Skip to content

Commit d26a76e

Browse files
cs-rajcs-raj
authored
Merge pull request #1555 from contentstack/fix/dev
fixed the path traversal issues
2 parents 1938080 + 9f57892 commit d26a76e

File tree

12 files changed

+89
-86
lines changed

12 files changed

+89
-86
lines changed

‎packages/contentstack-import/src/import/modules/variant-entries.ts‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,6 @@
11
import path from 'path';
22
import { Import, ImportHelperMethodsConfig, LogType, ProjectStruct } from '@contentstack/cli-variants';
3+
import { sanitizePath } from '@contentstack/cli-utilities';
34
import { ImportConfig, ModuleClassParams } from '../../types';
45
import {
56
log,
@@ -20,9 +21,9 @@ export default class ImportVarientEntries {
2021
this.config = importConfig;
2122
this.personalization = importConfig.modules.personalization;
2223
this.projectMapperFilePath = path.resolve(
23-
this.config.data,
24+
sanitizePath(this.config.data),
2425
'mapper',
25-
this.personalization.dirName,
26+
sanitizePath(this.personalization.dirName),
2627
'projects',
2728
'projects.json',
2829
);

‎packages/contentstack-variants/src/export/attributes.ts‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
import omit from 'lodash/omit';
22
import { resolve as pResolve } from 'node:path';
3-
3+
import { sanitizePath } from '@contentstack/cli-utilities';
44
import { formatError, fsUtil, PersonalizationAdapter, log } from '../utils';
55
import { PersonalizationConfig, ExportConfig, AttributesConfig, AttributeStruct } from '../types';
66

@@ -19,10 +19,10 @@ export default class ExportAttributes extends PersonalizationAdapter<ExportConfi
1919
this.personalizationConfig = exportConfig.modules.personalization;
2020
this.attributesConfig = exportConfig.modules.attributes;
2121
this.attributesFolderPath = pResolve(
22-
exportConfig.data,
23-
exportConfig.branchName || '',
24-
this.personalizationConfig.dirName,
25-
this.attributesConfig.dirName,
22+
sanitizePath(exportConfig.data),
23+
sanitizePath(exportConfig.branchName || ''),
24+
sanitizePath(this.personalizationConfig.dirName),
25+
sanitizePath(this.attributesConfig.dirName),
2626
);
2727
this.attributes = [];
2828
}
@@ -37,7 +37,7 @@ export default class ExportAttributes extends PersonalizationAdapter<ExportConfi
3737
log(this.exportConfig, 'No Attributes found with the given project!', 'info');
3838
} else {
3939
this.sanitizeAttribs();
40-
fsUtil.writeFile(pResolve(this.attributesFolderPath, this.attributesConfig.fileName), this.attributes);
40+
fsUtil.writeFile(pResolve(sanitizePath(this.attributesFolderPath), sanitizePath(this.attributesConfig.fileName)), this.attributes);
4141
log(this.exportConfig, 'All the attributes have been exported successfully!', 'success');
4242
}
4343
} catch (error) {

‎packages/contentstack-variants/src/export/experiences.ts‎

Lines changed: 7 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,5 @@
11
import * as path from 'path';
2+
import { sanitizePath } from '@contentstack/cli-utilities';
23
import { PersonalizationConfig, ExportConfig, ExperienceStruct } from '../types';
34
import { formatError, fsUtil, log, PersonalizationAdapter } from '../utils';
45

@@ -19,9 +20,9 @@ export default class ExportExperiences extends PersonalizationAdapter<ExportConf
1920
this.exportConfig = exportConfig;
2021
this.personalizationConfig = exportConfig.modules.personalization;
2122
this.experiencesFolderPath = path.resolve(
22-
exportConfig.data,
23-
exportConfig.branchName || '',
24-
this.personalizationConfig.dirName,
23+
sanitizePath(exportConfig.data),
24+
sanitizePath(exportConfig.branchName || ''),
25+
sanitizePath(this.personalizationConfig.dirName),
2526
'experiences',
2627
);
2728
}
@@ -38,7 +39,7 @@ export default class ExportExperiences extends PersonalizationAdapter<ExportConf
3839
log(this.exportConfig, 'No Experiences found with the give project', 'info');
3940
return;
4041
}
41-
fsUtil.writeFile(path.resolve(this.experiencesFolderPath, 'experiences.json'), experiences);
42+
fsUtil.writeFile(path.resolve(sanitizePath(this.experiencesFolderPath), 'experiences.json'), experiences);
4243

