update scripts

labring · Sep 4, 2024 · 584e760 · 584e760
1 parent 2a14e69
commit 584e760
Showing 1 changed file with 27 additions and 12 deletions.
diff --git a/docs/website/scripts/sync-docs.js b/docs/website/scripts/sync-docs.js
@@ -6,6 +6,26 @@ const versions = ['5.0.0', '4.0.0']
 const websiteDir = path.resolve(__dirname, '..')
 const rootDir = path.resolve(websiteDir, '..')
 
+// 定义允许的目录白名单
+const allowedDirs = [
+  'i18n/zh-Hans/docusaurus-plugin-content-blog',
+  'i18n/zh-Hans/docusaurus-plugin-content-docs',
+  'versioned_docs',
+  'versioned_sidebars'
+]
+
+// 安全的路径拼接函数
+function safeJoin (base, dir) {
+  if (!allowedDirs.includes(dir)) {
+    throw new Error(`Invalid directory: ${dir}`)
+  }
+  const fullPath = path.normalize(path.join(base, dir))
+  if (!fullPath.startsWith(base)) {
+    throw new Error(`Path traversal detected: ${fullPath}`)
+  }
+  return fullPath
+}
+
 async function generateVersionsJson () {
   const versionsJsonPath = path.join(websiteDir, 'versions.json')
   await fs.writeJson(versionsJsonPath, versions, { spaces: 2 })
@@ -14,12 +34,7 @@ async function generateVersionsJson () {
 async function syncDocs () {
   try {
     // Remove specified directories
-    const dirsToRemove = [
-      'i18n/zh-Hans/docusaurus-plugin-content-blog',
-      'i18n/zh-Hans/docusaurus-plugin-content-docs',
-      'versioned_docs',
-      'versioned_sidebars'
-    ].map(dir => path.join(websiteDir, dir))
+    const dirsToRemove = allowedDirs.map(dir => safeJoin(websiteDir, dir))
 
     await Promise.all(dirsToRemove.map(dir => fs.remove(dir)))
 
@@ -29,24 +44,24 @@ async function syncDocs () {
       // Sync English docs
       await fs.copy(
         path.join(rootDir, shortVersion, 'docs'),
-        path.join(websiteDir, 'versioned_docs', `version-${version}`)
+        safeJoin(websiteDir, 'versioned_docs', `version-${version}`)
       )
 
       // Sync Chinese docs
       await fs.copy(
         path.join(rootDir, shortVersion, 'i18n', 'zh-Hans'),
-        path.join(websiteDir, 'i18n/zh-Hans/docusaurus-plugin-content-docs', `version-${version}`)
+        safeJoin(websiteDir, 'i18n/zh-Hans/docusaurus-plugin-content-docs', `version-${version}`)
       )
 
       // Copy sidebar files
       const sidebarPaths = [
         {
           src: path.join(rootDir, shortVersion, 'sidebar.json'),
-          dest: path.join(websiteDir, 'versioned_sidebars', `version-${version}-sidebars.json`)
+          dest: safeJoin(websiteDir, 'versioned_sidebars', `version-${version}-sidebars.json`)
         },
         {
           src: path.join(rootDir, shortVersion, 'i18n', 'zh-Hans', 'sidebar.json'),
-          dest: path.join(websiteDir, 'i18n/zh-Hans/docusaurus-plugin-content-docs', `version-${version}.json`)
+          dest: safeJoin(websiteDir, 'i18n/zh-Hans/docusaurus-plugin-content-docs', `version-${version}.json`)
         }
       ]
 
@@ -60,13 +75,13 @@ async function syncDocs () {
     // Sync code.json
     await fs.copy(
       path.join(rootDir, '5.0/code.json'),
-      path.join(websiteDir, 'i18n/zh-Hans/code.json')
+      safeJoin(websiteDir, 'i18n/zh-Hans/code.json')
     )
 
     // Sync blog content
     await fs.copy(
       path.join(rootDir, 'blog/zh-Hans'),
-      path.join(websiteDir, 'i18n/zh-Hans/docusaurus-plugin-content-blog')
+      safeJoin(websiteDir, 'i18n/zh-Hans/docusaurus-plugin-content-blog')
     )
 
     await generateVersionsJson()