Files
pbakaus_impeccable/api/download/bundle/[provider].js
T
Paul BakausandClaude Opus 4.6 b628e208e3 Harden API endpoints: input validation, error sanitization, security headers
- Add shared validation helper (server/lib/validation.js) with ID regex, provider/type allowlists
- Validate all route params against allowlists before filesystem operations to prevent path traversal
- Strip stack traces and error.message from production error responses (generic "Internal server error")
- Sanitize filenames in Content-Disposition headers
- Add X-Content-Type-Options: nosniff and X-Frame-Options: DENY to dev server static responses
- Add path traversal (.. ) checks to all static file handlers and catch-all fetch

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-03-05 09:58:05 -08:00

37 lines
1.2 KiB
JavaScript

import { readFileSync, existsSync } from "fs";
import { join, dirname } from "path";
import { fileURLToPath } from "url";
const __filename = fileURLToPath(import.meta.url);
const __dirname = dirname(__filename);
const PROJECT_ROOT = join(__dirname, "../../..");
const ALLOWED_PROVIDERS = ['cursor', 'claude-code', 'gemini', 'codex', 'agents', 'universal'];
export default function handler(req, res) {
try {
const { provider } = req.query;
if (!provider || !ALLOWED_PROVIDERS.includes(provider)) {
return res.status(400).json({ error: "Invalid provider" });
}
const distDir = join(PROJECT_ROOT, "dist");
const zipPath = join(distDir, `${provider}.zip`);
if (!existsSync(zipPath)) {
return res.status(404).json({ error: "Bundle not found" });
}
const content = readFileSync(zipPath);
res.setHeader("Content-Type", "application/zip");
const safeProvider = provider.replace(/[^a-zA-Z0-9._-]/g, '');
res.setHeader("Content-Disposition", `attachment; filename="impeccable-style-${safeProvider}.zip"`);
res.send(content);
} catch (error) {
console.error("Error downloading bundle:", error);
res.status(500).json({ error: "Internal server error" });
}
}