4344
const experienceToVariantsStrList: Array<string> = [];
4445
const experienceToContentTypesMap: Record<string, string[]> = {};
@@ -62,12 +63,12 @@ export default class ExportExperiences extends PersonalizationAdapter<ExportConf
6263
}
6364
}
6465
fsUtil.writeFile(
65-
path.resolve(this.experiencesFolderPath, 'experiences-variants-ids.json'),
66+
path.resolve(sanitizePath(this.experiencesFolderPath), 'experiences-variants-ids.json'),
6667
experienceToVariantsStrList,
6768
);
6869

6970
fsUtil.writeFile(
70-
path.resolve(this.experiencesFolderPath, 'experiences-content-types.json'),
71+
path.resolve(sanitizePath(this.experiencesFolderPath), 'experiences-content-types.json'),
7172
experienceToContentTypesMap,
7273
);
7374
log(this.exportConfig, 'All the experiences have been exported successfully!', 'success');

‎packages/contentstack-variants/src/export/projects.ts‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
import * as path from 'path';
2-
2+
import { sanitizePath } from '@contentstack/cli-utilities';
33
import { ExportConfig, PersonalizationConfig } from '../types';
44
import { PersonalizationAdapter, log, fsUtil, formatError } from '../utils';
55

@@ -16,9 +16,9 @@ export default class ExportProjects extends PersonalizationAdapter<ExportConfig>
1616
this.exportConfig = exportConfig;
1717
this.personalizationConfig = exportConfig.modules.personalization;
1818
this.projectFolderPath = path.resolve(
19-
exportConfig.data,
20-
exportConfig.branchName || '',
21-
this.personalizationConfig.dirName,
19+
sanitizePath(exportConfig.data),
20+
sanitizePath(exportConfig.branchName || ''),
21+
sanitizePath(this.personalizationConfig.dirName),
2222
'projects',
2323
);
2424
}
@@ -35,7 +35,7 @@ export default class ExportProjects extends PersonalizationAdapter<ExportConfig>
3535
}
3636
this.exportConfig.personalizationEnabled = true;
3737
this.exportConfig.project_id = project[0]?.uid;
38-
fsUtil.writeFile(path.resolve(this.projectFolderPath, 'projects.json'), project);
38+
fsUtil.writeFile(path.resolve(sanitizePath(this.projectFolderPath), 'projects.json'), project);
3939
log(this.exportConfig, 'Project exported successfully!', 'success');
4040
} catch (error) {
4141
log(this.exportConfig, `Failed to export projects!`, 'error');

‎packages/contentstack-variants/src/export/variant-entries.ts‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
import { existsSync, mkdirSync } from 'fs';
22
import { join, resolve } from 'path';
3-
import { FsUtility } from '@contentstack/cli-utilities';
3+
import { FsUtility, sanitizePath } from '@contentstack/cli-utilities';
44

55
import { APIConfig, AdapterType, ExportConfig, LogType } from '../types';
66
import VariantAdapter, { VariantHttpClient } from '../utils/variant-api-adapter';
@@ -25,7 +25,7 @@ export default class VariantEntries extends VariantAdapter<VariantHttpClient<Exp
2525
},
2626
};
2727
super(Object.assign(config, conf));
28-
this.entriesDirPath = resolve(config.data, config.branchName || '', config.modules.entries.dirName);
28+
this.entriesDirPath = resolve(sanitizePath(config.data), sanitizePath(config.branchName || ''), sanitizePath(config.modules.entries.dirName));
2929
}
3030

3131
/**
@@ -39,7 +39,7 @@ export default class VariantEntries extends VariantAdapter<VariantHttpClient<Exp
3939

4040
for (let index = 0; index < entries.length; index++) {
4141
const entry = entries[index];
42-
const variantEntryBasePath = join(this.entriesDirPath, content_type_uid, locale, variantEntry.dirName, entry.uid);
42+
const variantEntryBasePath = join(sanitizePath(this.entriesDirPath), sanitizePath(content_type_uid), sanitizePath(locale), sanitizePath(variantEntry.dirName), sanitizePath(entry.uid));
4343
const variantEntriesFs = new FsUtility({
4444
isArray: true,
4545
keepMetadata: false,

‎packages/contentstack-variants/src/import/attribute.ts‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
import { resolve } from 'path';
22
import { existsSync } from 'fs';
3-
3+
import { sanitizePath } from '@contentstack/cli-utilities';
44
import { PersonalizationAdapter, fsUtil } from '../utils';
55
import { APIConfig, AttributeStruct, ImportConfig, LogType } from '../types';
66

