| 9 | } |
| 10 | |
| 11 | export function resolveSafePublicFilePath(filePath: string): PublicFilePathResolution | null { |
| 12 | let decodedFilePath: string; |
| 13 | |
| 14 | try { |
| 15 | decodedFilePath = decodeURIComponent(filePath); |
| 16 | } catch { |
| 17 | return null; |
| 18 | } |
| 19 | |
| 20 | if (!decodedFilePath || decodedFilePath.includes('\0')) { |
| 21 | return null; |
| 22 | } |
| 23 | |
| 24 | const normalizedRelativePath = normalize(decodedFilePath.replaceAll('\\', '/')); |
| 25 | |
| 26 | if ( |
| 27 | normalizedRelativePath.startsWith('/') || |
| 28 | normalizedRelativePath.startsWith('../') || |
| 29 | normalizedRelativePath === '..' |
| 30 | ) { |
| 31 | return null; |
| 32 | } |
| 33 | |
| 34 | const publicRootPath = resolve('public'); |
| 35 | const resolvedPublicFilePath = resolve(publicRootPath, normalizedRelativePath); |
| 36 | |
| 37 | if ( |
| 38 | resolvedPublicFilePath !== publicRootPath && |
| 39 | !resolvedPublicFilePath.startsWith(`${publicRootPath}/`) |
| 40 | ) { |
| 41 | return null; |
| 42 | } |
| 43 | |
| 44 | return { |
| 45 | absolutePath: resolvedPublicFilePath, |
| 46 | relativePath: normalizedRelativePath, |
| 47 | }; |
| 48 | } |
| 49 | |
| 50 | async function transpileTs(content: string, specifier: URL) { |
| 51 | const urlStr = specifier.toString(); |