From 7fd8ae462993f0a1a8a034b5938d309d63920043 Mon Sep 17 00:00:00 2001 From: dc Date: Sun, 27 Sep 2026 22:44:49 +0000 Subject: [PATCH] fix(mocks): keep the mock hook reader inside the Drive mockHookSource resolves the hook value against the Drive and eval()s what it finds. A hook value carrying '..' segments resolved outside files/ - mock-only, but the value is hand-edited mock config. Refuse anything that does not resolve under files/. --- sas/mocks/sasjs/services/dcMockUtils.js | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/sas/mocks/sasjs/services/dcMockUtils.js b/sas/mocks/sasjs/services/dcMockUtils.js index f79696e..2de2364 100644 --- a/sas/mocks/sasjs/services/dcMockUtils.js +++ b/sas/mocks/sasjs/services/dcMockUtils.js @@ -366,6 +366,11 @@ function mockHookSource(hookValue) { // sitting in the same place on the Drive. hook = hook.replace(/\.sas$/i, '') const hookFile = nodePath.resolve(driveRoot, 'files', appLoc, hook + '.js') + // The hook value is hand-edited mock config, and a value carrying '..' + // segments would otherwise resolve outside the Drive and be eval()'d + // in-service. Keep it inside the Drive's files tree. + const filesRoot = nodePath.resolve(driveRoot, 'files') + if (!hookFile.startsWith(filesRoot + nodePath.sep)) return null if (!fs.existsSync(hookFile)) return null return fs.readFileSync(hookFile, 'utf8') }