mirror of
https://github.com/heygen-com/hyperframes.git
synced 2026-09-01 19:42:03 +00:00
ukimsanov
bd7ea5d5ce
Miguel's P1 on #2975, and it is real. `catalog-previews.yml` triggers on `pull_request` for anything under `registry/blocks/**` or `registry/components/**`, so `registry-item.json` arrives from the pull request and is untrusted. `mirrorRegistryTargets` joined `files[].path` and `files[].target` under the temp project and called `cpSync` on the result, and `join()` walks out of its first argument. A `path` of `../../../../etc/passwd` reads an arbitrary runner file into the project — which the job then uploads as an artifact — and a `target` of the same shape writes an arbitrary runner path. Both sides are now resolved and rejected when `relative(projectDir, candidate)` is absolute or starts with `..`. Traversal that lands back inside the project still works, so `nested/../demo.html` is unaffected. Containment lives in `scripts/registry-target-paths.mjs` rather than inline, because the traversal cases have to be testable and importing `generate-catalog-previews.ts` drags in the producer. `existsSync` is injected so the decision cannot depend on whether the target happens to exist on the runner. Eight tests, covering traversal on each field separately, absolute paths on each field, the sibling directory that shares the project's prefix, and traversal that returns inside. Verified end to end on a real tree, not only in unit tests: a manifest asking to read `../secret.txt` and write `../pwned.txt` produces neither file, while the legitimate entry still copies. I introduced the wrapper when I extracted this block for a complexity finding earlier in the stack, and did not look at what it was joining.
89 lines
5.1 KiB
JSON
89 lines
5.1 KiB
JSON
{
|
|
"name": "hyperframes-monorepo",
|
|
"private": true,
|
|
"repository": {
|
|
"type": "git",
|
|
"url": "https://github.com/heygen-com/hyperframes"
|
|
},
|
|
"workspaces": [
|
|
"packages/*"
|
|
],
|
|
"type": "module",
|
|
"scripts": {
|
|
"dev": "bun run studio",
|
|
"build": "bun run --filter '@hyperframes/{parsers,lint,studio-server}' build && bun run --filter @hyperframes/core build && bun run --filter '@hyperframes/{core,engine,producer,player,studio,shader-transitions,aws-lambda,gcp-cloud-run,sdk}' build && bun run --filter @hyperframes/cli build && bun run --filter @hyperframes/sdk-playground build",
|
|
"build:producer": "bun run --filter @hyperframes/producer build",
|
|
"studio": "bun run --filter @hyperframes/studio dev",
|
|
"build:hyperframes-runtime": "bun run --filter @hyperframes/core build:hyperframes-runtime",
|
|
"build:hyperframes-runtime:modular": "bun run --filter @hyperframes/core build:hyperframes-runtime:modular",
|
|
"verify:packed-manifests": "node scripts/verify-packed-manifests.mjs",
|
|
"validate:release-channel": "node scripts/validate-release-channel.mjs",
|
|
"set-version": "tsx scripts/set-version.ts",
|
|
"release:prepare": "tsx scripts/release-prepare.ts",
|
|
"changelog:draft": "tsx scripts/draft-changelog.ts",
|
|
"changelog:weekly": "tsx scripts/changelog-weekly.ts",
|
|
"sync-schemas": "tsx scripts/sync-schemas.ts",
|
|
"sync-schemas:check": "tsx scripts/sync-schemas.ts --check",
|
|
"sync:package-subpaths": "node scripts/package-subpaths.mjs --write",
|
|
"check:package-subpaths": "node scripts/package-subpaths.mjs",
|
|