@@ -21,9 +21,9 @@ export default class Attribute extends PersonalizationAdapter<ImportConfig> {
2121
super(Object.assign(config, conf));
2222
this.personalizationConfig = this.config.modules.personalization;
2323
this.attributeConfig = this.personalizationConfig.attributes;
24-
this.mapperDirPath = resolve(this.config.backupDir, 'mapper', this.personalizationConfig.dirName);
25-
this.attrMapperDirPath = resolve(this.mapperDirPath, this.attributeConfig.dirName);
26-
this.attributesUidMapperPath = resolve(this.attrMapperDirPath, 'uid-mapping.json');
24+
this.mapperDirPath = resolve(sanitizePath(this.config.backupDir), 'mapper', sanitizePath(this.personalizationConfig.dirName));
25+
this.attrMapperDirPath = resolve(sanitizePath(this.mapperDirPath), sanitizePath(this.attributeConfig.dirName));
26+
this.attributesUidMapperPath = resolve(sanitizePath(this.attrMapperDirPath), 'uid-mapping.json');
2727
this.attributesUidMapper = {};
2828
}
2929

@@ -35,7 +35,7 @@ export default class Attribute extends PersonalizationAdapter<ImportConfig> {
3535

3636
await fsUtil.makeDirectory(this.attrMapperDirPath);
3737
const { dirName, fileName } = this.attributeConfig;
38-
const attributesPath = resolve(this.config.data, this.personalizationConfig.dirName, dirName, fileName);
38+
const attributesPath = resolve(sanitizePath(this.config.data), sanitizePath(this.personalizationConfig.dirName), sanitizePath(dirName), sanitizePath(fileName));
3939

4040
if (existsSync(attributesPath)) {
4141
try {

‎packages/contentstack-variants/src/import/audiences.ts‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
import { resolve } from 'path';
22
import { existsSync } from 'fs';
3-
3+
import { sanitizePath } from '@contentstack/cli-utilities';
44
import { APIConfig, AudienceStruct, ImportConfig, LogType } from '../types';
55
import { PersonalizationAdapter, fsUtil, lookUpAttributes } from '../utils';
66

@@ -24,10 +24,10 @@ export default class Audiences extends PersonalizationAdapter<ImportConfig> {
2424
this.personalizationConfig = this.config.modules.personalization;
2525
this.audienceConfig = this.personalizationConfig.audiences;
2626
this.attributeConfig = this.personalizationConfig.attributes;
27-
this.mapperDirPath = resolve(this.config.backupDir, 'mapper', this.personalizationConfig.dirName);
28-
this.audienceMapperDirPath = resolve(this.mapperDirPath, this.audienceConfig.dirName);
29-
this.audiencesUidMapperPath = resolve(this.audienceMapperDirPath, 'uid-mapping.json');
30-
this.attributesMapperPath = resolve(this.mapperDirPath, this.attributeConfig.dirName, 'uid-mapping.json');
27+
this.mapperDirPath = resolve(sanitizePath(this.config.backupDir), 'mapper', sanitizePath(this.personalizationConfig.dirName));
28+
this.audienceMapperDirPath = resolve(sanitizePath(this.mapperDirPath), sanitizePath(this.audienceConfig.dirName));
29+
this.audiencesUidMapperPath = resolve(sanitizePath(this.audienceMapperDirPath), 'uid-mapping.json');
30+
this.attributesMapperPath = resolve(sanitizePath(this.mapperDirPath), sanitizePath(this.attributeConfig.dirName), 'uid-mapping.json');
3131
this.audiencesUidMapper = {};
3232
}
3333

@@ -39,7 +39,7 @@ export default class Audiences extends PersonalizationAdapter<ImportConfig> {
3939

4040
await fsUtil.makeDirectory(this.audienceMapperDirPath);
4141
const { dirName, fileName } = this.audienceConfig;
42-
const audiencesPath = resolve(this.config.data, this.personalizationConfig.dirName, dirName, fileName);
42+
const audiencesPath = resolve(sanitizePath(this.config.data), sanitizePath(this.personalizationConfig.dirName), sanitizePath(dirName), sanitizePath(fileName));
4343

4444
if (existsSync(audiencesPath)) {
4545
try {

‎packages/contentstack-variants/src/import/events.ts‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
import { resolve } from 'path';
22
import { existsSync } from 'fs';
3-
3+
import { sanitizePath } from '@contentstack/cli-utilities';
44
import { PersonalizationAdapter, fsUtil } from '../utils';
55
import { APIConfig, EventStruct, ImportConfig, LogType } from '../types';
66

