Dynamic block loading proof-of-concept #158
Conversation
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 8db643f1e5
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
| const version = Date.now(); | ||
| const filename = `${name}-${version}.js`; | ||
| const filepath = path.join(DYNAMIC_BLOCKS_DIR, filename); |
There was a problem hiding this comment.
The name field comes straight from the request body and is interpolated into filename before being passed to path.join, which means a caller can include path separators (e.g. ../) and escape public/dynamic-blocks, resulting in arbitrary file writes relative to the server’s working directory. This is a security issue if the endpoint is reachable outside trusted tooling. Consider restricting name to a safe slug (e.g. /^[A-Za-z0-9_-]+$/) or using path.basename and rejecting any .. or separator characters before composing the path.
Useful? React with 👍 / 👎.
| build.onResolve({ filter: /^\./ }, args => { | ||
| const resolved = args.path.replace(/^\.\//, ''); | ||
| return { path: resolved, namespace: 'virtual' }; |
There was a problem hiding this comment.
The virtual filesystem resolver strips ./ and returns a path without using args.resolveDir, and the loader doesn’t set a resolveDir for virtual modules. As a result, relative imports from nested source files (e.g. components/Card.tsx importing ./Button) will be resolved as Button instead of components/Button, leading to “Virtual file not found” errors and failed compilation for any block that organizes code in subdirectories. Use path.join(args.resolveDir, args.path) and/or set resolveDir in onLoad to the file’s directory.
Useful? React with 👍 / 👎.
No description provided.