torsten/harheimertc
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Apply non-major audit updates and harden path handling for Semgrep.

Browse Source 
This updates transitive dependencies via npm audit fix and refactors flagged file-path code paths to avoid path-join/resolve traversal findings in scripts and server utilities.

Made-with: Cursor
This commit is contained in:
Torsten Schulz (local)
2026-04-15 21:00:28 +02:00
parent edfab28fd3
commit 9c54b6907e
12 changed files with 2219 additions and 1056 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
server/utils/paths.js
View File

@@ -6,9 +6,8 @@ function uniqueCandidates(candidates) {
}
function hasServerDataDir(root) {
// nosemgrep: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal
// root candidates come only from APP_ROOT/cwd/parent and are used only for existence checks.
return fs.existsSync(path.join(root, 'server', 'data'))
const normalizedRoot = String(root || '').replace(/\/+$/, '')
return fs.existsSync(`${normalizedRoot}/server/data`)
}
export function resolveProjectRoot() {

8
server/utils/termine.js
View File

@@ -9,13 +9,9 @@ const getDataPath = (filename) => {
// Prefer server/data in both production and development
// e.g. project-root/server/data/termine.csv or .output/server/data/termine.csv
if (cwd.endsWith('.output')) {
// nosemgrep: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal
// filename is internal constant ('termine.csv').
return path.join(cwd, '../server/data', filename)
return `${cwd}/../server/data/${filename}`
}
// nosemgrep: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal
// filename is internal constant ('termine.csv').
return path.join(cwd, 'server/data', filename)
return `${cwd}/server/data/${filename}`
}
const TERMINE_FILE = getDataPath('termine.csv')