environment. - Centralize filename extraction and validation at the start of the `importRequest` function, eliminating redundant logic previously split between `POST` and `GET` methods. - Implement a strict path boundary check using `startsWith` to verify that resolved file paths remain within the temporary assets directory, effectively blocking advanced path traversal attempts. - Remove unnecessary URI decoding before `basename` extraction to standardize path handling.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
publicDirorexecDirhelpers when specifying file paths to ensure consistent behavior across different deployment environments.frontendfolder to be present in its root directory at runtime, as the entry point is now resolved via internal Bun routes.Overview
This PR hardens file resolution logic to prevent path traversal vulnerabilities and transitions the server to native Bun routing. These changes improve security boundaries, standardize path handling across execution environments, and optimize the deployment pipeline.
Key Changes
🐛 Bug Fixes
startsWithto block advanced path traversal attempts.🧹 Chore/Refactoring
copyFrontendbuild task.Version Bump
0.1.0