fix: check whether operation is under current project folder

Composer/packages/server/__tests__/controllers/project.test.ts

@@ -187,7 +187,7 @@ describe('dialog operation', () => {
     const mockReq = {
       params: { projectId },
       query: {},
-      body: { name: 'bot1.dialog', content: '' },
+      body: { name: 'bot1.dialog', content: JSON.stringify({ $kind: 'aaa' }) },
     } as Request;
     await ProjectController.updateFile(mockReq, mockRes);
     expect(mockRes.status).toHaveBeenCalledWith(200);
@@ -196,7 +196,7 @@ describe('dialog operation', () => {
     const mockReq = {
       params: { projectId },
       query: {},
-      body: { name: 'test2.dialog', content: '' },
+      body: { name: 'test2.dialog', content: JSON.stringify({ $kind: 'aaa' }) },
     } as Request;
     await ProjectController.createFile(mockReq, mockRes);
     expect(mockRes.status).toHaveBeenCalledWith(200);

Composer/packages/server/src/models/bot/botProject.ts

@@ -370,6 +370,7 @@ export class BotProject implements IBotProject {
     }
 
     const relativePath = file.relativePath;
+    this._validateFileContent(name, content);
     const lastModified = await this._updateFile(relativePath, content);
     return lastModified;
   };
@@ -414,6 +415,7 @@ export class BotProject implements IBotProject {
   public createFile = async (name: string, content = '') => {
     const filename = name.trim();
     this.validateFileName(filename);
+    this._validateFileContent(name, content);
     const botName = this.name;
     const defaultLocale = this.settings?.defaultLanguage || defaultLanguage;
     const relativePath = defaultFilePath(botName, defaultLocale, filename);
@@ -610,6 +612,9 @@ export class BotProject implements IBotProject {
   // to root dir instead of dataDir dataDir is not aware at this layer
   private _createFile = async (relativePath: string, content: string) => {
     const absolutePath = Path.resolve(this.dir, relativePath);
+    if (!absolutePath.startsWith(this.dir)) {
+      throw new Error('Cannot create file outside of current project folder');
+    }
     await this.ensureDirExists(Path.dirname(absolutePath));
     debug('Creating file: %s', absolutePath);
     await this.fileStorage.writeFile(absolutePath, content);
@@ -640,7 +645,9 @@ export class BotProject implements IBotProject {
     }
 
     const absolutePath = `${this.dir}/${relativePath}`;
-
+    if (!absolutePath.startsWith(this.dir)) {
+      throw new Error('Cannot update file outside of current project folder');
+    }
     // only write if the file has actually changed
     if (file.content !== content) {
       file.content = content;
@@ -666,7 +673,6 @@ export class BotProject implements IBotProject {
     const absolutePath = `${this.dir}/${relativePath}`;
     await this.fileStorage.removeFile(absolutePath);
   };
-
   // ensure dir exist, dir is a absolute dir path
   private ensureDirExists = async (dir: string) => {
     if (!dir || dir === '.') {
@@ -764,4 +770,18 @@ export class BotProject implements IBotProject {
       };
     }
   };
+
+  private _validateFileContent = (name: string, content: string) => {
+    const extension = Path.extname(name);
+    if (extension === '.dialog' || name === 'appsettings.json') {
+      try {
+        const parsedContent = JSON.parse(content);
+        if (typeof parsedContent !== 'object' || Array.isArray(parsedContent)) {
+          throw new Error('Invalid file content');
+        }
+      } catch (e) {
+        throw new Error('Invalid file content');
+      }
+    }
+  };
 }