mirror of
https://github.com/pbakaus/impeccable.git
synced 2026-09-17 00:26:41 +03:00
- Add shared validation helper (server/lib/validation.js) with ID regex, provider/type allowlists - Validate all route params against allowlists before filesystem operations to prevent path traversal - Strip stack traces and error.message from production error responses (generic "Internal server error") - Sanitize filenames in Content-Disposition headers - Add X-Content-Type-Options: nosniff and X-Frame-Options: DENY to dev server static responses - Add path traversal (.. ) checks to all static file handlers and catch-all fetch Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
37 lines
1.2 KiB
JavaScript
37 lines
1.2 KiB
JavaScript
import { readFileSync, existsSync } from "fs";
|
|
import { join, dirname } from "path";
|
|
import { fileURLToPath } from "url";
|
|
|
|
const __filename = fileURLToPath(import.meta.url);
|
|
const __dirname = dirname(__filename);
|
|
const PROJECT_ROOT = join(__dirname, "../../..");
|
|
|
|
const ALLOWED_PROVIDERS = ['cursor', 'claude-code', 'gemini', 'codex', 'agents', 'universal'];
|
|
|
|
export default function handler(req, res) {
|
|
try {
|
|
const { provider } = req.query;
|
|
|
|
if (!provider || !ALLOWED_PROVIDERS.includes(provider)) {
|
|
return res.status(400).json({ error: "Invalid provider" });
|
|
}
|
|
|
|
const distDir = join(PROJECT_ROOT, "dist");
|
|
const zipPath = join(distDir, `${provider}.zip`);
|
|
|
|
if (!existsSync(zipPath)) {
|
|
return res.status(404).json({ error: "Bundle not found" });
|
|
}
|
|
|
|
const content = readFileSync(zipPath);
|
|
res.setHeader("Content-Type", "application/zip");
|
|
const safeProvider = provider.replace(/[^a-zA-Z0-9._-]/g, '');
|
|
res.setHeader("Content-Disposition", `attachment; filename="impeccable-style-${safeProvider}.zip"`);
|
|
res.send(content);
|
|
} catch (error) {
|
|
console.error("Error downloading bundle:", error);
|
|
res.status(500).json({ error: "Internal server error" });
|
|
}
|
|
}
|
|
|