Files
pbakaus_impeccable/api/command-source/[id].js
T
Paul BakausandClaude Opus 4.6 b628e208e3 Harden API endpoints: input validation, error sanitization, security headers
- Add shared validation helper (server/lib/validation.js) with ID regex, provider/type allowlists
- Validate all route params against allowlists before filesystem operations to prevent path traversal
- Strip stack traces and error.message from production error responses (generic "Internal server error")
- Sanitize filenames in Content-Disposition headers
- Add X-Content-Type-Options: nosniff and X-Frame-Options: DENY to dev server static responses
- Add path traversal (.. ) checks to all static file handlers and catch-all fetch

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-03-05 09:58:05 -08:00

32 lines
927 B
JavaScript

import { readFileSync, existsSync } from "fs";
import { join, dirname } from "path";
import { fileURLToPath } from "url";
const __filename = fileURLToPath(import.meta.url);
const __dirname = dirname(__filename);
const PROJECT_ROOT = join(__dirname, "../..");
const VALID_ID = /^[a-zA-Z0-9_-]+$/;
export default function handler(req, res) {
try {
const { id } = req.query;
if (!id || !VALID_ID.test(id)) {
return res.status(400).json({ error: "Invalid command ID" });
}
const commandPath = join(PROJECT_ROOT, "source", "skills", id, "SKILL.md");
if (!existsSync(commandPath)) {
return res.status(404).json({ error: "Command not found" });
}
const content = readFileSync(commandPath, "utf-8");
res.status(200).json({ content });
} catch (error) {
console.error("Error in /api/command-source:", error);
res.status(500).json({ error: "Internal server error" });
}
}