fix(server): canonicalise media paths the same way their callers do (#9575)

Julius Marminge committed 2 months ago

Commit 5f4c7161 parent 912276b3 files · +22 −11Browse files

Unified · Split

3 files

apps/server/src/assets/AssetAccess.test.ts +2 −2
apps/server/src/assets/MediaFile.ts +10 −1
apps/server/src/project/ProjectFaviconResolver.test.ts +10 −8

apps/server/src/assets/AssetAccess.test.ts+2−2

@@ -754,7 +754,7 @@ describe("AssetAccess", () => { · 753 unmodified lines
754	projectFaviconPath: "brand/custom.svg",	754	projectFaviconPath: "brand/custom.svg",
755	});	755	});
756		756
757	expect(result.sourcePath).toBe("brand/custom.svg");	757	expect(result.sourcePath).toBe(path.join("brand", "custom.svg"));
758	expect(result.relativeUrl).toMatch(/\/v[0-9a-f]{64}-custom\.svg$/);	758	expect(result.relativeUrl).toMatch(/\/v[0-9a-f]{64}-custom\.svg$/);
759	}).pipe(Effect.provide(testLayer)),	759	}).pipe(Effect.provide(testLayer)),
760	);	760	);
@@ -813,7 +813,7 @@ describe("AssetAccess", () => { · 52 unmodified lines
813	projectFaviconPath: "brand/saved.svg",	813	projectFaviconPath: "brand/saved.svg",
814	});	814	});
815		815
816	expect(result.sourcePath).toBe("brand/saved.svg");	816	expect(result.sourcePath).toBe(path.join("brand", "saved.svg"));
817	expect(result.relativeUrl).toMatch(/\/v[0-9a-f]{64}-saved\.svg$/);	817	expect(result.relativeUrl).toMatch(/\/v[0-9a-f]{64}-saved\.svg$/);
818	}).pipe(Effect.provide(testLayer)),	818	}).pipe(Effect.provide(testLayer)),
819	);	819	);

apps/server/src/assets/MediaFile.ts+10−1

   readonly info: NodeFS.BigIntStats;
 }
+const realpathLikeFileSystem = (filePath: string) =>
+  new Promise<string>((resolve, reject) => {
+    NodeFS.realpath(filePath, (error, resolved) => (error ? reject(error) : resolve(resolved)));
+  });
 /** Opens a canonical media path once. Replacements cannot change the response's source. */
 export const openMediaFile = Effect.fn("openMediaFile")(function* (
   filePath: string,
           ) {
             return null;
           }
-          if ((await NodeFSP.realpath(filePath)) !== filePath) return null;
+          // Callers canonicalise with Effect's FileSystem.realPath, which is
+          // Node's JS realpath. fs/promises.realpath is the native binding and
+          // on Windows also expands 8.3 short names, so a path that is already
+          // canonical by the caller's rules would still look swapped here.
+          if ((await realpathLikeFileSystem(filePath)) !== filePath) return null;
           const after = await NodeFSP.lstat(filePath, { bigint: true });
           if (!after.isFile() || info.dev !== after.dev || info.ino !== after.ino) return null;
           accepted = true;

apps/server/src/project/ProjectFaviconResolver.test.ts+10−8

     it.effect("prefers a t3.json iconPath over well-known files", () =>
       Effect.gen(function* () {
         const resolver = yield* ProjectFaviconResolver.ProjectFaviconResolver;
+        const path = yield* Path.Path;
         const cwd = yield* makeTempDir;
         yield* writeTextFile(cwd, "t3.json", '{ "iconPath": "brand/mark.svg" }');
         yield* writeTextFile(cwd, "brand/mark.svg", "<svg>mark</svg>");
         const resolved = yield* resolver.resolvePath(cwd);
         expect(resolved).not.toBeNull();
-        expect(resolved).toContain("brand/mark.svg");
+        expect(resolved).toBe(path.join(cwd, "brand", "mark.svg"));
       }),
     );
     it.effect("uses a saved project favicon override", () =>
       Effect.gen(function* () {
         const resolver = yield* ProjectFaviconResolver.ProjectFaviconResolver;
+        const path = yield* Path.Path;
         const cwd = yield* makeTempDir;
         yield* writeTextFile(cwd, "brand/custom.svg", "<svg>custom</svg>");
         yield* writeTextFile(cwd, "favicon.svg", "<svg>automatic</svg>");
         const resolved = yield* resolver.resolvePath(cwd, "brand/custom.svg");
         expect(resolved).not.toBeNull();
-        expect(resolved).toContain("brand/custom.svg");
+        expect(resolved).toBe(path.join(cwd, "brand", "custom.svg"));
       }),
     );
         const resolved = yield* resolver.resolvePath(cwd);
         expect(resolved).not.toBeNull();
-        expect(resolved).toContain("public/brand/logo.svg");
+        expect(resolved).toBe((yield* Path.Path).join(cwd, "public", "brand", "logo.svg"));
       }),
     );
         const resolved = yield* resolver.resolvePath(cwd);
         expect(resolved).not.toBeNull();
-        expect(resolved).toContain("public/brand/logo.svg");
+        expect(resolved).toBe((yield* Path.Path).join(cwd, "public", "brand", "logo.svg"));
       }),
     );
         const resolved = yield* resolver.resolvePath(cwd);
         expect(resolved).not.toBeNull();
-        expect(resolved).toContain("public/brand/logo.svg");
+        expect(resolved).toBe((yield* Path.Path).join(cwd, "public", "brand", "logo.svg"));
       }),
     );
         const resolved = yield* resolver.resolvePath(cwd);
         expect(resolved).not.toBeNull();
-        expect(resolved).toContain("public/brand/logo.svg");
+        expect(resolved).toBe((yield* Path.Path).join(cwd, "public", "brand", "logo.svg"));
       }),
     );
         const resolved = yield* resolver.resolvePath(cwd);
         expect(resolved).not.toBeNull();
-        expect(resolved).toContain("public/brand/logo.svg");
+        expect(resolved).toBe((yield* Path.Path).join(cwd, "public", "brand", "logo.svg"));
       }),
     );
         const resolved = yield* resolver.resolvePath(cwd);
         expect(resolved).not.toBeNull();
-        expect(resolved).toContain("public/brand/logo.svg");
+        expect(resolved).toBe((yield* Path.Path).join(cwd, "public", "brand", "logo.svg"));
       }),
     );
   });

fix(server): canonicalise media paths the same way their callers do (#9575)

Keyboard shortcuts

General

Issues and pull requests

Issues, pull requests and Inbox

Repository code