@@ -21,9 +21,9 @@ export default class Events extends PersonalizationAdapter<ImportConfig> {
2121
super(Object.assign(config, conf));
2222
this.personalizationConfig = this.config.modules.personalization;
2323
this.eventsConfig = this.personalizationConfig.events;
24-
this.mapperDirPath = resolve(this.config.backupDir, 'mapper', this.personalizationConfig.dirName);
25-
this.eventMapperDirPath = resolve(this.mapperDirPath, this.eventsConfig.dirName);
26-
this.eventsUidMapperPath = resolve(this.eventMapperDirPath, 'uid-mapping.json');
24+
this.mapperDirPath = resolve(sanitizePath(this.config.backupDir), 'mapper', sanitizePath(this.personalizationConfig.dirName));
25+
this.eventMapperDirPath = resolve(sanitizePath(this.mapperDirPath), sanitizePath(this.eventsConfig.dirName));
26+
this.eventsUidMapperPath = resolve(sanitizePath(this.eventMapperDirPath), 'uid-mapping.json');
2727
this.eventsUidMapper = {};
2828
}
2929

@@ -35,7 +35,7 @@ export default class Events extends PersonalizationAdapter<ImportConfig> {
3535

3636
await fsUtil.makeDirectory(this.eventMapperDirPath);
3737
const { dirName, fileName } = this.eventsConfig;
38-
const eventsPath = resolve(this.config.data, this.personalizationConfig.dirName, dirName, fileName);
38+
const eventsPath = resolve(sanitizePath(this.config.data), sanitizePath(this.personalizationConfig.dirName), sanitizePath(dirName), sanitizePath(fileName));
3939

4040
if (existsSync(eventsPath)) {
4141
try {

‎packages/contentstack-variants/src/import/experiences.ts‎

Lines changed: 20 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@ import { join, resolve } from 'path';
22
import { existsSync } from 'fs';
33
import values from 'lodash/values';
44
import cloneDeep from 'lodash/cloneDeep';
5-
5+
import { sanitizePath } from '@contentstack/cli-utilities';
66
import { PersonalizationAdapter, fsUtil, lookUpAudiences, lookUpEvents } from '../utils';
77
import { APIConfig, ImportConfig, ExperienceStruct, CreateExperienceInput, LogType } from '../types';
88

@@ -46,38 +46,38 @@ export default class Experiences extends PersonalizationAdapter<ImportConfig> {
4646
super(Object.assign(config, conf));
4747
this.personalizationConfig = this.config.modules.personalization;
4848
this.experiencesDirPath = resolve(
49-
this.config.data,
50-
this.personalizationConfig.dirName,
51-
this.personalizationConfig.experiences.dirName,
49+
sanitizePath(this.config.data),
50+
sanitizePath(this.personalizationConfig.dirName),
51+
sanitizePath(this.personalizationConfig.experiences.dirName),
5252
);
53-
this.experiencesPath = join(this.experiencesDirPath, this.personalizationConfig.experiences.fileName);
53+
this.experiencesPath = join(sanitizePath(this.experiencesDirPath), sanitizePath(this.personalizationConfig.experiences.fileName));
5454
this.experienceConfig = this.personalizationConfig.experiences;
5555
this.audienceConfig = this.personalizationConfig.audiences;
56-
this.mapperDirPath = resolve(this.config.backupDir, 'mapper', this.personalizationConfig.dirName);
57-
this.expMapperDirPath = resolve(this.mapperDirPath, this.experienceConfig.dirName);
58-
this.experiencesUidMapperPath = resolve(this.expMapperDirPath, 'uid-mapping.json');
59-
this.cmsVariantGroupPath = resolve(this.expMapperDirPath, 'cms-variant-groups.json');
60-
this.cmsVariantPath = resolve(this.expMapperDirPath, 'cms-variants.json');
61-
this.audiencesMapperPath = resolve(this.mapperDirPath, this.audienceConfig.dirName, 'uid-mapping.json');
62-
this.eventsMapperPath = resolve(this.mapperDirPath, 'events', 'uid-mapping.json');
63-
this.failedCmsExpPath = resolve(this.expMapperDirPath, 'failed-cms-experience.json');
64-
this.failedCmsExpPath = resolve(this.expMapperDirPath, 'failed-cms-experience.json');
65-
this.experienceCTsPath = resolve(this.experiencesDirPath, 'experiences-content-types.json');
56+
this.mapperDirPath = resolve(sanitizePath(this.config.backupDir), 'mapper', sanitizePath(this.personalizationConfig.dirName));
57+
this.expMapperDirPath = resolve(sanitizePath(this.mapperDirPath), sanitizePath(this.experienceConfig.dirName));
58+
this.experiencesUidMapperPath = resolve(sanitizePath(this.expMapperDirPath), 'uid-mapping.json');
59+
this.cmsVariantGroupPath = resolve(sanitizePath(this.expMapperDirPath), 'cms-variant-groups.json');
60+
this.cmsVariantPath = resolve(sanitizePath(this.expMapperDirPath), 'cms-variants.json');
61+
this.audiencesMapperPath = resolve(sanitizePath(this.mapperDirPath), sanitizePath(this.audienceConfig.dirName), 'uid-mapping.json');
62+
this.eventsMapperPath = resolve(sanitizePath(this.mapperDirPath), 'events', 'uid-mapping.json');
63+
this.failedCmsExpPath = resolve(sanitizePath(this.expMapperDirPath), 'failed-cms-experience.json');
64+
this.failedCmsExpPath = resolve(sanitizePath(this.expMapperDirPath), 'failed-cms-experience.json');
65+
this.experienceCTsPath = resolve(sanitizePath(this.experiencesDirPath), 'experiences-content-types.json');
6666
this.experienceVariantsIdsPath = resolve(
67-
this.config.data,
68-
this.personalizationConfig.dirName,
69-
this.experienceConfig.dirName,
67+
sanitizePath(this.config.data),
68+
sanitizePath(this.personalizationConfig.dirName),
69+
sanitizePath(this.experienceConfig.dirName),
7070
'experiences-variants-ids.json',
7171
);
72-
this.variantUidMapperFilePath = resolve(this.expMapperDirPath, 'variants-uid-mapping.json');
72+
this.variantUidMapperFilePath = resolve(sanitizePath(this.expMapperDirPath), 'variants-uid-mapping.json');
7373
this.experiencesUidMapper = {};
7474
this.cmsVariantGroups = {};
7575
this.cmsVariants = {};
7676
this.expThresholdTimer = this.experienceConfig?.thresholdTimer ?? 30000;
7777
this.expCheckIntervalDuration = this.experienceConfig?.checkIntervalDuration ?? 5000;
7878
this.maxValidateRetry = Math.round(this.expThresholdTimer / this.expCheckIntervalDuration);
7979
this.pendingVariantAndVariantGrpForExperience = [];
80-
this.cTsSuccessPath = resolve(this.config.backupDir, 'mapper', 'content_types', 'success.json');
80+
this.cTsSuccessPath = resolve(sanitizePath(this.config.backupDir), 'mapper', 'content_types', 'success.json');
8181
this.createdCTs = [];
8282
}
8383

