[bun:FileSystemRouter] add more validations on parameters (#3053)

* add validations and allow relative path on  dir

* remove unneed things

* add origin/dir validation tests

* remove workaround

* add back relative path resolution

1 files changed, 28 insertions, 2 deletions

diff --git a/src/bun.js/api/filesystem_router.zig b/src/bun.js/api/filesystem_router.zig
index fff726552..ec95ec373 100644
--- a/src/bun.js/api/filesystem_router.zig
+++ b/src/bun.js/api/filesystem_router.zig
@@ -178,6 +178,7 @@ pub const FileSystemRouter = struct {
         var origin_str: ZigString.Slice = .{};
         var asset_prefix_slice: ZigString.Slice = .{};
 
+        var out_buf: [bun.MAX_PATH_BYTES * 2]u8 = undefined;
         if (argument.get(globalThis, "style")) |style_val| {
             if (!style_val.getZigString(globalThis).eqlComptime("nextjs")) {
                 globalThis.throwInvalidArguments("Only 'nextjs' style is currently implemented", .{});
@@ -189,10 +190,25 @@ pub const FileSystemRouter = struct {
         }
 
         if (argument.get(globalThis, "dir")) |dir| {
+            if (!dir.isString()) {
+                globalThis.throwInvalidArguments("Expected dir to be a string", .{});
+                return null;
+            }
             const root_dir_path_ = dir.toSlice(globalThis, globalThis.allocator());
             if (!(root_dir_path_.len == 0 or strings.eqlComptime(root_dir_path_.slice(), "."))) {
-                root_dir_path = root_dir_path_;
+                // resolve relative path if needed
+                const path = root_dir_path_.slice();
+                if (bun.path.Platform.isAbsolute(.auto, path)) {
+                    root_dir_path = root_dir_path_;
+                } else {
+                    var parts = [_][]const u8{path};
+                    root_dir_path = JSC.ZigString.Slice.fromUTF8NeverFree(bun.path.joinAbsStringBuf(Fs.FileSystem.instance.top_level_dir, &out_buf, &parts, .auto));
+                }
             }
+        } else {
+            // dir is not optional
+            globalThis.throwInvalidArguments("Expected dir to be a string", .{});
+            return null;
         }
         var arena = globalThis.allocator().create(std.heap.ArenaAllocator) catch unreachable;
         arena.* = std.heap.ArenaAllocator.init(globalThis.allocator());
@@ -233,13 +249,13 @@ pub const FileSystemRouter = struct {
 
             asset_prefix_slice = asset_prefix.toSlice(globalThis, allocator).clone(allocator) catch unreachable;
         }
-
         var orig_log = vm.bundler.resolver.log;
         var log = Log.Log.init(allocator);
         vm.bundler.resolver.log = &log;
         defer vm.bundler.resolver.log = orig_log;
 
         var path_to_use = (root_dir_path.cloneWithTrailingSlash(allocator) catch unreachable).slice();
+
         var root_dir_info = vm.bundler.resolver.readDirInfo(path_to_use) catch {
             globalThis.throwValue(log.toJS(globalThis, globalThis.allocator(), "reading root directory"));
             origin_str.deinit();
@@ -253,11 +269,13 @@ pub const FileSystemRouter = struct {
             globalThis.allocator().destroy(arena);
             return null;
         };
+
         var router = Router.init(vm.bundler.fs, allocator, .{
             .dir = path_to_use,
             .extensions = if (extensions.items.len > 0) extensions.items else default_extensions,
             .asset_prefix_path = asset_prefix_slice.slice(),
         }) catch unreachable;
+
         router.loadRoutes(&log, root_dir_info, Resolver, &vm.bundler.resolver, router.config.dir) catch {
             globalThis.throwValue(log.toJS(globalThis, globalThis.allocator(), "loading routes"));
             origin_str.deinit();
@@ -267,6 +285,12 @@ pub const FileSystemRouter = struct {
         };
 
         if (argument.get(globalThis, "origin")) |origin| {
+            if (!origin.isString()) {
+                globalThis.throwInvalidArguments("Expected origin to be a string", .{});
+                arena.deinit();
+                globalThis.allocator().destroy(arena);
+                return null;
+            }
             origin_str = origin.toSlice(globalThis, globalThis.allocator());
         }
 
@@ -290,8 +314,10 @@ pub const FileSystemRouter = struct {
             .arena = arena,
             .allocator = allocator,
         };
+
         router.config.dir = fs_router.base_dir.?.slice();
         fs_router.base_dir.?.ref();
+
         return fs_router;
     }