"lint": "bun run check:docs-snippet-motion && bun run check:tracked-artifacts && bun run check:workspace-contracts && bun run check:gcp-cloud-run-dockerfile && bun run check:package-cycles && bun run check:package-subpaths && bun run check:cli-process-ownership && oxlint . && tsx scripts/lint-skills.ts && node scripts/check-skill-mirror.mjs",
|
|
"check:gcp-cloud-run-dockerfile": "bun run --cwd packages/gcp-cloud-run test:dockerfile-workspaces",
|
|
"lint:skills": "tsx scripts/lint-skills.ts",
|
|
"check:skill-mirror": "node scripts/check-skill-mirror.mjs",
|
|
"lint:fix": "oxlint --fix .",
|
|
"check:tracked-artifacts": "node scripts/check-tracked-artifacts.mjs",
|
|
"check:docs-snippet-motion": "node scripts/check-docs-snippet-motion.mjs",
|
|
"check:workspace-contracts": "node scripts/check-workspace-contracts.mjs",
|
|
"check:package-cycles": "node scripts/check-package-cycles.mjs",
|
|
"check:cli-process-ownership": "node scripts/check-cli-process-ownership.mjs",
|
|
"format": "oxfmt .",
|
|
"test": "bun run test:unit",
|
|
"test:unit": "bun run --filter '*' test",
|
|
"producer:test:classification": "bun run --cwd packages/producer test:classification",
|
|
"producer:test:unit": "bun run --cwd packages/producer test:unit",
|
|
"producer:test:unit:bun": "bun run --cwd packages/producer test:unit:bun",
|
|
"producer:test:unit:vitest": "bun run --cwd packages/producer test:unit:vitest",
|
|
"producer:test:integration": "bun run --cwd packages/producer test:integration",
|
|
"test:regression": "bun run --cwd packages/producer test:regression",
|
|
"player:perf": "bun run --filter @hyperframes/player perf",
|
|
"format:check": "oxfmt --check .",
|
|
"knip": "knip",
|
|
"test:scripts": "node --import tsx --test scripts/check-tracked-artifacts.test.mjs scripts/check-docs-snippet-motion.test.mjs scripts/registry-target-paths.test.mjs scripts/check-workspace-contracts.test.mjs scripts/check-package-cycles.test.mjs scripts/check-cli-process-ownership.test.mjs scripts/package-subpaths.test.mjs scripts/validate-release-channel.test.mjs scripts/publish-workflow.test.mjs scripts/draft-changelog.test.ts scripts/set-version.test.ts scripts/release-prepare.test.ts scripts/cli-options.test.ts scripts/changelog-weekly.test.ts scripts/claude-plugin-compression.test.ts scripts/studio-runtime-smoke.test.mjs scripts/verify-packed-manifests.test.mjs scripts/lint-skills.test.mjs packages/gcp-cloud-run/check-dockerfile-workspaces.test.mjs",
|
|
"test:skills": "node --test 'skills/**/*.test.mjs'",
|
|
"generate:previews": "tsx scripts/generate-template-previews.ts",
|
|
"generate:catalog-previews": "tsx scripts/generate-catalog-previews.ts",
|
|
"package:codex-plugin": "node scripts/package-codex-plugin.mjs",
|
|
"upload:docs-images": "bash scripts/upload-docs-images.sh",
|
|
"prepare": "test -d .git && lefthook install || true",
|
|
"lint:registry-items": "node scripts/lint-registry-items.mjs"
|
|
},
|
|
"devDependencies": {
|
|
"@commitlint/cli": "^20.5.0",
|
|
"@commitlint/config-conventional": "^20.5.0",
|
|
"@hyperframes/player": "workspace:*",
|
|
"@types/node": "^25.0.10",
|
|
"concurrently": "^8.2.0",
|
|
"fallow": "^2.75.0",
|
|
"happy-dom": "^20.9.0",
|
|
"knip": "^6.0.3",
|
|
"lefthook": "^2.1.4",
|
|
"oxfmt": "^0.41.0",
|
|
"oxlint": "^1.56.0",
|
|
"tsx": "^4.21.0",
|
|
"typescript": "^5.0.0",
|
|
"yaml": "^2.9.0"
|
|
},
|
|
"resolutions": {
|
|
"@types/react": "^19.0.0",
|
|
"@types/react-dom": "^19.0.0",
|
|
"react": "^19.0.0",
|
|
"react-dom": "^19.0.0"
|
|
},
|
|
"overrides": {
|
|
"@types/react": "^19.0.0",
|
|
"@types/react-dom": "^19.0.0",
|
|
"react": "^19.0.0",
|
|
"react-dom": "^19.0.0"
|
|
}
|
|
}
|