‎packages/contentstack-variants/src/import/project.ts‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
import { join, resolve as pResolve } from 'path';
22
import { existsSync, readFileSync } from 'fs';
3-
3+
import { sanitizePath } from '@contentstack/cli-utilities';
44
import { PersonalizationAdapter, askProjectName, fsUtil } from '../utils';
55
import { APIConfig, CreateProjectInput, ImportConfig, LogType, ProjectStruct } from '../types';
66

@@ -14,9 +14,9 @@ export default class Project extends PersonalizationAdapter<ImportConfig> {
1414
};
1515
super(Object.assign(config, conf));
1616
this.projectMapperFolderPath = pResolve(
17-
this.config.backupDir,
17+
sanitizePath(this.config.backupDir),
1818
'mapper',
19-
this.config.modules.personalization.dirName,
19+
sanitizePath(this.config.modules.personalization.dirName),
2020
'projects',
2121
);
2222
}
@@ -28,7 +28,7 @@ export default class Project extends PersonalizationAdapter<ImportConfig> {
2828
async import() {
2929
const personalization = this.config.modules.personalization;
3030
const { dirName, fileName } = personalization.projects;
31-
const projectPath = join(this.config.data, personalization.dirName, dirName, fileName);
31+
const projectPath = join(sanitizePath(this.config.data), sanitizePath(personalization.dirName), sanitizePath(dirName), sanitizePath(fileName));
3232

3333
if (existsSync(projectPath)) {
3434
const projects = JSON.parse(readFileSync(projectPath, 'utf8')) as CreateProjectInput[];
@@ -60,7 +60,7 @@ export default class Project extends PersonalizationAdapter<ImportConfig> {
6060
this.config.modules.personalization.importData = true;
6161

6262
await fsUtil.makeDirectory(this.projectMapperFolderPath);
63-
fsUtil.writeFile(pResolve(this.projectMapperFolderPath, 'projects.json'), projectRes);
63+
fsUtil.writeFile(pResolve(sanitizePath(this.projectMapperFolderPath), 'projects.json'), projectRes);
6464
this.log(this.config, `Project Created Successfully: ${projectRes.uid}`, 'info');
6565
}
6666
} else {

0 commit comments

Comments
 (0)