Hacktoberfest 2026: as issues que os mantenedores marcaram para outubro, abertas e boas para iniciantes. Ver issues do Hacktoberfest

build.mjs and thumbs.mjs trust `meta.id` for file paths, and the id regex lives in three copies

Fechada
  • Algo errado?
#135 0 comentários 0 reações 0 responsáveis Ver no GitHub

Mantenedores costumam responder em até 1 dia

Ninguém assumiu esta issue ainda.

Avaliação

Dificuldade
4/5
Tempo estimado
3-5 dias
Facilidade para iniciantes
52/100
Tipo de issue
Bug
Clareza
Claramente especificada
Status de atividade
Ativa
Stack de tecnologia
javascript, node.js
Domínio
build-system, security

Direção de pesquisa

Read site/build.mjs around lines 104 and 446, then inspect site/thumbs.mjs, site/validate.mjs, site/lib/scaffold.mjs, and site/checks.mjs for the repeated ID checks and file writes. The issue suggests a shared loader in site/lib/entry-files.mjs and pairing the change with #85. Done means one ID regex definition remains in site/, and a fixture with id: ../x makes node site/build.mjs exit 1 naming the file without touching disk.

Escrita pelo modelo de indexação a partir do texto da issue.

Descrição

hardening priority: low

Why it matters

validate is the only place that enforces the id charset and id === filename. npm run build on its own, and thumbs.yml (which runs thumbs.mjs before validate), write files whose names come straight from frontmatter. CI order protects main, but a local node site/build.mjs with a bad id writes outside site/dist/.

Evidence (at 69387df)

  • site/build.mjs:446: writeOut(path.join("entry", entry.id, "index.html"), html) with entry.id = String(meta.id) (build.mjs:104). path.join("entry", "../../x", "index.html") resolves under the parent of DIST (build.mjs:292), and produced/pruneDist never see it.
  • site/thumbs.mjs:123-124, 244: ${entry.id}.src, ${entry.id}.webp in the temp dir and in site/public/thumbs/.
  • The same regex is written three times: site/validate.mjs:65, site/lib/scaffold.mjs:30 (exported ID_RE), site/checks.mjs:806 (inline).

Suggested approach

Give site/lib/entry-files.mjs one loader that reads the file, parses frontmatter, and refuses an entry whose id fails ID_RE or differs from the basename; have build, thumbs, check-links and reverify-batch use it. Export ID_RE from one module and import it everywhere. This pairs naturally with #85.

Done when

One definition of the id regex in site/; a fixture entry with id: ../x makes node site/build.mjs exit 1 naming the file, without touching the disk.

Linguagem predominante
JavaScript
Estrelas
58
Forks
15
Merge médio
18h 42min
PRs com merge (30d)
11

Preparar o ambiente

Primeiros passos

  1. Leia a issue inteira e depois o guia de contribuição do projeto.
  2. Comente na issue dizendo que vai assumir — evita que duas pessoas façam o mesmo trabalho.
  3. Faça um fork do repositório e trabalhe em uma branch.
  4. Abra um pull request que referencie o número da issue.

Mais de TMHSDigital/Free-Game-Dev-Assets

Todas as issues de TMHSDigital/Free-Game-Dev-Assets

Issues semelhantes

Mais issues de JavaScript

Receba novas issues na sua caixa de entrada

Um resumo curto de issues do GitHub para quem está começando.