Merge branch 'main' into addPathForGHCommits

speced · Aug 23, 2024 · 8f5c5fb · 8f5c5fb
2 parents e9e9c92 + 3fc8588
commit 8f5c5fb
Show file tree

Hide file tree

Showing 3 changed files with 42 additions and 36 deletions.
diff --git a/package.json b/package.json
@@ -31,7 +31,7 @@
     "regenerate-docs": "node --trace-warnings ./build/scripts/regenerate-docs.js",
     "update-data-sources": "node build/scripts/update-data-sources.js"
   },
-  "packageManager": "pnpm@9.1.2",
+  "packageManager": "pnpm@9.8.0",
   "simple-git-hooks": {
     "post-merge": "pnpm i && pnpm build"
   },
@@ -45,10 +45,10 @@
     "@types/cors": "^2.8.17",
     "@types/express": "^4.17.21",
     "@types/morgan": "^1.9.9",
-    "@types/node": "^20.14.0",
+    "@types/node": "^20.16.1",
     "@types/split2": "^4.2.3",
-    "jasmine": "^5.1.0",
+    "jasmine": "^5.2.0",
     "simple-git-hooks": "^2.11.1",
-    "typescript": "^5.4.5"
+    "typescript": "^5.5.4"
   }
 }
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
diff --git a/utils/disk-cache.ts b/utils/disk-cache.ts
@@ -104,6 +104,12 @@ export class DiskCache<ValueType> {
   }
 
   private keyToFilePath(key: string) {
-    return path.join(env("DATA_DIR"), this.#path, `${key}.json`);
+    const baseDir = path.join(env("DATA_DIR"), this.#path);
+    const result = path.resolve(path.join(baseDir, `${key}.json`));
+    // avoid path traversal attack
+    if (!result.startsWith(baseDir)) {
+      throw new Error(`Invalid path: ${result}`);
+    }
+    return result;
   }
 }