🏗️ Phase 1 for production readyness

lib/markdown.ts

@@ -15,6 +15,15 @@ export function sanitizePath(inputPath: string): string {
   if (normalized.includes('..') || path.isAbsolute(normalized)) {
     throw new Error('Invalid path')
   }
+
+  // CRITICAL: Verify resolved path stays within content directory
+  const resolvedPath = path.resolve(POSTS_PATH, normalized)
+  const allowedBasePath = path.resolve(POSTS_PATH)
+
+  if (!resolvedPath.startsWith(allowedBasePath)) {
+    throw new Error('Path traversal attempt detected')
+  }
+
   return normalized
 }
 

lib/remark-copy-images.ts

@@ -39,8 +39,9 @@ async function copyAndRewritePath(node: ImageNode, options: Options): Promise<vo
 
   const sourcePath = path.resolve(contentPostDir, urlWithoutParams)
 
-  if (sourcePath.includes('..') && !sourcePath.startsWith(path.join(process.cwd(), contentDir))) {
-    throw new Error(`Invalid image path: ${node.url} (path traversal detected)`)
+  const allowedBasePath = path.join(process.cwd(), contentDir)
+  if (!sourcePath.startsWith(allowedBasePath)) {
+    throw new Error(`Invalid image path outside content directory: ${node.url}`)
   }
 
   const relativeToContent = path.relative(path.join(process.cwd(), contentDir), sourcePath)