fix sonar issues

Author: mathiasconradt

models/boardRepository.js

@@ -22,7 +22,7 @@ function createBoardRepository(config) {
   }
 
   async function writeSplitBoard(board) {
-    await fs.mkdir(safePathInsideRoot(config.boardDir, config.workspaceDir), { recursive: true });
+    await fs.mkdir(safePathInsideRoot(config.boardDir, config.workspaceDir), { recursive: true }); // NOSONAR: path is constrained to the configured vault root.
     const {
       lists,
       labels,
@@ -46,7 +46,7 @@ function createBoardRepository(config) {
     const directory = safePathInsideRoot(path.join(config.boardDir, name), config.boardDir);
     let entries = [];
     try {
-      entries = await fs.readdir(directory, { withFileTypes: true });
+      entries = await fs.readdir(directory, { withFileTypes: true }); // NOSONAR: directory is constrained to the board data root.
     } catch (error) {
       if (error.code === "ENOENT") return [];
       throw error;
@@ -62,7 +62,7 @@ function createBoardRepository(config) {
 
   async function writeJsonCollection(name, items) {
     const directory = safePathInsideRoot(path.join(config.boardDir, name), config.boardDir);
-    await fs.mkdir(directory, { recursive: true });
+    await fs.mkdir(directory, { recursive: true }); // NOSONAR: directory is constrained to the board data root.
     const desiredFiles = new Set();
 
     for (const item of items) {
@@ -76,7 +76,7 @@ function createBoardRepository(config) {
 
     let entries = [];
     try {
-      entries = await fs.readdir(directory, { withFileTypes: true });
+      entries = await fs.readdir(directory, { withFileTypes: true }); // NOSONAR: directory is constrained to the board data root.
     } catch (error) {
       if (error.code === "ENOENT") return;
       throw error;

services/boardService.js

@@ -20,7 +20,7 @@ function createBoardService(config) {
   async function seedBoard() {
     try {
       if (await exists(config.boardFilePath, config.workspaceDir)) {
-        const raw = await fs.readFile(safePathInsideRoot(config.boardFilePath, config.workspaceDir), "utf8");
+        const raw = await fs.readFile(safePathInsideRoot(config.boardFilePath, config.workspaceDir), "utf8"); // NOSONAR: board file is constrained to the vault root.
         return normalizer.normalizeBoard(JSON.parse(raw));
       }
     } catch {
@@ -29,14 +29,14 @@ function createBoardService(config) {
 
     try {
       const sampleExportDir = safePathInsideRoot(config.sampleExportDir, config.workspaceDir);
-      const entries = await fs.readdir(sampleExportDir, { withFileTypes: true });
+      const entries = await fs.readdir(sampleExportDir, { withFileTypes: true }); // NOSONAR: sample directory is constrained to the vault root.
       const sample = entries
         .filter((entry) => entry.isFile() && entry.name.toLowerCase().endsWith(".json"))
         .sort((left, right) => left.name.localeCompare(right.name))[0];
 
       if (sample) {
         const samplePath = safePathInsideRoot(path.join(sampleExportDir, sample.name), sampleExportDir);
-        const raw = await fs.readFile(samplePath, "utf8");
+        const raw = await fs.readFile(samplePath, "utf8"); // NOSONAR: sample file is constrained to the sample export directory.
         return normalizer.normalizeBoard(JSON.parse(raw));
       }
     } catch {

services/gitService.js

@@ -10,7 +10,7 @@ function createGitService(config) {
   async function hasGitRepository(rootPath = config.workspaceDir) {
     try {
       const gitPath = safePathInsideRoot(path.join(rootPath, ".git"), config.workspaceDir);
-      const stat = await fs.stat(gitPath);
+      const stat = await fs.stat(gitPath); // NOSONAR: git path is constrained to the configured vault root.
       return stat.isDirectory() || stat.isFile();
     } catch {
       return false;

utils/fileUtils.js

@@ -6,7 +6,7 @@ const { safePathInsideRoot } = require("./pathUtils");
 
 async function exists(filePath, rootPath) {
   try {
-    await fs.access(safePathInsideRoot(filePath, rootPath));
+    await fs.access(safePathInsideRoot(filePath, rootPath)); // NOSONAR: path is constrained to the caller-provided root.
     return true;
   } catch {
     return false;
@@ -15,7 +15,7 @@ async function exists(filePath, rootPath) {
 
 async function readJsonFile(filePath, fallback, rootPath) {
   try {
-    return JSON.parse(await fs.readFile(safePathInsideRoot(filePath, rootPath), "utf8"));
+    return JSON.parse(await fs.readFile(safePathInsideRoot(filePath, rootPath), "utf8")); // NOSONAR: path is constrained to the caller-provided root.
   } catch (error) {
     if (error.code === "ENOENT") return fallback;
     throw error;
@@ -26,7 +26,7 @@ async function writeJsonIfChanged(filePath, value, rootPath) {
   const safePath = safePathInsideRoot(filePath, rootPath);
   const next = `${JSON.stringify(value, null, 2)}\n`;
   try {
-    const current = await fs.readFile(safePath, "utf8");
+    const current = await fs.readFile(safePath, "utf8"); // NOSONAR: safePath is constrained to the caller-provided root.
     if (current === next) return;
   } catch (error) {
     if (error.code !== "ENOENT") throw error;
@@ -39,8 +39,8 @@ async function writeTextAtomically(filePath, text, rootPath) {
   const directory = path.dirname(safePath);
   const tmpPath = safePathInsideRoot(`${safePath}.${process.pid}.${Date.now()}.tmp`, rootPath);
   await fs.mkdir(directory, { recursive: true });
-  await fs.writeFile(tmpPath, text, "utf8");
-  await fs.rename(tmpPath, safePath);
+  await fs.writeFile(tmpPath, text, "utf8"); // NOSONAR: tmpPath is constrained to the caller-provided root.
+  await fs.rename(tmpPath, safePath); // NOSONAR: both paths are constrained to the caller-provided root.
 }
 
 module.exports = {

utils/pathUtils.js

@@ -9,9 +9,12 @@ function canonicalWorkspacePath(candidatePath, allowedRoots) {
     throw new Error("Invalid workspace path.");
   }
 
-  fsSync.mkdirSync(resolvedPath, { recursive: true });
-  const canonicalPath = fsSync.realpathSync(resolvedPath);
   const allowed = allowedRoots.map(canonicalDirectory);
+  if (!allowed.some((rootPath) => isPathInside(resolvedPath, rootPath))) {
+    throw new Error("Workspace path must be inside your home directory, current directory, or temporary directory.");
+  }
+  fsSync.mkdirSync(resolvedPath, { recursive: true }); // NOSONAR: resolvedPath is validated against allowed roots above.
+  const canonicalPath = fsSync.realpathSync(resolvedPath); // NOSONAR: resolvedPath is validated against allowed roots above.
   if (!allowed.some((rootPath) => isPathInside(canonicalPath, rootPath))) {
     throw new Error("Workspace path must be inside your home directory, current directory, or temporary directory.");
   }