WARNING! Don't merge is just for test (new embedeable version) #18
Conversation
…nk-to-elpx-is-not-working
…able-version-refactor Integrates user theme management changes (CSS/JS handling for ELPX-imported themes) with static mode refactoring (subdirectory deployment support). Key changes merged: - User theme CSS/JS inline loading for preview - Static mode path handling for blob URL contexts - ResourceFetcher user theme methods (setUserThemeFiles, getUserTheme, getUserThemeAsync) - Static mode bundle URL generation Co-Authored-By: Claude Opus 4.5 <[email protected]>
… into release/3.1-embedable-version-refactor
… into release/3.1-embedable-version-refactor
|
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: ec576e4a31
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| // Security: ensure the path is within staticDir | ||
| const normalizedPath = path.normalize(fullPath); | ||
| if (!normalizedPath.startsWith(staticDir)) { | ||
| return new Response('Forbidden', { status: 403 }); |
There was a problem hiding this comment.
The containment check normalizedPath.startsWith(staticDir) is a string-prefix test, so a crafted request like exe://../static-assets/secret normalizes to a sibling directory whose path still starts with the static prefix (e.g., /resources/static-assets/...) and will be served by net.fetch. This means any rendered content that can issue exe:// requests (user HTML, previews, etc.) can read files outside the intended static directory if a sibling directory shares the prefix. Use a path-based check such as path.relative(staticDir, normalizedPath) and ensure it doesn’t start with .. (or compare against staticDir + path.sep) to enforce true containment.
Useful? React with 👍 / 👎.
No description provided.