Hacktoberfest 2026: los issues que los mantenedores marcaron para octubre, abiertos y aptos para principiantes. Explorar issues de Hacktoberfest

build.mjs and thumbs.mjs trust `meta.id` for file paths, and the id regex lives in three copies

Cerrado
  • ¿Algo no está bien?
#135 0 comentarios 0 reacciones 0 asignados Ver en GitHub

Los mantenedores suelen responder en 1 día

Nadie ha tomado este issue todavía.

Evaluación

Dificultad
4/5
Tiempo estimado
3-5 días
Aptitud para principiantes
52/100
Tipo de issue
Error
Claridad
Bien especificado
Estado de actividad
Activo
Stack tecnológico
javascript, node.js
Área
build-system, security

Línea de trabajo

Read site/build.mjs around lines 104 and 446, then inspect site/thumbs.mjs, site/validate.mjs, site/lib/scaffold.mjs, and site/checks.mjs for the repeated ID checks and file writes. The issue suggests a shared loader in site/lib/entry-files.mjs and pairing the change with #85. Done means one ID regex definition remains in site/, and a fixture with id: ../x makes node site/build.mjs exit 1 naming the file without touching disk.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

hardening priority: low

Why it matters

validate is the only place that enforces the id charset and id === filename. npm run build on its own, and thumbs.yml (which runs thumbs.mjs before validate), write files whose names come straight from frontmatter. CI order protects main, but a local node site/build.mjs with a bad id writes outside site/dist/.

Evidence (at 69387df)

  • site/build.mjs:446: writeOut(path.join("entry", entry.id, "index.html"), html) with entry.id = String(meta.id) (build.mjs:104). path.join("entry", "../../x", "index.html") resolves under the parent of DIST (build.mjs:292), and produced/pruneDist never see it.
  • site/thumbs.mjs:123-124, 244: ${entry.id}.src, ${entry.id}.webp in the temp dir and in site/public/thumbs/.
  • The same regex is written three times: site/validate.mjs:65, site/lib/scaffold.mjs:30 (exported ID_RE), site/checks.mjs:806 (inline).

Suggested approach

Give site/lib/entry-files.mjs one loader that reads the file, parses frontmatter, and refuses an entry whose id fails ID_RE or differs from the basename; have build, thumbs, check-links and reverify-batch use it. Export ID_RE from one module and import it everywhere. This pairs naturally with #85.

Done when

One definition of the id regex in site/; a fixture entry with id: ../x makes node site/build.mjs exit 1 naming the file, without touching the disk.

Lenguaje dominante
JavaScript
Estrellas
58
Forks
15
Merge medio
18 h 42 min
PR fusionados (30 d)
11

Preparar el entorno

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de TMHSDigital/Free-Game-Dev-Assets

Todos los issues de TMHSDigital/Free-Game-Dev-Assets

Issues similares

Más issues de JavaScript

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.