1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
|
package admin
import (
"bytes"
"fmt"
"path/filepath"
"strings"
"gopkg.in/yaml.v3"
"thehouseoficarus/internal/behavior"
"thehouseoficarus/internal/persistence"
"thehouseoficarus/internal/world"
)
// validEntityID reports whether an entity ID can be safely joined into a
// file path under its data directory. IDs come from URL path segments and
// JSON bodies, so an unchecked join could otherwise escape the data
// directory ("../") or touch dot files.
func validEntityID(id string) bool {
if id == "" || id == "." || id == ".." || strings.HasPrefix(id, ".") {
return false
}
if strings.ContainsAny(id, `/\`) || strings.ContainsRune(id, 0) {
return false
}
for _, r := range id {
if r < 32 || r == 127 {
return false
}
}
return true
}
// resolveRoomSubdir validates a client-supplied room subdirectory and returns
// the cleaned path relative to <dataDir>/rooms. Absolute paths, ".." escapes,
// drive-like prefixes, and backslashes are rejected; the empty string is the
// rooms root. Room-directory API handlers must route body.Dir/patch.Dir through
// this before joining, mirroring validEntityID/resolveDataPath elsewhere.
func (s *AdminServer) resolveRoomSubdir(dir string) (string, error) {
dir = strings.TrimSpace(dir)
if dir == "" {
return "", nil
}
if filepath.IsAbs(dir) || strings.ContainsRune(dir, '\\') || strings.ContainsRune(dir, 0) {
return "", fmt.Errorf("invalid directory")
}
clean := filepath.Clean(dir)
if clean == "." {
return "", nil
}
if clean == ".." || strings.HasPrefix(clean, ".."+string(filepath.Separator)) {
return "", fmt.Errorf("directory escapes the rooms tree")
}
base := filepath.Join(s.dataDir, "rooms")
rel, err := filepath.Rel(base, filepath.Join(base, clean))
if err != nil || rel == ".." || strings.HasPrefix(rel, ".."+string(filepath.Separator)) {
return "", fmt.Errorf("directory escapes the rooms tree")
}
return clean, nil
}
// validateRoomSchema decodes a rendered room YAML into world.Room before it is
// written, so the editor cannot persist a room the runtime loader would later
// reject (for example a non-numeric exit target). KnownFields(true) also
// catches keys the runtime would silently ignore.
func validateRoomSchema(content []byte) error {
dec := yaml.NewDecoder(bytes.NewReader(content))
dec.KnownFields(true)
var room world.Room
return dec.Decode(&room)
}
func yamlToMap(data []byte) (map[string]any, error) {
var v any
if err := yaml.Unmarshal(data, &v); err != nil {
return nil, err
}
m, ok := stringifyMap(v).(map[string]any)
if !ok {
return nil, fmt.Errorf("yaml root is not a map")
}
return m, nil
}
func stringifyMap(v any) any {
switch val := v.(type) {
case map[interface{}]interface{}:
out := make(map[string]any, len(val))
for k, v := range val {
out[fmt.Sprint(k)] = stringifyMap(v)
}
return out
case map[string]interface{}:
out := make(map[string]any, len(val))
for k, v := range val {
out[k] = stringifyMap(v)
}
return out
case []interface{}:
out := make([]any, len(val))
for i, e := range val {
out[i] = stringifyMap(e)
}
return out
default:
return v
}
}
func writeMapAsYAML(path string, m map[string]any) ([]byte, error) {
content, err := marshalMapYAML(m)
if err != nil {
return nil, err
}
if err := persistence.WriteFile(path, content, 0644); err != nil {
return nil, err
}
return content, nil
}
// marshalMapYAML serializes a generic map without writing: callers that
// only need the after-image (mutation-plan preflight) use this.
func marshalMapYAML(m map[string]any) ([]byte, error) {
return behavior.MarshalYAMLMap(m)
}
|
